← CTRL-ALT-LEAD with David Hinson
Loading summary
Transcript1 lines
- [00:11]
A
This town ain't my home. Set us only for a while. I'm David Hinson and I serve as campus CIO for Bolden Networks for Higher Education. Welcome to Control Alt Lead. If you've spent five minutes on LinkedIn lately or sat through a single board meeting this year, you've heard the sirens. Everyone is screaming about AI. The futurists want you to believe that if you aren't currently deploying predictive algorithms to grade papers, restructure your curriculum, or read the minds of prospective freshmen, your institution is already dead in the water. But let's pause, let's take a breath and talk about reality. Because if you're a sitting cio, a cfo, or a president looking at the actual ledger, you know the truth. AI isn't the priority right now. Not even close. It's a shiny hood ornament on a car that currently lacks a working transmission. The real tech priority in higher education today isn't flashy. It doesn't look good in a glossy recruitment brochure, and IT sure as hell won't make for a sexy press release. The real priority is cleaning up the plumbing. For the last 20 years, higher ed IT departments functioned like high end tool managers. If a dean wanted a specific software package, well, we bought it. If a department head wanted a boutique server under their desk, we provisioned it. We collected applications like hoarders, layering system upon system, patch upon patch, creating an architectural nightmare of siloed data and fragile dependencies. Now those days are over. The luxury of running an inefficient and bloated technology curiosity shop has died because the demographic realities of the enrollment cliff have collided with a hyper aggressive cyber threat landscape. Today our job isn't to manage tools, it's to manage institutional risk. We aren't just technologists anymore. We have to be trusted business partners capable of keeping our institutions financially viable. And if we don't clean up the plumbing, nothing else we build on top of it is going to matter. Let's look closely at what's actually broken. When I talk about the plumbing, I'm talking about the core infrastructure. Specifically your erp, your student information system, your legacy identity management, and your mission critical SAS connections. In most universities, these systems look like a house where the previous owners ran extension cords through all the windows and tapped directly into the water mains with duct tape. We've tolerated this because higher ed culture historically has valued radical autonomy over enterprise discipline. But let's face the math. We're staring down an unprecedented contraction in our traditional student numbers. Budgets are tightening to the point of fracture. At the same time, higher ed has become the number one target for sophisticated collaborative ransomware syndicates. They aren't script kiddies in a basement anymore. They're organized corporate enterprises targeting our ecosystems because they know our architecture is sprawling, porous, and overly reliant on single points of failure. Look at what just happened with Instructure and Canvas. That hit wasn't just a localized data breach. It was a direct strike on the central nervous system of global learning infrastructure. When an exploit compromises a vendor of that scale, the potential for downstream damage ripples across the 8,000 schools depending upon that LMS every single second to deliver course content, process grades, and authenticate identities. When the primary plumbing leaks at the source, thousands of campuses instantly face severe secondary operational exposure. Lets be crystal clear, every single vendor security breach must be treated as a direct attack on the institution itself. The moment a critical third party SAS vendor is compromised. It isn't an isolated vendor issue. It's your issue. If they hold your student data, your grades, or your financial records, their perimeter is your perimeter. That means each vendor incident should immediately trigger the exact same enterprise incident response plan you'd deploy if the school's physical server room was directly attacked or compromised. You don't wait around for the vendor to send a glossy postmortem newsletter three weeks later. You activate your containment protocols, pull your leadership team into the war room, isolate your API endpoints, and treat it with the exact same tactical urgency as a hostile actor sitting inside your firewall. When a crisis like that threatens your perimeter, the board doesn't care about your AI roadmap. They care about operational uptime. They want to know if we can keep our classes online. Are our identity integrations secure? Or is the contagion traveling through our integrations right now? Are our backups immutable, or did the ROT reach those too? This is exactly why we have to stop treating third party SaaS vendors like independent islands and start treating them as extensions of our own infrastructure. We need real weapons to manage vendor risk, and fortunately, we have them if we actually have the discipline to use them. Before a single contract ever gets routed to the cfo, we must demand proof of operational integrity. That means drawing a line in the sand on SOC 2 type 2 attestations and demanding exhaustive disclosures within Hecvat, which is the higher education community vendor assessment tool. A vendor's marketing slick says that they're secure, but a SOC 2 report actually proves it by auditing their operational