MIT’s Cybersecurity Clinic has emerged as a vital program offering pro-bono cybersecurity vulnerability assessments to municipalities and healthcare organizations, leveraging student expertise to combat a rising tide of cyberattacks. Since its establishment in 2019, the clinic has produced over 40 reports identifying risks and recommending cost-effective protective measures, addressing a critical gap in public-sector cybersecurity preparedness.
What Happened
In 2019, faculty members Jungwoo Chun and Lawrence Susskind launched the MIT Cybersecurity Clinic within the Department of Urban Studies and Planning to respond to growing ransomware assaults on municipal governments, illustrated by the high-profile 2019 Baltimore cyberattack. The clinic recruits students from diverse academic backgrounds who complete certification through online modules before engaging directly with client organizations. Each semester, teams develop tailored reports assessing their client’s cybersecurity weaknesses and offering practical recommendations. By 2025, the FBI reported that U.S. entities face approximately 2,765 cyberattacks daily, underscoring the urgency and relevance of the clinic’s work.
Key Facts
The clinic has provided more than 40 free and confidential cybersecurity assessments largely to New England municipalities and health-care providers, focusing on 23 key risk categories relevant to these sectors. The program has trained over 120 students who pass a certification exam through MITx’s publicly available Cybersecurity for Critical Urban Infrastructure course. The clinic emphasizes defensive social engineering practices—integrating both technical expertise and human factors in cybersecurity. Common recommendations include maintaining thorough inventories of network hardware and software, regular software patching and backups, multi-factor authentication, employee training on phishing threats, and contingency planning for ransomware scenarios.
What This Means
Given the constraints many public entities face—limited cybersecurity staff, tight budgets, and escalating cyber threats—the MIT Cybersecurity Clinic’s approach provides a crucial, scalable model of capacity building. By partnering with students trained to consider social and organizational dynamics alongside technical defenses, at-risk municipalities can implement impact-driven changes without substantial new investments. The ripple effects are significant: improved cybersecurity measures protect essential public services such as 911 systems and water supplies from disruption, safeguard citizen data, and reduce costly downtime. Moreover, providing municipalities with credible external validation strengthens their case for increased cybersecurity funding and legislative support, a vital step in an era where cyber resilience is critical to community stability.
Background
The program builds on lessons from targeted ransomware attacks, including Baltimore’s 2019 incident, which caused severe disruptions and multi-million-dollar recovery costs. Recognizing a shortage of cybersecurity professionals willing to work in under-resourced public agencies, the clinic adopts an interdisciplinary framework combining urban planning, conflict resolution, and technology. This broad curriculum equips students to navigate institutional constraints such as budgeting and leadership engagement, which are often overlooked in purely technical cybersecurity training.
What Comes Next
The clinic continues to operate each semester, with ongoing follow-up support for clients extending up to two years post-assessment. It also contributes to a growing national network of university-based cybersecurity clinics, sharing its curriculum and best practices with over 60 academic partners. The clinic’s leadership plans to sustain collaborations with public agencies and industry experts, adapting to rapid developments in AI-driven cyber threats and evolving defense technologies.
Sources
This article is based on reporting and publicly available information from the following sources:
Read more Cybersecurity stories on Goka World News.