UNLV's Cyber Clinic Path to Success

The Cyber Clinic at UNLV is a profound nonprofit and student-run organization that offers free services throughout the Las Vegas valley to protect and educate students and small businesses about cybersecurity since its creation in 2021. After five successful years of the organization's foundation, the Cyber Clinic is on a continuous growth path, with countless students of all backgrounds joining to strengthen their personal and career skills.

The nonprofit and student organization experienced a surge of interest in 2023 following the cyberattacks on MGM Resorts and Caesars Entertainment. The Cyber Clinic took the initiative of protecting small businesses throughout the valley, as fear among the biggest corporations within the city was being targeted. Now, the Cyber Clinic, in total, has more than 100 members, with 40 to 50 being active members and the rest alumni.

“We go around, and we try to help out small businesses. It's typically a very expensive procedure. There's plenty of consultation companies here in the valley, but they'll usually charge at price points that are typically unreachable for many of these businesses,” Abubhan Mahapatra, the President of Coordination, states. Mahapatra’s been with the clinic for one and a half years, with his current position for half a year.

Mahaptra’s role consists of coordinating operations teams for the Cyber Clinic, such as assisting in personal development, handling client management, and working closely with other departments for organizational alignment. Mahapatra is in the last semester of his graduate program, where he will soon have a Master of Science in cybersecurity and management information systems.

Although small businesses aren’t the only ones who benefit from the Cyber Clinic. Students who join benefit from gaining real hands-on experience by engaging with a range of clientele and conducting procedures that are present within the field. Such as the CARE process, which is abbreviated for consultation, assessment, remediation, and education. Consultation, assessment, and remediation will be conducted at the client's request with the clinic’s judgment.

“You always want somebody who can guarantee that they're protecting your things, your intellectual property, and your assets. So, there's not a huge demand in the industry for inexperienced cyber security practices of cyber security. Everyone is usually only going to want to hire the best and students can't be the best just for the sake of being students,” Mahapatra expresses.

Members of the clinic recognize the ongoing battle within cybersecurity. Given at any point and time where vulnerability is present, cyber attackers take advantage of any opportunity. Cyber attackers are not directly on the hunt for certain people or businesses; however, cyber attackers are on the hunt for who is the most vulnerable and proceed from there.

Mahapatra warns, “There's a bunch of different other kinds of malware. Most of them persist on you never knowing because the longer they can stay on your computer, that's just more information they can get from you. Cyber attackers are finding what your credit card information is or finding what kind of sensitive information you type into your keyboard. Anything they can put into your computer, they'll be able to see. So, it's their interest to never be found. Malware is really scary nowadays, and it's also silent.”

With the internet being an infinite road that bridges people and businesses from all over the world into one space, cyberattacks can happen at any time of the day or year. Mahapatra expresses that there is no direct catalyst in the rise of cyberattacks; instead, it’s the lack of protection knowledge. While the internet is not the safest of all places, it is one of the most valued.

“We had an old legacy system, and it worked great for what it was. But, the issue was it didn’t do a good job of bringing a board of new people. There’s tons of people at UNLV, and the cybersecurity program has grown exponentially over a few semesters. When I first joined some of my classes, there were only like 20 to 15 people. Now there's around 40,” Mahapatra states.

The cybersecurity bachelor’s program spiked in popularity within the past two semesters. Student enrollment spiked to around 200 students, and Mahapatra took the opportunity to create a new system that is accessible to all students and of the organization to further their cybersecurity skills. Mahapatra acted quickly in a short amount of time to create a system that would disrupt the past comfort level of the old one for the sake of growing with the student enrollment and engagements with their clients.

By changing how the clinic’s system works internally, Mahapatra believes this is one of his proudest accomplishments at the clinic, as he quotes, “Even changing that process, it affects questions that are asked later on during an engagement. It changes the questions necessary for when we do our reporting and our deliverables. It was a very, very, very large cascading domino effect that you don't really see when you're working. We eventually revamped a lot of our documentation, our processes, our internal systems, and it did accelerate the rate at which we could perform these client engagements.”

With Mahapatra’s actions, the clinic’s turnaround time for completing the CARE procedure was able to drop by 20% to 30% of client engagements. By doing so, students would be able to be more thorough in a timely manner and more organized, so they can proceed onto the next client without back-and-forth auditing. The Cyber Clinic also stresses the importance of their role within cybersecurity as they do not tackle cyber attacks, but rather provide the education their clients need to lessen their vulnerability.

In essence, “There are three types of services we provide: consultations, assessments, and remediation. Now, not all clients who request assistance qualify for these services because the main thing that we do is move on to education and preventative measures. If someone is undergoing a cybersecurity attack, we are not able to help them. We won’t be able to go into their computer and fix the attack because that’s not the service we provide,” Yasmeen Atout, the Vice President of Project Coordination, states.