controls over a sustained period of time. A HECVAT submission forces them to detail exactly how they handle data governance, privacy and architecture, specifically within the higher ed context. These aren't bureaucratic hoops, they're shields. If a vendor balks at providing an updated SoC2 or hands over an incomplete HeCVAT, that isn't a minor administrative delay, it's a massive red flag. It means they want your students data but aren't willing to prove they can protect it. Proving it's value today means moving completely away from prevention hype and focusing on documented resilient recovery. It's about building a true zero trust architecture and using these compliance frameworks to manage our exposure. If you can't guarantee that your institution can isolate a vendor breach, trigger an immediate internal incident response, and maintain operational resilience without compromising student data, you aren't managing risk. You're gambling with the institution's survival. But cleanup isn't just about cybersecurity. It's about operational survival through enterprise simplification. Every single redundant application on your campus represents two a security vulnerability and financial drain. Every time we allow a department to buy a standalone SaaS tool because they don't like the enterprise option, we're adding friction to the plumbing. We're creating another data silo, another integration point that has to be maintained, and another contract the CFO has to sign as a strategic technology partner. You have to find the courage to walk into those rooms and say no. Not because we want to restrict academic freedom, but because simplification is a financial imperative. When we migrate to the cloud and aggressively deprecate legacy systems, we aren't just shifting workloads. We're stripping out structural costs. We're freeing up capital that the institution desperately needs to keep the lights on and the faculty paid. This brings us to the core of the entire plumbing data strategy. You can't make proactive, data driven decisions to navigate an enrollment crisis if your data is trapped in five different disconnected systems. If the admissions team has one version of a student's reality, the registrar has another and financial aid has a third. You don't have an enterprise. You have a collection of competing fiefdoms. A real data strategy isn't about buying a new analytics dashboard. It's about data governance. It's the hard, unglamorous work of defining a single source of truth. It's making sure that when the president asks for a retention forecast, the numbers are accurate, verified and actionable. Clean plumbing means clean data. And clean data is the only tool that will allow our institutions to make the disciplined adjustments required to survive the next decade. This shift from tool manager to risk manager changes the entire nature of the campus CIO role. For years it was viewed as a cost center, meaning it was treated like a black hole where money went in and occasionally a working laptop came out. To change that perception, we have to speak the language of business. The board doesn't want to hear about server uptime, bandwidth metrics, or network throughput. They want to hear about risk mitigation, capital preservation, and operational resilience. When you sit down with your cfo, you shouldn't be pitching a tech project. You should be pitching a business solution. You're showing them how using tools like SoC2 and Hecvat to vet your stack protects the bottom line. You're showing them how a strict uniform incident response plan for external breaches limits liability. You're showing them how enterprise simplification lowers the total cost of ownership. You're showing them how a modernized, tightly governed data framework improves student retention metrics. You're proving that a disciplined approach to the tech stack is directly tied to the financial viability of the college. This isn't just a theory for me, it's the playbook I've spent the last 15 years executing across different campuses, whether balancing fractional leadership roles or structuring enterprise network strategies. Here at Bolden, I've watched institutions stall out because they tried to build the future on top of a cracked foundation. And I've watched institutions thrive because they had the discipline to stop chasing the hype cycle, roll up their sleeves, and fix the core pipelines first. So stop the hand wringing over AI. Let's stop letting the vendors dictate our institutional strategies with buzzwords designed to create artificial panic. If you want to lead your campus through this transition, look down at the floorboards, check the integrations, look at the data silos, audit the vendor connections that are eating your budget and exposing your perimeters. The institutions that Survive the next 10 years won't be the ones that deploy the flashiest tools. They'll be the ones that had the operational discipline to to simplify their footprint, secure their data pipelines, mandate uniform crisis response for vendor breakdowns, and manage their institutional risk with cold, hard metrics. Get your teams out of the clouds of hype and get them into the trenches of infrastructure. Clean up the plumbing. Your institution's survival depends on it. Thanks for listening. I'll see you. A Better Late than Never this week's episode uses an AI voice clone trained upon hours of my natural speaking voice. While the voice you hear today is cloned. The words, thoughts and ideas here are 100% my own.