Verizon's 2026 Data Breach Investigations Report counted 1,302 security incidents in Educational Services, 1,252 of them with confirmed data disclosure. System Intrusion accounted for 52 percent of Education breaches, roughly three times as often as any other pattern. Ransomware appeared in 65 percent of malware-related breaches in the sector, and the primary malware vector was web applications, in 71 percent of cases. External actors drove 78 percent of breaches and 78 percent of them were financially motivated. Those four numbers describe a campus attack path precisely: an internet-facing application, credentials or an unpatched flaw, then lateral movement into the systems that hold student records.
Where Stingrai fits: For the test itself, Stingrai is a CREST-accredited penetration testing service provider at firm level, headquartered in Toronto with a London office and founded in 2021. Each engagement is staffed with two named penetration testers holding OSCE3, OSCP, OSWE, OSEP, CREST CRT and CISSP, with 18 published CVEs across the team. On a campus that covers the student information system and portal tested authenticated as student, faculty, registrar and administrator, the integrations hanging off the learning platform, single sign on and multi-factor flows in Entra ID, the Active Directory forest behind them, the external perimeter, residence and guest wireless, and staff phishing, delivered as a one-time annual engagement or a continuous programme through its PTaaS platform with retesting and an attestation letter included. Published pricing is US$3,000 for an Autonomous Pentest and US$6,800 for a Hybrid Pentest covering one web application and its APIs (pricing); every other campus scope is quoted.
What a campus test has to satisfy is more specific than most vendor marketing suggests, and the single most common error in higher education security procurement is citing the wrong regulation. FERPA does not tell you to run a penetration test. The Gramm-Leach-Bliley Act does, because a Title IV institution is a financial institution. The ranking below is built around that distinction, and every vendor entry links to a page on the vendor's own site, verified on 19 September 2026.
Quick answer: who are the best higher education penetration testing companies in 2026?
The best higher education penetration testing companies in 2026 are Stingrai, CampusGuard, Compass IT Compliance, OCD Tech, Schneider Downs, SBS CyberSecurity, Bulletproof, Rapid7, Packetlabs, Plante Moran and BDO Canada. Stingrai is a CREST-accredited penetration testing service provider at firm level, headquartered in Toronto with a London office, staffing each engagement with two named penetration testers who work the student information system across every role, single sign on and Active Directory, the perimeter, campus wireless and staff phishing, delivered one-time or continuously through its PTaaS platform with retesting and an attestation letter included. CampusGuard, Compass IT Compliance and OCD Tech follow for higher-education-only coverage, New England institutional depth and combined IT audit and testing respectively.
What universities and colleges are actually required to test
Several regimes turn up in a single campus procurement file, and they say very different things.
Does GLBA require universities to run a penetration test?
Yes, for Title IV institutions, and this is the requirement that binds. Because colleges and universities administer federal student financial aid, they meet the definition of a financial institution under the Gramm-Leach-Bliley Act and fall under the Federal Trade Commission's Safeguards Rule. 16 CFR 314.4(d) requires regular testing of the effectiveness of key controls, and paragraph (d)(2) requires that for information systems, that testing include continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months, and after any material change.
Enforcement runs through the Department of Education rather than the FTC. Federal Student Aid's announcement GENERAL-23-09 confirmed the updated rule took effect on 9 June 2023, that institutions must maintain a written information security program covering nine required elements, and that GLBA compliance is examined in the annual compliance audit, with a corrective action plan required where an auditor finds noncompliance. Two consequences follow. The test is not optional unless the institution can evidence continuous monitoring achieving equivalent outcomes, and a vulnerability scanner subscription is not that evidence. And the testing calendar has to align with the fiscal year the auditor examines, not with whenever budget frees up.
Does FERPA require penetration testing?
No. The Family Educational Rights and Privacy Act, implemented at 34 CFR Part 99, governs who may see and disclose education records. It prescribes no security control catalogue, no technical safeguards and no testing cadence. FERPA shapes what a breach costs in consequences and notification obligations, not how often an institution tests. A proposal leading with FERPA-mandated penetration testing is describing a requirement that does not exist.
What about HIPAA, campus health services and medical schools?
Campus health centres, counselling services, student insurance plans and academic medical centres can be covered entities or parts of hybrid entities under HIPAA. Where they are, the protected health information they hold sits outside FERPA's education records definition and inside the HIPAA Security Rule, which requires a risk analysis, a periodic technical and nontechnical evaluation and maintenance of security measures rather than naming a test. The clause-by-clause treatment is in the HIPAA penetration testing requirements guide. The scoping point is boundary definition: a campus test that never crosses into the clinical network cannot tell you whether the hybrid entity boundary holds.
What does PCI DSS require for tuition and campus payments?
