EDUCAUSE's current HECVAT workbook, version 4.1.6, downloaded from educause.edu on 16 October 2026, lists 323 questions (322 of them appear on the vendor tabs), and none of them uses the words "penetration test." The phrase appears only in the notes EDUCAUSE writes for campus analysts under VULN-03: "Many higher education institutions are capable of performing vulnerability assessments and/or penetration testing on their solution providers' infrastructures." The question a penetration test answers most directly is VULN-04: "Have your systems and applications had a third-party security assessment completed in the last year?"
The Higher Education Community Vendor Assessment Toolkit makes nothing mandatory by itself. It is a questionnaire that colleges and universities ask edtech and SaaS vendors to complete, campuses score the answers against their own appetite for risk, and the firm testing requirements sit in each campus's policy or contract.
Quick answer. Not by name. The HECVAT is a questionnaire, not a mandate, and none of the 323 questions in version 4.1.6 names a penetration test. VULN-04 asks whether your "systems and applications had a third-party security assessment completed in the last year," and its guidance asks you to attach the results and state the date; three critical questions, VULN-01 to VULN-03, each weighted 20, cover authenticated scanning before releases, sharing scan results and letting the institution test. A penetration test of the product dated within 12 months, with an executive summary, a retest record and an attestation letter, is the most direct answer to VULN-04, and Arizona State University asks for that summary outright. Stingrai, a CREST-accredited penetration testing firm, delivers that evidence from testing by named penetration testers, as a one-time annual engagement or a continuous program.
What the HECVAT is in 2026
EDUCAUSE calls the HECVAT "the higher education sector's preferred evaluation framework for selecting technology tools and services for campuses." It was built with Internet2 and REN-ISAC, first released in 2016, and rebuilt as HECVAT 4 on 10 February 2025, when EDUCAUSE rolled "the HECVAT Full, Lite, and On-Prem into one file" and added privacy and AI questions. Version 4.1.6 is the current file: EDUCAUSE's HECVAT page lists it, and the issue tracker logs the last fix that went into it on 22 May 2026.
Routing. Eight required questions, REQU-01 to REQU-08, decide which tabs apply. A product that is not cloud-based answers "no" to REQU-01 and skips the Product and Infrastructure tabs, which hold all six vulnerability management questions.
Weights. 90 questions end with the asterisk EDUCAUSE uses for critical questions, and 87 of them carry Critical Importance, a default weight of 20, against 10 for Standard Importance and 5 for Minor.
Lite reviews. A campus that wants a lighter review reviews only the asterisked questions, but EDUCAUSE tells vendors to "always complete all applicable questions."
Cadence. "Solution providers should update their HECVAT at least once per year," and an institution may ask for an updated version of one that is not current.
Sharing. EDUCAUSE "doesn't collect completed HECVATs," and it retired the Community Broker Index, the shared library of completed HECVATs, on 31 July 2025 because many of them "had become outdated." Vendors now send their own copy.
Reach. EDUCAUSE's list of institutional users had 258 entries on 16 October 2026, eight of them Canadian: BCIT, Lambton College, MacEwan University, Niagara College, SAIT, the University of Waterloo, the University of Winnipeg and York University.
Cost. Vendors may use HECVAT 4 "at no cost and without further license from EDUCAUSE."
EDUCAUSE's site returned a browser check to automated readers on 16 October 2026, so its FAQs and how-to page were read in Internet Archive captures from August and September 2025, and its HECVAT page in a capture from 27 June 2026; the workbook downloaded directly.
The HECVAT questions a penetration test answers
Figure 1: The HECVAT 4.1.6 questions about testing, scanning and independent assurance, read 16 October 2026. Source: EDUCAUSE, HECVAT 4.1.6 workbook.
Thirteen questions ask about testing, scanning or independent assurance. In the workbook the critical ones end with an asterisk; here that is the Critical column.
