“According to the 2025 EDUCAUSE Cybersecurity and Privacy Workforce in Higher Education Report, cybersecurity teams at many institutions are operating under significant staffing and budget constraints while demands continue to grow,” says Isaac Galvan, community program director for cybersecurity and privacy at EDUCAUSE. “Budget limitations and hiring freezes continue to shape how institutions prioritize cybersecurity spending, often forcing teams to operate reactively rather than strategically.” As a result, many CISOs are seeking more effective strategies and practices to help them acquire the budgets they need to safeguard their institutions. The Role of Ongoing Cybersecurity Training in Budget Discussions At a high level, one tactic that CISOs can use to help improve the outcomes of their budget conversations is providing ongoing cybersecurity training. Most budget stakeholders are not security experts, so they rely on the CISO to explain to them what’s important and where to direct the university’s security budget. This can be done through both formal and informal conversations throughout the year. An ongoing cybersecurity training strategy can also include forming partnerships with particular stakeholders. Close relationships with key executive committee members can assist the CISO with making the case for specific budget priorities when the security budget is being considered by the full committee. “One of the things that helps me at DeVry is that we have a cyber risk committee,” explains Fred Kwong, vice president and CISO at DeVry University. “With this group, I give a full picture of our security posture, the controls we have in place, the existing risk that we have, anything that we still need to mitigate. Then, we talk about future planning. We include several of the executive committee members as part of this group. They can help weigh in with the executive committee on where we need stronger protection and what we