A university is a merchant many times over: tuition and housing, the bookstore, dining, parking, athletics ticketing, conference services, alumni giving and departmental event registrations. PCI DSS v4.0.1 requirement 11.4 asks for external and internal penetration testing at least once every 12 months and after any significant infrastructure or application change, plus testing to confirm that segmentation isolating the cardholder data environment is effective. On a decentralised campus, segmentation testing is often the finding that matters most, because departmental systems drift into scope quietly. The walkthrough is in the PCI DSS penetration testing guide.
Do research contracts require penetration testing under NIST SP 800-171 and CMMC?
Not as a control, but as the evidence behind several. Universities holding Department of Defense research contracts inherit DFARS 252.204-7012 and all 110 requirements of NIST SP 800-171 Revision 2. Penetration testing is not one of those 110. It is the artifact that makes 3.11.2, 3.12.1, 3.12.3 and 3.14.1 defensible when an assessor reads the file. The CMMC picture moved in 2026: the Department of War suspended the transition to Phase 2 in July 2026 and Class Deviation 2026-O0025 Revision 3 of 3 September 2026 made that binding on contracting officers, while the security requirements themselves did not change. Current state is in the CMMC penetration testing companies guide.
Canadian institutions meet a parallel obligation through research security. The federal Policy on Sensitive Technology Research and Affiliations of Concern, in effect since 1 May 2024, conditions tri-agency and Canada Foundation for Innovation funding on research affiliation attestations, and institutions are increasingly asked to show the research data environment is segregated and tested.
What do state and provincial rules add?
In Texas, 1 TAC 202.76 requires institutions of higher education to adopt the state security control standards catalogue, built on NIST SP 800-53 Revision 5, and requires the information security program to be reviewed at least biennially by individuals independent of the program. The rule prints no testing cadence, so that obligation arrives through the control catalogue and through GLBA. New York's SHIELD Act obliges organisations holding private information of New York residents to maintain reasonable safeguards, including regular testing and monitoring of key controls. In Canada, Ontario and British Columbia institutions operate under provincial freedom of information and protection of privacy legislation and Quebec institutions under Law 25, with its confidentiality incident reporting duty. None prints an interval, so a documented annual test plus testing after significant change is the defensible position.
What do cyber-insurance questionnaires ask for?
Insurance is a de facto regulator here, and the renewal questionnaire is often stricter than any statute: whether multi-factor authentication covers remote access, email and privileged accounts, whether backups are segregated and restoration tested, how fast critical vulnerabilities are remediated, and whether an independent penetration test was performed in the last 12 months. An institution that answers the last one with a dated report, a remediation record and a retest result prices better than one that cannot.
The campus attack surface that actually gets tested
Higher education has an attack surface that looks nothing like a corporate estate: tens of thousands of transient identities, federated access, a residence network that is effectively public, and dozens of departments buying software without telling central IT.
Student information and ERP systems. Banner, Workday Student and PeopleSoft hold the record GLBA and FERPA both care about. What matters is object-level authorization on student, application, award and invoice identifiers, plus role separation across student, advisor, registrar, bursar and administrator.
Learning platforms and edtech integrations. Canvas, Moodle and Brightspace are usually hardened by the vendor. The integrations around them are not: learning tools interoperability connections, grade passback endpoints and departmental plugins inherit trust nobody re-evaluated.
Identity. Single sign on, federation, multi-factor enrolment and recovery are the highest-value target on campus, because one working account reaches teaching, payroll, research and student records. Test the recovery path, not just the login.
Payments. Tuition, housing, bookstore, dining and athletics flows, and above all the segmentation keeping the rest of the campus out of cardholder scope.
Research networks and computing clusters. High performance computing, laboratory instrumentation and controlled research data enclaves run older operating systems for legitimate scientific reasons and are often reachable from the general network.
Open campus and residence wireless. Guest, conference and residence networks share the physical estate with administrative systems more often than anyone admits, and a wireless assessment is the fastest way to find out whether the separation is real.
How public-sector procurement changes the buy
Most campuses cannot simply sign an order form, and the procurement route often sets the shortlist before security has a view.
Competitive thresholds. Public institutions must tender above a dollar threshold set by state, provincial or board policy. Writing the scope precisely keeps evaluation technical rather than purely price-driven, which is what a penetration testing RFP template and a statement of work template are for.
Cooperative contracts. In Ontario, OECM holds a vulnerability assessment and penetration testing services agreement with seven pre-qualified supplier partners, open to colleges, universities, school boards, hospitals, municipalities and community services organisations, running to 30 January 2027. American institutions use comparable education and state cooperative vehicles.
Insurance, indemnity and data handling. Public procurement fixes minimum insurance limits, requires named-insured certificates and increasingly specifies where test data and reports may be stored. Ask early, because it eliminates vendors late.