ID | Question as written in HECVAT 4.1.6 | Critical | Weight |
|---|---|---|---|
VULN-01 | Are your systems and applications scanned with an authenticated user account for vulnerabilities (that are remediated) prior to new releases? | Yes | 20 |
VULN-02 | Will you provide results of application and system vulnerability scans to the institution? | Yes | 20 |
VULN-03 | Will you allow the institution to perform its own vulnerability testing and/or scanning of your systems and/or application, provided that testing is performed at a mutually agreed upon time and date? | Yes | 20 |
VULN-04 | Have your systems and applications had a third-party security assessment completed in the last year? | No | 10 |
VULN-05 | Do you regularly scan for common web application security vulnerabilities (e.g., SQL injection, XSS, XSRF, etc.)? | No | 10 |
VULN-06 | Are your systems and applications regularly scanned externally for vulnerabilities? | No | 5 |
APPL-06 | Do you subject your code to static code analysis and/or static application security testing prior to release? | Yes | 20 |
APPL-07 | Do you have software testing processes (dynamic or static) that are established and followed? | Yes | 20 |
CHNG-05 | Does your change management process minimally include authorization, impact analysis, testing, and validation before moving changes to production? | No | 10 |
DOCU-03 | Have you undergone a SSAE 18/SOC 2 audit? | No | 10 |
DOCU-04 | Do you conform with a specific industry standard security framework (e.g., NIST Cybersecurity Framework, CIS Controls, ISO 27001, etc.)? | No | 10 |
AILM-04 | Do you limit multiple LLM model plugins being called as part of a single input? | Yes | 20 |
AILM-06 | Do you leverage LLM model tuning or other model validation mechanisms? | No | 10 |
VULN-04 is the testing question, and it is not critical. It sits at Standard Importance, weight 10. Its guidance reads: "Provide the results with this document (link or attached), if possible. State the date of the last completed third-party security assessment." The reason EDUCAUSE gives analysts is "Trust, but verify": evidence from outside the vendor "goes a long way in building trust."
The critical questions are about process. VULN-01 checks "regression testing" before each release, VULN-02 asks for scan results, with "a summarized version" if the vendor hesitates to share the report, and VULN-03 asks whether a campus may test you itself, with "the process or procedure to set up security testing times and scopes." A penetration test supports all three: its retest record shows that findings were remediated, and its report is a document VULN-02 can point to. If a campus asks to test, our right-to-test clause guide covers what to agree.
AI features add testing questions. Products that answer "yes" to REQU-04 complete the AI tab. AILM-04 exists, in EDUCAUSE's words, because plugin limits reduce "supply-chain and prompt-injection risk," and its follow-up asks for "test evidence"; the AILM-06 follow-up asks for "any red-team or adversarial testing results."
What the HECVAT does not require
The workbook sets no tester qualification, scope, method or frequency beyond "in the last year," and it never defines "third-party security assessment." Campuses fill those gaps in three ways:
They raise the stakes on VULN-04. Analysts can switch any question to Critical Importance or tick Non-Negotiable, which pulls it onto the High-Risk Evaluation sheet.
They ask for documents. Arizona State University asks for the "Latest third-party conducted penetration test findings executive summary generated by the testing organization" beside a completed questionnaire such as the HECVAT, SIG or CAIQ.
They write the test into the contract. The University of California's data security appendix says a supplier's "information security plan must be supported by a third-party review or certification," with evidence due "upon execution of the Agreement" and on request "annually, after Major Changes, and/or as a result of a Security Incident."
How campuses use the HECVAT
Duke University accepts "Only version 4 of the HECVAT," returned "as an Excel spreadsheet with all tabs intact," and, if available, the vendor's own SOC 2 Type 2 "performed within the past two years." If talks reach a contract, Duke expects the vendor to "warrant that the services you provide will be in substantial conformity with the information provided in the response to the HECVAT" (Duke). Review "can take up to two weeks."
York University in Toronto accepts "version 3.04 or higher," asks that each Additional Information entry address the question's guidance, and aims to finish within three weeks (York). Numbering differs on older files: in HECVAT 3.04 Full the third-party assessment question is VULN-02, not VULN-04.
Arizona State University asks for a SOC 2 Type 2 or similar report, with a bridge letter "If the SOC audit is more than 1 year old," the latest penetration test summary, an architecture diagram and a questionnaire, and wants "updated due diligence documentation annually." Missing documents produce "a high risk score" in the university risk register.
The University of Arkansas requires a HECVAT and a VPAT or ACR "for each individual product being purchased," and its reviews "expire after 12 months" (Arkansas).
The University of Texas at Austin has vendor products complete a HECVAT in Isora unless the product "already has an active TX-RAMP Level 2 certification," and "Renewals require the same assessment as new products" (UT Austin).
The University of California asks suppliers, through the same appendix, to remediate High and Critical vulnerabilities "within twenty (20) business days." Its policy IS-3 sets a floor for UC's own units: Protection Level 4 systems get a penetration test "Once every three years" and "After a major change occurs."
