The education sector is experiencing a surge in costly breaches due to third-party vulnerabilities, highlighting the need for institutions to reevaluate their vendor risk management strategies. Ransomware and other attacks are being launched through third-party actors, compromising sensitive student data. Institutions are being forced to play defense, investing significant resources in protecting against these threats. The use of outdated software and unpatched vulnerabilities, such as those associated with known CVEs, are exacerbating the issue. A recent example of this is the exploitation of vulnerabilities in outdated versions of software, allowing attackers to gain unauthorized access to student records1. The financial and reputational consequences of these breaches are substantial, emphasizing the importance of robust vendor risk assessment and mitigation. As a result, education sector practitioners must prioritize proactive vendor risk management to prevent such breaches and protect sensitive student data.