Trade agreement obligations. Canadian institutions are frequently bound by interprovincial and international trade agreement rules on non-discriminatory evaluation criteria, which constrains how a shortlist can be built.
Academic calendar. Registration, add and drop and examination periods are hard blackout windows. A vendor that cannot work around them will not finish inside the audit year.
How we ranked them
Eleven vendors were scored against six criteria, and every claim traces to a page the vendor publishes itself.
Published higher education or public sector practice, not a logo wall.
GLBA Safeguards Rule fluency, meaning the published material shows the vendor understands the 16 CFR 314.4(d)(2) obligation and the audit that enforces it.
Authorization and business logic depth on student, award and invoice identifiers across the campus role hierarchy.
Breadth across the campus estate: external and internal networks, applications and APIs, cloud, identity, wireless and social engineering, tested as one estate.
Evidence quality, meaning a report an auditor, an insurer and a board committee can each read, with reproduction steps and a retest record.
Delivery model fit, meaning support for both a one-time annual test and a continuous program.
Vendors whose product is governance advisory, identity consulting or attack surface discovery without offensive testing were not ranked as penetration testing providers. Two examples are noted after the ranking.
Quick comparison: best higher education penetration testing companies
Company | HQ | Best for | Source page, verified 19 September 2026 |
|---|---|---|---|
1. Stingrai | Toronto, Canada | Firm-level CREST accreditation, two named penetration testers per engagement across the student portal and its roles, single sign on, Active Directory, perimeter and campus wireless, one-time or continuous, retest and attestation letter included | |
2. CampusGuard | Lincoln, Nebraska | Testing and compliance program management from a higher-education-only bench | |
3. Compass IT Compliance | North Providence, Rhode Island | New England institutions buying testing and GLBA readiness together | |
4. OCD Tech | Braintree, Massachusetts | The penetration test and the IT audit relationship under one roof | |
5. Schneider Downs | Pittsburgh, Pennsylvania | Institutions whose audit relationship sits with a regional advisory firm | |
6. SBS CyberSecurity | Madison, South Dakota | Smaller colleges wanting testing inside an advisory relationship | |
7. Bulletproof | Moncton, New Brunswick | Canadian institutions buying testing alongside managed services | |
8. Rapid7 | Boston, Massachusetts | Institutions standardised on the vendor's vulnerability management platform | |
9. Packetlabs | Toronto, Ontario | A manual-first, objective-based engagement | |
10. Plante Moran | Southfield, Michigan | Community colleges already using the firm for audit or advisory work | |
11. BDO Canada | Toronto, Ontario | Ontario institutions buying through an existing cooperative agreement |
1. Stingrai (top rated for higher education)
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
It is one of a small number of CREST-accredited firms headquartered in Canada. Its penetration testers cover web applications and APIs, internal and external networks, Active Directory, cloud environments, wireless, phishing and red teaming. For a campus that means the student information system tested authenticated as student, faculty, registrar and administrator so one student record cannot be reached from another account, the integrations hanging off the learning platform, single sign on and multi-factor flows through Entra ID app registrations and consent grants, the Active Directory forest including ACL abuse and Kerberos delegation paths, the cloud tenancy, the perimeter, residence and guest wireless tested on-site or with a Wi-Fi Pineapple, and staff phishing and vishing, with boundaries agreed around registration and examination periods.
HQ: Toronto, Canada, with a London, UK office.
Delivery model: human-led penetration testing, one-time annual engagements and continuous programs through the PTaaS platform.
Named penetration testers: yes, two per engagement, holding OSCE3, OSCP, OSWE, OSEP, CREST CRT and CISSP, with 18 published CVEs across the team and bug bounty Hall of Fame listings at Apple, Google, the US Department of Defense and the US Federal Reserve.
Retest: included, with an attestation letter and verified badge issued with every report.
Portal: yes, with findings posted as they are confirmed, live chat with the assigned penetration testers, Jira and Slack integration and a remediation workflow.
Pricing transparency: published packages from US$3,000 for one web application and its APIs on the pricing page, campus estates quoted.
Best for: institutions in the US and Canada that want CREST-accredited testing across the whole campus estate and evidence shaped for the GLBA compliance audit.
CREST accreditation applies to Stingrai as a penetration testing service provider, which is distinct from individual tester certifications. Stingrai's penetration testing supports GLBA Safeguards Rule, PCI DSS, SOC 2, ISO 27001 and NIST SP 800-171 programs by producing the scope statement, technical report, remediation record and retest evidence those programs consume.