How old a penetration test can be
Source | What it says about age or cadence |
|---|---|
HECVAT 4.1.6, VULN-04 | An assessment "completed in the last year"; a short lapse "can be understood (if there is a planned assessment)" |
EDUCAUSE FAQ | Update the HECVAT "at least once per year" |
Arizona State University | The "Latest" penetration test summary; due diligence refreshed "annually" |
University of California appendix | Evidence at signing and "annually, after Major Changes, and/or as a result of a Security Incident" |
University of Arizona sample addendum | A formal penetration test before the effective date, then "no less than annually" and after changes that may affect University Data |
University of Arkansas | HECVAT reviews "expire after 12 months" |
UC policy IS-3 (UC's own systems) | Penetration testing of Protection Level 4 systems "Once every three years" and after a major change |
The University of Arizona's sample addendum for agreements and RFPs is the most explicit: "A formal penetration test performed by qualified personnel of the Vendor's systems and facilities in use in any way to deliver services under this Agreement," plus "penetration testing and/or scanning prior to releasing new software versions." Read together, the yardstick is 12 months: date the test within a year of the day you send the HECVAT, retest after major changes, and keep scanning before each release. If the test is older, give the date of the next one; the VULN-04 follow-up treats "a significant time lapse or no scan whatsoever" as "cause for elevated levels of concern."
HECVAT, SOC 2, ISO 27001 and TX-RAMP
EDUCAUSE's FAQ says "Most colleges and universities will accept a recent SOC2 Type 2 report as a thorough and authoritative review by an objective third-party auditor," that many will consider the CAIQ, and that sales literature "is not a substitute." Inside the workbook, a SOC 2 report answers DOCU-03, which prefers a SOC 2 Type 2 and asks whether "your hosting provider was the subject of the audit"; DCTR-02 asks for the hosting environment's own SOC 2 Type 2; and DOCU-04 asks which framework you follow, naming ISO 27001, with "current certification levels." None of them is VULN-04, and whether a campus treats a SOC 2 audit as the third-party assessment is its call; ASU asks for both. In Texas, UT Austin lets an active TX-RAMP Level 2 certification stand in for the HECVAT. Our guides to pentest evidence auditors accept and SOC 2 penetration testing cover the audit side.
Scoping a test that answers the HECVAT
VULN-04 says "systems and applications," so scope the product the campus is buying:
The application and its APIs, tested authenticated across every role a campus will use: students, instructors, administrators and service accounts.
Single sign-on. AAAI-01, a critical question, asks about SSO for users and administrators, and Duke calls SAML 2.0 integration with its Shibboleth service "a non-negotiable requirement for any platform where Duke students will be users." Test the SAML flow and account linking (scope guide).
Integrations. ASU gives "an LTI tool" added to the LMS as an example that needs its review.
Tenant isolation, where campuses share a multi-tenant platform (scope guide).
Hosting and cloud configuration, which the architecture diagram DOCU-05 asks for will show.
AI features: prompt injection through plugins and tools (AILM-04) and input validation, which AISC-04 asks you to describe.
The evidence pack, and what reviewers reject
Figure 2: A HECVAT testing evidence pack, built from the workbook's guidance and three universities' requirements. Sources: EDUCAUSE, HECVAT 4.1.6, Arizona State University, Duke University and University of California.
What gets a testing answer sent back:
The wrong file. Duke takes version 4 only, as an Excel file with all tabs intact, and EDUCAUSE says sales literature is no substitute for a security review.
Blank or unexplained answers. The workbook says that "If leaving an answer blank, you must also state why," and Duke rejects "N/A" for questions a hosting arrangement affects.
Stale evidence. VULN-04's follow-up flags "a significant time lapse," and ASU wants a bridge letter for a SOC audit more than a year old.
Someone else's report. Duke wants your own SOC 2 Type 2, "not one for a cloud service provider such as Amazon Web Services or Microsoft Azure."
Missing documents, which at ASU produce a high risk score in the university risk register.
Answers the product does not match. At Duke, "any material deficiency in operations from those as described in your response will be deemed a material breach."
