From Classroom to Community: Building Cyber Resilience through Sri Lanka’s Cyber Clinics

From Classroom to Community Building Cyber Resilience through Sri Lanka’s Cyber Clinics Cyber threats continue to grow, but many MSMEs lack the resources, expertise, or dedicated staff needed to manage cybersecurity risks. Cyber clinics create a bridge between education and impact, giving higher education students real-world experience while helping small businesses strengthen their security posture. The APAC Cybersecurity Fund (ACF) is an initiative by The Asia Foundation in partnership with the Global Cyber Alliance and Protect.NGO, supported by Google.org, Google’s philanthropic arm. ACF is designed to build inclusive and sustainable cybersecurity ecosystems across the Asia-Pacific region. Through cyber hygiene training, policy research, and stakeholder engagement, the program helps micro and small businesses, nonprofits, and social enterprises strengthen their cyber resilience. It also invests in long-term capacity by establishing more than 19 cyber clinics housed in higher education institutions across the region to expand outreach and develop the region’s cybersecurity workforce. The initiative spans across 13 countries including Australia, Bangladesh, India, Indonesia, Japan, Korea, Malaysia, Pakistan, Philippines, Singapore, Sri Lanka, Thailand, and Vietnam. The cyber clinic model helps equip students with practical cybersecurity and risk management skills, enabling them to work directly with local businesses to improve their security while gaining hands-on experience. In this article, we explore the impact of the cyber clinic model in Sri Lanka, one of three pilot projects, and hear from the students, professors, and organizations involved. Turning Cybersecurity Theory into Real-World Risk Reduction The Sri Lanka Institute of Information Technology (SLIIT) is Sri Lanka’s largest non-state tertiary education provider, renowned for its wide array of modern programs and dedication to producing industry-ready graduates. SLIIT joined the ACF Pilot Cyber Clinic program to enhance the cybersecurity posture of Micro, Small, and Medium Enterprises (MSMEs) across Sri Lanka while creating deep experiential learning opportunities for students. The tools and technologies students use are tailored to the technical environment and asset structure of each MSME they engage with. Depending on the nature of the organization, students may use a mix of web-based and standalone open-source tools for vulnerability assessment and penetration testing (VAPT). As third-year cybersecurity undergraduates at SLIIT, students are already familiar with these tools through coursework and lab sessions, and apply structured risk assessment methodologies such as the NIST Risk Management Framework, ISO/IEC 27005, and OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation). This ensures that their assessments are methodical, standards-based, and aligned with industry best practices, making their recommendations both relevant and actionable for the MSMEs they support. So far, students in the SLIIT clinic program have supported 112 MSMEs spanning healthcare, manufacturing, education, hospitality, digital services, and other sectors. Meet the Students Senaya joined the Cyber Clinic to gain practical experience applying cybersecurity risk management beyond the classroom. Working with a small private hospital, she learned how to conduct structured risk assessments, identify vulnerabilities, and recommend realistic security controls that fit within limited budgets and resources. The experience also strengthened her ability to communicate complex cybersecurity concepts in ways that non-technical staff could understand and act upon. For Sayuni, the Cyber Clinic was an opportunity to see how cybersecurity frameworks translate into real business outcomes. Through direct engagement with MSMEs using the OCTAVE-Allegro methodology, she learned how better backups, access controls, and security awareness training can significantly reduce risk. The experience reinforced the importance of creating practical, affordable security plans that align with the realities facing small businesses. Ravindu gained hands-on experience with cybersecurity risk management frameworks that he had previously encountered only in coursework. Working directly with MSMEs helped him understand how structured risk assessments can improve an organization's security posture. Perhaps most importantly, he learned how to explain cybersecurity risks and solutions in clear, relatable language, helping business leaders better understand and address their security challenges. As someone with a highly technical mindset, Harindu entered the Cyber Clinic expecting to focus primarily on identifying vulnerabilities and analyzing systems. Instead, he discovered that effective cybersecurity requires understanding how businesses operate and translating technical findings into meaningful business risks. Through his work with a software startup, he learned that cybersecurity professionals create the greatest impact when they help organizations understand problems, prioritize solutions, and take practical steps toward improving their resilience. Learning That Cybersecurity Is About People, Not Just