Snipe, Stingrai's autonomous agent, covers web application penetration testing including the application's APIs, hunting broken authorization, insecure direct object references and business logic flaws, which is exactly the class that exposes one student's record to another. It also reviews source code where the institution grants repository access and can open AutoFix pull requests. The Autonomous tier is Snipe alone; in a Hybrid engagement the penetration testers and Snipe work the application together throughout, with the testers directing where it looks. Network, Active Directory, cloud, wireless, social engineering and red team work is tested by the penetration testers.
2. CampusGuard
CampusGuard, in Lincoln, Nebraska, is the closest thing this market has to a higher-education-first security firm. Its published services span penetration testing, vulnerability scanning, red teaming, social engineering, cloud assessment, password auditing and network segmentation testing, alongside assessment work for PCI DSS, GLBA, CMMC, HIPAA, FACTA and FERPA. It is a PCI Qualified Security Assessor company and publishes material on the GLBA Safeguards Rule audit objective written for campus audiences.
HQ: Lincoln, Nebraska. Delivery model: consultancy with managed compliance services.
Named testers, retest and portal: not published, so make all three proposal requirements. Pricing: quoted.
Pros: higher education is the lead sector rather than one industry page among twenty, and segmentation testing plus QSA status in one firm is convenient for the payments side of a campus.
Cons: compliance program management is the centre of gravity, so confirm the offensive bench, and get a written answer on how independence is documented when assessment and testing run together.
Best for: campuses wanting testing and compliance program management from one higher-education-only bench.
3. Compass IT Compliance
Compass IT Compliance, founded in 2010 in North Providence, Rhode Island, publishes a higher education page describing a decade of work with private and public colleges and universities, pairing penetration testing with GLBA and PCI DSS compliance work. It is an affiliate member of the University Risk Management and Insurance Association.
HQ: North Providence, Rhode Island. Delivery model: consultancy. Retest, portal and pricing: not published.
Pros: the published pairing matches how campuses buy, with the test and the GLBA readiness work in one engagement, and regional depth across New England is real.
Cons: the page is service-level rather than methodology-level and team credentials are not published, so require a redacted sample report and named tester certifications.
Best for: New England and mid-Atlantic institutions buying testing and GLBA readiness together.
4. OCD Tech
OCD Tech, in Braintree, Massachusetts, is the technology assurance division of an accounting firm and publishes penetration testing services alongside IT audit, SOC reporting and CMMC readiness, including network penetration testing pages aimed at colleges and universities and framed against FERPA, GLBA and HIPAA where applicable. Boston-area institutions can compare it against the wider regional field in the Boston penetration testing companies guide.
HQ: Braintree, Massachusetts. Delivery model: IT audit and cybersecurity consultancy. Portal and pricing: not published.
Pros: audit heritage means the report is written for a reader who has to evidence something, the right instinct for a Title IV institution, and regional presence makes on-site internal and wireless work straightforward.
Cons: network testing is the published emphasis, so a deep authorization test on a student portal needs confirming separately.
Best for: institutions wanting the penetration test and the IT audit relationship under one roof.
5. Schneider Downs
Schneider Downs, in Pittsburgh, Pennsylvania, publishes network penetration testing alongside vulnerability assessment and incident response, maintains a higher education industry group, and has published guidance on GLBA for higher education covering the compliance supplement changes that put the Safeguards Rule into the single audit.
HQ: Pittsburgh, Pennsylvania. Delivery model: advisory firm with a cybersecurity practice. Portal and pricing: not published.
Pros: one of the few advisory firms publishing both a higher education industry group and a named penetration testing service, with GLBA material written for the audit that enforces the rule.
Cons: advisory-led delivery, so pin tester continuity down in the statement of work, and regional concentration in the mid-Atlantic and midwest.
Best for: institutions whose external audit or advisory relationship already sits with a regional firm.
6. SBS CyberSecurity
SBS CyberSecurity, in Madison, South Dakota, publishes a higher education page covering consulting, auditing and network security services, referencing FERPA, HIPAA and NIST frameworks and Department of Education expectations around student financial aid information. Its heritage is in banking, which is a real advantage for the Safeguards Rule, because the rule came from banking supervision in the first place.
HQ: Madison, South Dakota. Delivery model: consultancy with managed and audit services. Retest and pricing: not published.
Pros: financial-institution heritage maps directly onto the GLBA obligation, and board-level reporting is a published deliverable, which matters when a finding reaches a trustees committee.
Cons: higher education is one of several sectors served, and offensive depth on complex web applications is less published than network and audit work.
Best for: smaller colleges and community colleges wanting testing inside an advisory relationship.
7. Bulletproof
Bulletproof, in Moncton, New Brunswick and part of the GLI group, publishes a security testing practice covering penetration testing, vulnerability assessments, threat risk assessments, web application assessments and secure code review, and lists education among its sectors. It has published a case in which its testers found a vulnerability in a content platform used by higher education institutions during a penetration test for a Canadian university, which is rare public evidence of campus testing work.