A first-year plan
When | What | Why |
|---|---|---|
Month 0 | Download 4.1.6, answer REQU-01 to REQU-08 and list the tabs that apply | Routing decides which questions you answer |
Months 1 to 2 | Commission an independent penetration test of the product, remediate and retest | VULN-04, VULN-01 and VULN-02 |
Month 2 | Assemble the evidence pack, enter the test date in VULN-04 and attach the summary | VULN-04 guidance |
Every release | Authenticated scans and static analysis | VULN-01 and APPL-06 |
After a major change | Notify campuses whose contracts require it (UC: within 20 business days) and retest | UC appendix; Arizona sample addendum |
Month 12 | Refresh the HECVAT and the test | EDUCAUSE FAQ; ASU; Arkansas |
What it costs
EDUCAUSE charges vendors nothing for HECVAT 4. The cost is time: Duke's review "can take up to two weeks," York aims for three weeks, and Arkansas says its review "can take 1 to 2 weeks." The test is scoped per product. Stingrai's fixed prices cover one web application and associated APIs: the Autonomous Pentest by Snipe, with no penetration testers, is US$3,000 per assessment or US$650 a month on a 12-month plan and ships the pentest report only; the Hybrid Pentest is US$6,800 per assessment or US$1,275 a month and ships a report and an attestation letter (pricing). For a HECVAT, a Hybrid or human-led test is the stronger answer, because campuses look for evidence from the testing firm. Larger scopes, cloud and AI testing are quoted through Get a Quote.
What to ask a penetration testing vendor
Will the report state the scope, the test dates and the method, so the date can go into VULN-04?
Is there an executive summary and an attestation letter we can share with campuses under NDA?
Is retesting included and documented, so every finding has a matching mitigation action?
Will you test authenticated across roles, including the SSO flow, the APIs and any AI features?
Who are the named testers, and how fast can you test again after a major change?
Where Stingrai fits
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For a HECVAT response, Stingrai produces the evidence behind VULN-04 and the questions around it. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team, and Stingrai Inc. holds CREST accreditation for penetration testing (CREST Marketplace).
The product: authenticated web application and API testing across every user role, aimed at broken authorization, IDOR and business logic, including the SSO flow.
AI features: AI and LLM testing for prompt injection, tool misuse and excessive agency, aligned with the OWASP LLM Top 10, for the AILM and AISC questions.
Hosting: cloud testing from the control plane to the workload in AWS, Azure and Google Cloud.
Evidence: every confirmed finding, at every severity, is posted to the PTaaS platform, on one-time and continuous engagements alike, the same day it is confirmed, with a proof of concept and remediation guidance; retesting is included, and every human-led and hybrid report ships with an attestation letter that records the scope and testing dates.
Engagements run as a one-time annual test timed to your HECVAT refresh or as a continuous program. Snipe, Stingrai's autonomous AI agent, covers web applications and their APIs only. Stingrai is based in Toronto with a London office and serves US and Canadian clients remotely.
Frequently Asked Questions
Does the HECVAT require a penetration test?
Not by name. None of the 323 questions in HECVAT 4.1.6 uses the words penetration test. VULN-04 asks whether your systems and applications had a third-party security assessment completed in the last year, and a recent independent penetration test with its results attached is the most direct answer. Any firm requirement comes from the campus's own policy or contract.
Which HECVAT question covers penetration testing?
VULN-04: "Have your systems and applications had a third-party security assessment completed in the last year?" Its guidance asks you to attach the results and state the date of the last assessment. VULN-01 to VULN-03 cover scanning before releases, sharing scan results and letting the institution run its own tests.
How old can a penetration test be for a HECVAT?
VULN-04 asks for an assessment completed in the last year, and EDUCAUSE tells vendors to update their HECVAT at least once per year. The workbook's analyst guidance tolerates a short lapse if the next assessment is planned. Arizona State University asks for the latest test summary and annual updates.
Are the HECVAT testing questions critical?
VULN-01, VULN-02 and VULN-03 are critical questions with a default weight of 20, as are APPL-06 and APPL-07 on static analysis and software testing. VULN-04, the third-party assessment question, carries Standard Importance with a weight of 10, but an institution can raise it to Critical or mark it non-negotiable.
Is there still a HECVAT Lite?
Not as a separate file. HECVAT 4 rolled the Full, Lite and On-Premise versions into one workbook with privacy and AI questions. A campus that wants a lite review reviews only the 90 questions marked with an asterisk, but vendors should answer every question that applies to their product.
Does a SOC 2 report replace a penetration test for the HECVAT?
Not in the workbook. A SOC 2 Type 2 report answers DOCU-03, and EDUCAUSE says most institutions accept a recent one as alternate documentation. VULN-04 asks separately for a third-party security assessment, and some campuses, such as Arizona State University, ask for both the SOC 2 and the latest penetration test summary.
What happened to the HECVAT Community Broker Index?