Technology One theme that came through consistently in the students’ responses was the importance of communicating cybersecurity to non-technical audiences. They emphasized that technical expertise alone isn’t enough—cybersecurity professionals also need to explain concepts and risks in plain language, help organizational leaders understand the real-world consequences of security gaps, and translate technical findings into practical, actionable recommendations. Making cybersecurity accessible and relevant to decision-makers is essential for driving meaningful improvements in security. | SENAYA | “Our role also involved recommending specific, low-cost controls like implementing email authentication and using free tools for security checks. This experience showed us that our value lies in making security accessible and sustainable for the businesses that form the backbone of our community.” | | RAVINDU | “The training helped us develop the ability to explain cybersecurity risks and mitigation strategies in simple, relatable terms—using practical examples rather than technical jargon. This skill proved essential in helping MSME representatives understand their security challenges and the importance of addressing them.” | | HARINDU | “What surprised me was realizing that finding technical problems isn’t enough; you need to explain why those problems matter to the business. I had to learn how to connect technical risks to real business impacts like money loss or reputation damage. This experience challenged my technical-only mindset and taught me to think beyond just the technical side.” | | SAYUNI | “Many MSMEs had no idea what assets were critical or how to protect them. By mapping threats, ranking impact, and proposing affordable solutions like MFA and awareness sessions, it became possible to give advice that fits their scale and budget. The experience showed that understanding the people behind the system is just as important as fixing the system itself.” | Delivering Practical Security for Small Businesses Cyber clinics deliver tangible benefits to small and medium-sized businesses that often lack access to affordable cybersecurity expertise. Businesses that worked with student teams consistently reported positive outcomes, gaining practical recommendations that helped them better understand their risks and take meaningful steps to strengthen their cybersecurity. | Director, Alpha Tech Labs (Pvt) Ltd | “The engagement process was highly effective. The team listened to our needs and explained everything clearly. The training helped our staff gain a better understanding of cyber threats, and the recommendations were practical and well-aligned with our business.” | | Founder/CEO, Outright Play | “It was a pleasure working with the student team. Initiatives like this provide meaningful industry exposure for emerging talent while offering businesses a fresh perspective on critical areas such as cybersecurity. We would be happy to support or collaborate on similar programs in the future. Keep up the great work!” | | Finance Manager, Jeewaka Private Hospital | “We truly appreciate the enthusiasm, professionalism, and fresh perspective the student team brought to this engagement. It was a pleasure collaborating with them, and we believe experiences like this are valuable not only for students but also for organizations like ours.” | Creating Cybersecurity Leaders for the Future Across their responses, students described a shift in perspective, recognizing that cybersecurity is about much more than technology. They came to appreciate the importance of awareness and education, the vital role that small businesses play in local economies, and the responsibility cybersecurity professionals have to help communities become more resilient. For many, the experience reinforced that their technical skills can have a direct, meaningful impact on people’s lives. | SAYUNI | “Our job wasn’t just to find flaws, but to build practical tools tailored to their needs.” | | HARINDU | “I’ve learned that helping communities stay safe online means explaining technical stuff in ways people can actually use. My job isn’t just finding problems—it’s helping solve them in realistic ways.” | | SENAYA | “The experience taught me that creating a safer online environment starts with motivating individuals to make informed digital decisions rather than investing and relying solely on expensive controls.” | | RAVINDU | “This experience made me realize the critical role cybersecurity practitioners can play in strengthening the digital resilience of their communities.” | The Role of Cyber Clinics in Building a More Secure Digital Future The students highlighted here have now graduated and are all working in the cybersecurity industry. The cybersecurity program employability rate at SLIIT is at 85% across all the students who have participated. Every risk assessment completed, every employee trained, and every small business that adopts stronger security practices contributes to a safer digital ecosystem. By investing in the next generation of cybersecurity professionals and connecting them directly with the organizations that need support most, we’re helping build both the workforce and the resilience needed for a more secure digital future.