Lighthouse AdvisorySLED AI Adoption Intelligence

Campus Operations

Campus-operations evidence on 2026-09-21 pairs the University of South Dakota’s documented hybrid Agentic AI SOC—Microsoft- and MDR-layered agents with explicit human gates on consequential actions—with ASU–SDSU–Utah’s $5M NSF PARAPET privacy-enhancing cyberinfrastructure award, while Daily Cal reporting shows UC Berkeley EECS researchers enduring multi-week information gaps during an IRIS containment event and University World News synthesizes AI-as-labour bargaining (CUNY, Miami, Spokane, CAUT, UCU). Agentic SOC capacity and PET investment are advancing faster than independently measured service outcomes; labour lifecycle consultation and research-IT continuity communications remain binding operating constraints.

Evidence records
4
Cross-source patterns
2
Evidence classes
4 independent reporting
Outcomes
2 emerging1 cautionary1 mixed
Source freshness
4 new this fortnight
Research completed
2026-09-22

Choose a role to see its takeaway beside every record in the ledger.

Patterns across the evidence

Synthesis · Lighthouse Advisory interpretation

2 patterns, each supported by at least two sources
  1. Agentic hybrid SOC designs expand capacity while major campus cyber events still expose communication and continuity gaps

    USD documents a multi-layer Agentic AI SOC with human-gated consequential decisions and MDR co-management, while Daily Cal reporting on Berkeley’s EECS IRIS incident shows multi-week researcher information gaps during EDR-driven containment. Interpretation: campus-operations cyber strategy is simultaneously an automation/architecture problem and a continuity/communications problem. This does not prove USD’s model would have clarified Berkeley’s event or that agentic SOCs reduce departmental research downtime.

    Operating questionCan the institution show both a human-gated agent-augmented SOC operating model and tested research-IT continuity/comms playbooks for multi-week containment?

    Supporting evidenceUniversity of South Dakota Information Security / TeamDynamix KBThe Daily Californian

  2. Privacy-preserving compute investment advances while AI-as-labour demands lifecycle bargaining beyond IT offices

    ASU–SDSU–Utah’s NSF PARAPET award funds national privacy-enhancing cyberinfrastructure for sensitive collaborative compute and AI training without raw-data centralization, while University World News synthesizes higher-ed agreements treating AI as labour technology requiring consultation across procurement and capability change. Interpretation: campus-operations AI scale-up needs joint privacy infrastructure and workforce governance—not only model access. Neither source measures the other’s domain outcomes.

    Operating questionBefore expanding sensitive-data AI compute or admin automation, can the institution produce PET/compliance pathways and labour-management consultation records covering verification workload and feature changes?

    Supporting evidenceArizona State University with San Diego State University and University of UtahUniversity World News (commentary by James Yoonil Auh)

Evidence ledger

Full record · every source keeps its link and limitations

4 records
  1. Independent reportingEmergingNew this fortnight

    University of South Dakota documents hybrid Agentic AI SOC with human-gated decisions

    USD’s Security Team describes a deployed Agentic AI SOC that layers (1) USD-built agents in Microsoft Copilot Studio/AI Foundry, (2) Microsoft Sentinel/XDR/Security Copilot agents, and (3) Red Canary MDR agents. Specialist agents cover orchestration (SOOA), identity, network, vulnerability prioritization, data governance/FERPA-HIPAA-GLBA context, third-party/HECVAT reviews, and a ghost-student fraud POC. Workflows gather evidence and recommend actions, but consequential decisions—risk acceptance, software approval, disruptive containment, legal notification—remain with humans. Why now: the KB shows article:modified_time 2026-09-11 after the stream’s 2026-09-19 published edition, documenting a concrete hybrid campus SOC operating model amid agentic-attack pressure covered in prior issues.

    University of South Dakota Information Security / TeamDynamix KBUnited States (South Dakota public university)Published 2026-08-04; materially updated 2026-09-11 (KB article:modified_time)

    Why it matters, evidence and limitations
    Why it matters
    Campus-operations cyber evidence of an agent-augmented SOC with explicit human approval gates, vendor MDR co-management, and compliance-aware specialist agents—transferable to thin higher-ed SOCs evaluating Security Copilot/MDR stacks.
    Evidence and measured results
    Primary institutional HTTPS KB page enumerating agent inventory, orchestration pattern, Red Canary/Microsoft layers, and human-oversight prohibitions. No MTTD/MTTR, false-positive rates, or independent audit metrics are published.
    Limitations and uncertainty
    Operator-authored KB, not an independent evaluation. Publication originally 2026-08-04 with Sept 11 modification; effectiveness metrics absent. Transferability assumes Microsoft + MDR contracting and staff capacity to validate agent output.
  2. Independent reportingEmergingNew this fortnight