EDUCAUSE retired the Community Broker Index on 31 July 2025, saying many of the HECVATs it held had become outdated. EDUCAUSE does not collect completed HECVATs, so vendors share their own copy with each institution.
Can a university penetration test our product?
VULN-03, a critical question, asks whether you will let the institution run its own vulnerability testing or scanning at a mutually agreed time and date, and its guidance asks for your procedure for setting testing times and scopes. Agree the scope, the window and the stop conditions in writing first.
Related reading
Best Higher Education Penetration Testing Companies (2026): GLBA, FERPA and Campus Systems Compared
Enterprise Deal Stuck in Security Review? The Pentest Report That Unblocks It
Pentest Evidence Auditors Accept: SOC 2, ISO 27001, PCI DSS and CMMC (2026)
References
EDUCAUSE. Higher Education Community Vendor Assessment Toolkit (HECVAT), version 4.1.6 workbook. Downloaded 16 October 2026. https://www.educause.edu/-/media/files/educause/hecvat/hecvat416.xlsx
EDUCAUSE. Higher Education Community Vendor Assessment Toolkit page, Internet Archive capture of 27 June 2026. https://web.archive.org/web/20260627081542/https://www.educause.edu/higher-education-community-vendor-assessment-toolkit
EDUCAUSE. HECVAT FAQs for Corporations (capture of 14 August 2025), HECVAT FAQs for Higher Education (10 September 2025) and How to Use the HECVAT (15 September 2025). https://web.archive.org/web/20250814211514/https://www.educause.edu/higher-education-community-vendor-assessment-toolkit/hecvat-faqs-for-corporations, https://web.archive.org/web/20250910235211/https://www.educause.edu/higher-education-community-vendor-assessment-toolkit/hecvat-faqs-for-higher-education and https://web.archive.org/web/20250915162522/https://www.educause.edu/higher-education-community-vendor-assessment-toolkit/how-to-use-the-higher-education-community-vendor-assessment-toolkit
Nichole Arbino and Nick Lewis. HECVAT 4: Better than Ever. EDUCAUSE Review, 10 February 2025. https://er.educause.edu/articles/2025/2/hecvat-4-better-than-ever
EDUCAUSE. HECVAT Issue Tracker and Higher Ed Institutions using the HECVAT, read 16 October 2026. https://docs.google.com/spreadsheets/d/1VHMZtfDiCV9gMeNKkHcuUThwW2L3Oxk5lquPuBwgkHY/edit and https://docs.google.com/document/d/1ACX6fly0c3gPm_KA9bMZ2xJ8BKHrEFryuBD08NC_7BM/edit
Duke University IT Security Office. Vendor Risk Assessment Process. Read 16 October 2026. https://security.duke.edu/vendor-risk-assessment/
York University. Contractual Vendor Risk Assessment Guideline. Modified 6 October 2025. https://www.yorku.ca/uit/infosec/ctra/
Arizona State University. Vendor IT Risk Assessments. Read 16 October 2026. https://getprotected.asu.edu/services/vendor-it-risk-assessments
University of Arkansas. Cybersecurity (HECVAT) and Accessibility (VPAT) Requirements for Technology Purchases. Read 16 October 2026. https://uark.teamdynamix.com/TDClient/33/Portal/KB/ArticleDet?ID=785
University of Texas at Austin, Information Security Office. Vendor and Application Security Requirements. Read 16 October 2026. https://security.utexas.edu/risk/appreg
University of California. Appendix: Data Security (version of 20 August 2021) and Policy BFB-IS-3, Electronic Information Security (25 October 2019). https://procurement.ucop.edu/sites/default/files/2023-09/appendix-data-security.pdf and https://policy.ucop.edu/doc/7000543/BFB-IS-3
University of Arizona. Transfer of University Data to Third-Party Systems Guidance, Appendix B sample addendum. https://uair.arizona.edu/sites/default/files/Transfer%20of%20University%20Data%20to%20Third-Party%20Systems%20Guidance.pdf
EDUCAUSE. HECVAT 3.04 Full workbook (copy posted by the University of Toledo). https://www.utoledo.edu/it/security/assessments/docs/hecvat304.xlsx
Stingrai. Pricing and Snipe. https://www.stingrai.io/pricing and https://www.stingrai.io/snipe
Talk to Stingrai
Stingrai will test the product your HECVAT describes and hand you the evidence campuses ask for: a dated report, an executive summary, a retest record and an attestation letter, from named penetration testers at a CREST-accredited firm, as a one-time annual test or a continuous program. Get a quote or book a free discovery call.