HQ: Moncton, New Brunswick. Delivery model: consultancy and managed services. Portal and pricing: not published.
Pros: published, verifiable higher education testing work rather than an unsupported sector claim, with Canadian delivery and data residency that simplify provincial privacy obligations.
Cons: managed services breadth means the offensive bench is one line among several, and public methodology detail is limited.
Best for: Canadian institutions buying testing alongside managed IT and security services.
8. Rapid7
Rapid7, in Boston, Massachusetts, publishes an education solutions page framed around protecting student data and supporting FERPA and GLBA obligations, and offers penetration testing services alongside its vulnerability management and detection products.
HQ: Boston, Massachusetts. Delivery model: product platform with a testing services line. Portal: yes, the vendor's own platform. Pricing: quoted.
Pros: findings flow into a platform the institution may already run, shortening the path from report to remediation ticket, and the scale suits multi-campus systems.
Cons: product-led relationship, so confirm the manual testing proportion and the seniority of assigned testers in writing.
Best for: institutions already standardised on the vendor's vulnerability management platform.
9. Packetlabs
Packetlabs, at 401 Bay Street in Toronto with offices in Calgary, San Francisco and Sydney, publishes a K-12 and post-secondary education page covering application testing for student portals and learning platforms, infrastructure and cloud testing, social engineering and continuous testing, citing FERPA, state privacy laws, NIST and ISO 27001.
HQ: Toronto, Ontario. Delivery model: consultancy, manual-first, with a continuous option. Pricing: quoted.
Pros: manual-first positioning suits institutions that have already run scanners and want exploitation depth, and the education page names campus systems rather than speaking generically.
Cons: the page addresses K-12 and post-secondary together, so confirm post-secondary-specific methodology.
Best for: institutions wanting a manual-first, objective-based engagement.
10. Plante Moran
Plante Moran, in Southfield, Michigan, publishes a higher education practice describing more than fifty years serving public and private colleges, universities, community colleges and foundations, including cybersecurity work, and maintains a separate penetration testing service line.
HQ: Southfield, Michigan. Delivery model: advisory firm. Portal and pricing: not published.
Pros: deep familiarity with governance, board reporting and the single audit cycle, and community college coverage that is genuine rather than incidental.
Cons: the higher education page does not name penetration testing, so the two service lines have to be connected during scoping.
Best for: community colleges and mid-size institutions already using the firm for audit or advisory work.
11. BDO Canada
BDO Canada appears here on procurement grounds rather than published sector marketing. It is one of seven pre-qualified supplier partners on the OECM vulnerability assessment and penetration testing services agreement, covering vulnerability assessment, external and internal penetration testing and optional cloud assessment and threat risk assessment work, available to Ontario colleges, universities, school boards, hospitals and municipalities through 30 January 2027.
HQ: Toronto, Ontario. Delivery model: advisory firm, available through a cooperative agreement. Pricing: agreement price list.
Pros: buying through the agreement removes a competitive tender from the critical path, which can save a full term.
Cons: cooperative pricing still needs comparison against direct quotes, and education-specific methodology is not published at the service level.
Best for: Ontario institutions that need to buy through an existing cooperative agreement.
Two organisations worth knowing that are not commercial testing vendors
REN-ISAC runs information sharing and assessment services for higher education member institutions, including peer-delivered penetration testing performed by staff from other member institutions. That is a genuine option for a community-priced external or assumed-breach test, but it is a membership service with its own queue and scope limits rather than a contracted commercial engagement with defined delivery dates and indemnity terms.
Moran Technology Consulting is a higher-education-focused IT consultancy known for identity and access management and virtual CISO work. Its published services cover security assessment and design rather than offensive testing, so the penetration test remains a separate purchase.
How much does higher education penetration testing cost in 2026?
There is no published price list for campus testing, and any figure presented as one is invented. What can be published honestly is arithmetic on two verifiable numbers: a day rate and a day count. The day rate is the median published rate of £1,000 across 30 public-sector rate cards collected in Stingrai's Penetration Testing Price Index 2026, and the day counts are those firms publish alongside fixed fees, collected in the cost per hour and day rates guide. Conversions use Federal Reserve H.10 observations dated 11 September 2026: US$1.3524 per pound and C$1.3864 per US dollar.