    ASU–SDSU–Utah win $5M NSF award to build PARAPET privacy-enhancing cyberinfrastructure

    ASU News reports a $5M NSF Office of Advanced Cyberinfrastructure award (#2537035) for PARAPET (Prototype Architecture for Research Advances using Privacy Enhancing Technologies), a five-year national community resource led with SDSU and Utah. The project targets secure computation on sensitive data using differential privacy, homomorphic encryption, federated learning, and hardware that keeps data encrypted during processing; ASU’s Research Technology Office will align the prototype with institutional policies and regulated-research communities. Why now: dated September 18, 2026—after the stream’s last published edition (2026-09-19 coverage window starts from prior run)—and not previously archived.

    Arizona State University with San Diego State University and University of UtahUnited States (multi-university NSF cyberinfrastructure)September 18, 2026 (ASU News)

    Why it matters, evidence and limitations
    Why it matters
    Campus-operations relevance via regulated-data sharing, AI-model training without raw-data centralization, and institutional policy/compliance leadership for privacy-enhancing cyberinfrastructure that IT/research-computing and CISO organizations must operate.
    Evidence and measured results
    Primary ASU HTTPS news article with named PIs/co-PIs, NSF grant number, and technical aims. No production SLA, cost-per-job, or independent security evaluation of PARAPET yet—prototype phase.
    Limitations and uncertainty
    Award announcement, not measured deployment outcomes. Multi-year build; national-scale readiness is aspirational. Transfer to non-research admin data stores is not demonstrated.
  3. Independent reportingCautionaryNew this fortnight

    Daily Cal: UC Berkeley EECS researchers left in dark after sweeping IRIS cybersecurity incident

    Campus reporting states that from about Aug. 25, 2026, EECS Instructional & Research Information Systems (IRIS) infrastructure was taken offline amid suspicious activity; containment restricted network access and systems. As of the Sept. 9 article, investigation continued with law enforcement notified; most EECS systems restored but some inactive; central campus IT said unaffected; detection attributed to endpoint detection and response. An anonymous AI lab director described limited briefings and research disruption with partial migration to AWS. Why now: post-dates last published campus-operations edition’s source set and remains newly relevant to mid-September restoration/comms scrutiny; URL not in archive.

    The Daily CalifornianUnited States (University of California, Berkeley)September 9, 2026

    Why it matters, evidence and limitations
    Why it matters
    Cautionary campus-operations evidence on research-IT cyber response, continuity for AI labs, stakeholder communication failures, and EDR-triggered containment tradeoffs—not a product pitch.
    Evidence and measured results
    Primary Daily Cal HTTPS article with dated quotes from campus IT notices and spokesperson Janet Gilmore; anonymous researcher commentary. Scope of data exfiltration and threat actor remain undisclosed in the piece.
    Limitations and uncertainty
    Student newspaper reporting with anonymous sources; university declined many details. Not a forensic report. Clarification note in page HTML appears mistyped (07/09/2026) relative to Sept dateline—treat operational claims cautiously.
  4. Independent reportingMixedNew this fortnight

    University World News: AI as labour technology hits higher-ed bargaining tables

    Commentary argues AI in universities is becoming a labour technology, citing CUNY PSC agreement language requiring instructional staff titles for instructors of record, Miami University AAUP-AFT AI MOU, Spokane Community Colleges contract AI discussion mechanisms, CAUT generative AI policy, and UCU principles requiring consultation before AI affecting working conditions. It introduces concepts of AI verification labour, productivity dividends, and lifecycle bargaining across procurement, implementation, capability change, and review. Why now: published 2026-09-11 and not archived; newly relevant as campuses scale admin/teaching AI under active union pressure.

    University World News (commentary by James Yoonil Auh)International higher education (U.S., Canada, UK examples)11 September 2026

    Why it matters, evidence and limitations
    Why it matters
    Campus-operations workforce and procurement implications: admin and academic AI deployments face bargaining, workload accounting, IP, and algorithmic-management constraints that IT-only governance cannot settle.
    Evidence and measured results
    Opinion/analysis citing named agreements and association policies; not primary CBA text. Author notes commentary status and jurisdictional variation in bargaining mandates.
    Limitations and uncertainty
    Commentary synthesizing secondary sources; not a systematic legal survey. Transfer across jurisdictions limited. Does not measure administrative productivity outcomes.

How to read this edition

Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.

Independent reporting
Independent reporting with attributable sources but without a formal evaluation design.