I work in the central IT department at a university that has around 20,000 students. You are a 100% correct that we are very underfunded and understaffed. I'm t

I work in the central IT department at a university that has around 20,000 students. You are a 100% correct that we are very underfunded and understaffed. I'm the lead and only full time programmer for the entire portal system. We make due by hiring students to help off load the work for us full timers. Our security team is relatively new. When I first started back in 2013 we didn't really have one. So if you had a few programmers that didn't understand security, many things got through. We do a much better job now, but I can see how other universities can really struggle.