Campus scope | Days | US$ band | C$ band |
|---|---|---|---|
External network perimeter, single campus | 3 to 5 | US$4,057 to US$6,762 | C$5,625 to C$9,375 |
Student portal or single web application | 3 to 5 | US$4,057 to US$6,762 | C$5,625 to C$9,375 |
Cloud tenancy configuration review | 4 to 5 | US$5,410 to US$6,762 | C$7,500 to C$9,375 |
Campus and residence wireless assessment | 4 to 6 | US$5,410 to US$8,114 | C$7,500 to C$11,250 |
Internal network, larger multi-building estate | 5 to 8 | US$6,762 to US$10,819 | C$9,375 to C$15,000 |
Student information system, authenticated multi-role | 6 to 12 | US$8,114 to US$16,229 | C$11,250 to C$22,500 |
Full-scope campus assessment, several surfaces | 10 to 20 | US$13,524 to US$27,048 | C$18,750 to C$37,500 |
Stingrai publishes package pricing openly. A one-time Autonomous Pentest with Snipe starts at US$3,000 and a one-time Hybrid Pentest with certified penetration testers is US$6,800, both covering exactly one web application and its APIs, with the same tiers available as continuous subscriptions on a 12-month engagement. Retesting is included. Campus estates, multi-campus systems and research enclaves are quoted individually on the pricing page, and cross-vendor context sits in the penetration testing cost guide.
A buyer checklist for a campus penetration test
Ask which regulation the vendor thinks applies, before you tell them. The correct answer names 16 CFR 314.4(d)(2) and the annual compliance audit, not FERPA.
Require named penetration testers with verifiable certifications in the proposal, plus notice if the assigned testers change.
Fix the scope around the record, not the subnet. Name the student information system, the portal, the identity provider, the payment flows and the wireless estate.
Require authenticated multi-role testing across student, faculty, advisor, bursar and administrator. Unauthenticated-only testing will not find the authorization flaws that expose records.
Confirm retesting is included, stated in days after remediation, with a retest letter you can hand the auditor and the insurer.
Set the calendar against both the audit year and the academic year, excluding registration, add and drop and examination periods in the rules of engagement.
Specify deliverables in writing: technical report with reproduction steps, an executive summary a board committee can read, a control mapping, a remediation record and a retest result.
Pin down data handling and research data. Where reports are stored, who can access them, retention and destruction, and who may see controlled research data.
What this means for higher education security buyers in 2026
Cite GLBA, not FERPA. The Safeguards Rule is the one instrument that prints the requirement, and the Department of Education examines it in the annual compliance audit. Build the testing calendar around the fiscal year the auditor reads, and keep the report, the remediation record and the retest result in one file.
Test the authorization boundary, not the perimeter. Verizon puts web applications behind 71 percent of malware infections in Education, and the campus systems holding the record are web applications with a dozen roles. Object-level authorization on a student, award or invoice identifier is where a record leaks.
Buy evidence an auditor, an insurer and a board can all read. Across the engagements analysed in the 2026 state of penetration testing report, 1,206 verified findings across 55 tests carried a 0.74 percent false-positive rate, 92.7 percent of tests surfaced at least one High or Critical issue, and the median time to fix a Critical was 10.5 days. Those numbers exist because findings are manually verified before they reach a report.
Frequently Asked Questions
Who are the best higher education penetration testing companies in 2026?
The best higher education penetration testing companies in 2026 are Stingrai, CampusGuard, Compass IT Compliance, OCD Tech, Schneider Downs, SBS CyberSecurity, Bulletproof, Rapid7, Packetlabs, Plante Moran and BDO Canada. Stingrai is a CREST-accredited penetration testing service provider at firm level, headquartered in Toronto with a London office, staffing each engagement with two named penetration testers holding OSCE3, OSCP, OSWE, OSEP, CREST CRT and CISSP and 18 published CVEs across the team. It tests the student information system authenticated across student, faculty, registrar and administrator roles, single sign on and Active Directory, the perimeter, campus wireless and staff phishing, as a one-time annual engagement or a continuous programme, with retesting, an attestation letter and published package pricing. CampusGuard, Compass IT Compliance and OCD Tech follow for higher-education-only coverage, New England institutional depth and combined IT audit and testing. Every entry links to the vendor's own published page and was verified on 19 September 2026.
Does GLBA require universities to run a penetration test?
Yes, for Title IV institutions. Because colleges and universities administer federal student financial aid, they are financial institutions under the Gramm-Leach-Bliley Act and fall under the FTC Safeguards Rule. 16 CFR 314.4(d)(2) requires that monitoring and testing of information systems include continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months, and after any material change. Federal Student Aid's announcement GENERAL-23-09 confirmed the updated rule took effect on 9 June 2023 and that compliance is examined in the annual compliance audit, with a corrective action plan required where noncompliance is found.
Does FERPA require penetration testing?
No. FERPA, implemented at 34 CFR Part 99, governs access to and disclosure of education records. It prescribes no security control catalogue, no technical safeguards and no testing cadence. FERPA determines what an unauthorised disclosure costs an institution, while the GLBA Safeguards Rule is the instrument that sets the testing interval.
