MIT Cybersecurity Clinic Has Delivered Over 40 Free Assessments to Municipalities and Health-Care Providers

A program at the Massachusetts Institute of Technology has provided more than 40 free, confidential cybersecurity vulnerability assessments to municipalities and health-care organizations, primarily in New England, since its launch in 2019. The MIT Cybersecurity Clinic, housed in the Department of Urban Studies and Planning, operates as a semester-long course in which students complete instructional modules and a certification exam before being assigned in teams to a client. Each team produces a report assessing the client's vulnerabilities and recommending protective steps. The clinic was started by lecturer Jungwoo Chun and professor Lawrence Susskind to address a gap: many small municipalities and hospitals lack in-house cybersecurity expertise, and public-sector budgets rarely match private-sector salaries for qualified candidates. The FBI's Internet Crime Complaint Center documented an average of 2,765 cyberattacks targeting Americans daily in 2025. Recent attacks on the kinds of communities the clinic serves have imperiled water supplies, impeded 911 and police services, and exposed personal data, Chun said. Chun and Susskind describe their approach as "defensive social engineering," emphasizing that cybersecurity is not solely a technical challenge. The course covers technical topics, including how artificial intelligence is creating new attack tools, but centers on organizational capacity, inventorying hardware and software, patching and backups, multi-factor authentication, employee training, incident-response planning, and vendor hygiene. Susskind said those basic measures together likely avoid 80 percent or more of the potential cost and danger of cyberattacks. Students spend the first four weeks preparing through online modules and simulations of difficult client interactions. They must pass an exam on the first attempt to receive a field assignment. More than 120 students have completed the full course at MIT. The online modules are also freely available on MITx as a massive open online course, Cybersecurity for Critical Urban Infrastructure, which has attracted tens of thousands of learners. A consortium co-founded by MIT in 2021 with the University of California at Berkeley, Indiana University, and the University of Alabama now includes 61 member institutions running their own cybersecurity clinics. Most student teams conclude their work after finalizing recommendations; a few have volunteered to continue advising on implementation. Susskind and Chun check in with clients for at least two years post-engagement. Past clients have used the reports to secure additional budget from municipal leadership, and some have returned for repeat assessments after staff turnover or equipment upgrades.