What does PCI DSS require for tuition and campus payments?
PCI DSS v4.0.1 requirement 11.4 asks for external and internal penetration testing at least once every 12 months and after any significant infrastructure or application change, plus testing to confirm that segmentation isolating the cardholder data environment is effective. A university is a merchant in many places at once, from tuition and housing through the bookstore, dining, athletics and alumni giving, so segmentation testing frequently produces the most consequential finding on a decentralised campus.
What do state and provincial rules add?
In Texas, 1 TAC 202.76 requires institutions of higher education to adopt the state control standards catalogue built on NIST SP 800-53 Revision 5 and to have the information security program reviewed at least biennially by individuals independent of it, without printing a testing cadence itself. New York's SHIELD Act requires reasonable safeguards including regular testing of key controls. In Canada, Ontario and British Columbia freedom of information and protection of privacy legislation and Quebec Law 25 require reasonable security measures, and Law 25 adds confidentiality incident reporting, but none prints an interval, so an annual test plus testing after significant change is the defensible position.
How much does higher education penetration testing cost in 2026?
Cost tracks scope. Using a median published day rate of £1,000 and published day counts, an external perimeter or single student-facing application test lands around US$4,057 to US$6,762, an authenticated multi-role student information system test around US$8,114 to US$16,229, and a full-scope campus assessment around US$13,524 to US$27,048, with Canadian equivalents of roughly C$5,625 to C$9,375, C$11,250 to C$22,500 and C$18,750 to C$37,500. Stingrai publishes package pricing openly, with a one-time Autonomous Pentest from US$3,000 and a one-time Hybrid Pentest at US$6,800, each covering one web application and its APIs. Campus estates are quoted individually on the pricing page.
How often should a college or university run a penetration test?
For a Title IV institution, at least once every 12 months, because 16 CFR 314.4(d)(2) sets that interval unless documented continuous monitoring achieving equivalent outcomes is in place, with vulnerability assessments at least every six months alongside it. Institutions taking card payments inherit the same annual cadence plus testing after significant change from PCI DSS requirement 11.4. Institutions that ship changes to student-facing applications during term increasingly run a continuous program so the gap between a change and its first test is measured in days.
Can we buy penetration testing through a cooperative contract?
Yes, and many institutions do. In Ontario, OECM holds a vulnerability assessment and penetration testing services agreement with seven pre-qualified supplier partners, open to colleges, universities, school boards, hospitals, municipalities and community services organisations and running to 30 January 2027. American institutions use comparable education and state cooperative vehicles. The vehicle removes a tender from the critical path, but it does not guarantee the best price or the right methodology, so compare it against at least one direct quote.
What should a campus penetration test cover?
Object-level authorization on every record-scoped endpoint in the student information system and portal, role separation across student, faculty, advisor, bursar and administrator, the single sign on and multi-factor enrolment and recovery flows, the integrations hanging off the learning platform, payment flows and their segmentation, the internal and external perimeter, campus and residence wireless, and where applicable the research network and any controlled data enclave. The evidence should carry tester identity and credentials, scope, dates, methods, reproduction steps, remediation guidance and a retest result.
Who is the best penetration testing company for a Canadian university?
For Canadian institutions, Stingrai ranks first on the criteria that matter in a provincial procurement file: CREST firm-level accreditation, a Toronto headquarters with data handling that suits provincial privacy obligations, named penetration testers, retesting included, a PTaaS portal and published pricing, delivered as either a one-time annual engagement or a continuous program. Bulletproof and Packetlabs are credible Canadian alternatives, and BDO Canada is available to Ontario institutions through the OECM cooperative agreement. Broader context sits in the top penetration testing companies in Canada guide.
Related reading
References
Verizon Business. _2026 Data Breach Investigations Report, Public Sector snapshot._ https://www.verizon.com/business/resources/reports/dbir/. Source of the Educational Services figures: 1,302 incidents, 1,252 with confirmed data disclosure, System Intrusion at 52 percent of breaches, ransomware in 65 percent of malware-related breaches, web applications as the malware vector in 71 percent of cases, and external actors and financial motive each at 78 percent.
Office of the Federal Register. _16 CFR 314.4, Elements of an information security program._ https://www.ecfr.gov/current/title-16/part-314/section-314.4. Source of the annual penetration testing and six-month vulnerability assessment requirement at paragraph (d)(2).
U.S. Department of Education, Federal Student Aid. _Updates to the Gramm-Leach-Bliley Act Cybersecurity Requirements, announcement GENERAL-23-09._ https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements. Source of the 9 June 2023 effective date, the nine required program elements, the annual compliance audit and the corrective action plan process.
Office of the Federal Register. _34 CFR Part 99, Family Educational Rights and Privacy._ https://www.ecfr.gov/current/title-34/part-99. Confirms that FERPA governs disclosure of education records and prescribes no security control set or testing cadence.
PCI Security Standards Council. _PCI DSS v4.0.1, requirement 11.4._ https://www.pcisecuritystandards.org/document_library/. Source of the annual and post-change external and internal penetration testing requirement and segmentation testing.
Texas Secretary of State. _1 TAC 202.76, Security Control Standards Catalog._ https://www.law.cornell.edu/regulations/texas/1-Tex-Admin-Code-SS-202-76. Source of the mandatory control catalogue for institutions of higher education and the at least biennial independent program review.
Government of Canada. _Policy on Sensitive Technology Research and Affiliations of Concern._ https://science.gc.ca/site/science/en/safeguarding-your-research/guidelines-and-tools-implement-research-security/policy-sensitive-technology-research-and-affiliations-concern. In effect 1 May 2024, conditioning tri-agency and Canada Foundation for Innovation funding on research affiliation attestations.
OECM. _Vulnerability Assessment and Penetration Testing Services._ https://oecm.ca/marketplace/vulnerability-assessment-and-penetration-testing-services/. Seven pre-qualified supplier partners, eligible institution types and an agreement term to 30 January 2027. Verified 19 September 2026.
CampusGuard. _Services._ https://campusguard.com/services/. Published penetration testing, red teaming, social engineering, segmentation testing and compliance assessment services, with higher education as a lead sector and QSA status. Verified 19 September 2026.
Compass IT Compliance. _Higher Education._ https://www.compassitc.com/industries/higher-education. Published higher education practice pairing penetration testing with GLBA and PCI DSS compliance work. Verified 19 September 2026.
OCD Tech. _Vulnerability Scanning and Network Penetration Testing._ https://ocd-tech.com/services/penetration-testing. Published penetration testing alongside IT audit and SOC reporting, with pages addressed to colleges and universities. Verified 19 September 2026.
Schneider Downs. _Penetration Testing._ https://schneiderdowns.com/cybersecurity/services/penetration-testing/, and _Update on GLBA for Higher Ed._ https://schneiderdowns.com/our-thoughts-on/update-on-glba-for-higher-ed/. Verified 19 September 2026.
SBS CyberSecurity. _Higher Education._ https://sbscyber.com/industry/higher-education. Published consulting, auditing and network security services for higher education referencing FERPA, HIPAA and NIST frameworks. Verified 19 September 2026.
Bulletproof. _IT Security._ https://bulletproofsi.com/it-security/. Published penetration testing, vulnerability assessment and secure code review services, with education among the sectors served. Verified 19 September 2026.
Rapid7. _Cybersecurity Solutions for Higher Education._ https://www.rapid7.com/solutions/industry/education/. Published education solutions page citing FERPA and GLBA alongside penetration testing services. Verified 19 September 2026.
Packetlabs. _Penetration Testing for K-12 and Post-Secondary._ https://www.packetlabs.net/industries/education/. Published education page covering application, infrastructure, cloud and social engineering testing. Verified 19 September 2026.
Plante Moran. _Higher Education._ https://www.plantemoran.com/industries/higher-education, and _Penetration Testing._ https://www.plantemoran.com/services/consulting/cybersecurity/penetration-testing. Verified 19 September 2026.
Moran Technology Consulting. _Information Security._ https://morantechnology.com/services/information-security/. Higher-education-focused consultancy publishing security assessment, identity and virtual CISO services rather than offensive testing. Verified 19 September 2026.
REN-ISAC. _Penetration Testing, Information Security Assessment and Advisory Services._ https://www.ren-isac.net/ISAAS/pentesting.html. Member-delivered external, assumed breach and cloud penetration testing for higher education member institutions. Verified 19 September 2026.
Stingrai. _Pricing._ https://www.stingrai.io/pricing. Published one-time and continuous package prices covering one web application and its APIs.
Ready to scope a campus penetration test?
The finding that costs an institution its audit year is almost never an unpatched edge device. It is an authorization check in the student portal that trusts an identifier it should have validated, or a residence network that reaches an administrative subnet nobody documented. Stingrai is a CREST-accredited penetration testing service provider whose penetration testing supports GLBA Safeguards Rule, PCI DSS, SOC 2, ISO 27001 and NIST SP 800-171 programs by producing the scope statement, technical report, remediation record and retest evidence those programs consume. Named penetration testers work concurrently with Snipe, our autonomous AI agent for web application penetration testing, hunting the broken authorization and business logic flaws that put one student's record on another student's screen. Book a free scoping call, get a quote for a campus or multi-campus scope, or read the published package prices on the pricing page.