Atout works under Mahapatra with tasks such as drafting important paperwork, keeping track of clients, communicating and managing engagement teams, overseeing projects throughout the entire clinic, and providing students with the resources they need. With Atuot on the route for her bachelor’s degree in cybersecurity and her interest in the field, she joined the clinic in the spring semester of 2025 and has held her current position since the fall semester of 2025.

The two main services the clinic provides, consultation and assessment, vary from each other as the engagement team will not be touching any of the client’s devices during consultations due to the client’s level of comfort. As for the assessment, the team is allowed to work on the devices that the client grants access and consent to. These devices can be anywhere from routers, point of sale systems, phones, or any technology that is critical to the small business.

“For remediation, it’s only for certain clients who choose to go through with it. Only clients that have done an assessment can do remediation. The engagement team will go back in with the tools recommended and the vulnerabilities they found,” Atout reveals. “When I was in my assessment (engagement team) era, you wouldn’t believe what I saw. I won't say who for confidentiality reasons, but I was shocked when people still use ‘password123’ because there’s no way this was real!”

While internet safety education has always stressed the importance of strong passwords, the Cyber Clinic further discloses how common passwords are still one of the top disadvantages small businesses and people have when it comes to cyber attacks. Even though the thought of it may be laughable, the Cyber Clinic stresses that small businesses and students strengthen their cybersecurity skills with the resources they provide.

Even though there has been significant growth of interest within the cybersecurity academic path, cybersecurity may seem intimidating for students who are among the field of interest. However, Mikayla Tuzon, the President of the Cyber Clinic, started her cybersecurity journey with a different background from most students. With her bachelor's in journalism with a public relations concentration, she was able to provide the clinic with the media content they needed to thrive in other areas. Tuzon has been with the clinic for two years, and she has held her current position for six months.

“I was able to complete my internship as part of the journalism program. I was able to write articles and briefs about the clinic. I will definitely say that myself and one of the students came into the clinic knowing nothing, like barely anything about cybersecurity. But, I wanted to learn, and through the clinic, I learned a lot about cyber security to the point where now I’m doing it as my master’s,” Tuzon gladly states. With her presidential role, Tuzon not only provides leadership and the overall direction of the clinic, but she also oversees the day-to-day operations and conducts the weekly general meetings.

While the clinic provides on-hand experience with clientele engagement, Tuzon believes that it builds students up in all aspects of their careers and within themselves. The clinic is flexible around students’ schedules so they can manage an academic and work-life balance. Even though their members' schedules highly differ from one another, Tuzon remarks on an accomplishment that was striking for the organization last semester.

“We typically aim to do around 3 to 5 (assessments) a month. We had this whole initiative last semester called ‘Push to 30’ where we tried to reach 30 clients in two to three months, because we were meeting with the Commissions of Congress,” Tuzon quotes. “We wanted to basically showcase if we have the bandwidth and have the resources and everything. And, of course, access to a bunch of small businesses within the valley. We were able to push out so much work, and within 2 to 3 months, we actually surpassed our goal of 30, and we’re able to reach about 40 clients (assessments).”

It must also be duly noted that assessments take time, and when not all students can participate due to conflicts of schedules, the amount of clients that are able to be seen within a semester will always vary. Nathaniel Boyle, Vice President of the Cyber Clinic, acknowledges the time assessments and the follow-up procedures typically take.

“A rough estimate of completing an assessment can be a week or maybe two, so we have to break it up. The actual time we spend in the business is about an hour or two, but then there's a week within the month where we write and polish all reports,” Boyle states. Boyle has been with the organization since the fall semester of 2024, and he has held his current title since the fall semester of 2025. Boyle is now finishing up his last semester of graduate school with a Master of Business Administration in management information systems, cybersecurity, and data analytics.

As the Cyber Clinic has shown its determination in completing its goals and further beyond it, it allowed Boyle to focus on a different aspect of the student-non-profit organization. With Boyle’s determination, he was able to establish good bylaws within the Cyber Clinic to lean back on an ethical code of conduct. With this in mind, it allowed students to get a glimpse of the professional expectations and pace for their future work environments.

“My goal is to have everyone, every student, I come into contact with be prepared for working in an office. There’s a lot of different frameworks and standards in the cybersecurity industry, and it's kind of, you know, what fits you best. Part of one of the main things I do for the clinic now is because I have this corporate experience before going back to school. I can provide that kind of oversight or mentorship to the clinic,” Boyle expresses as he values his career insight as knowledge for members of the clinic.

The Cyber Clinic takes battles beyond the scenes of what students and small businesses may think. The nonprofit student-run organization continues to manage its success by adapting to an ever-changing industry that will always have conscious cyberattacks and threats. With the clinic providing education and internet safety for small businesses throughout the valley, the Cyber Clinic notes that the experience students gain will build confidence in a field that will need it greatly.

“Even if you don’t realize it, you’ve already been practicing cybersecurity. If you have a password on a computer or something that limits access, then you’ve been practicing cybersecurity. Everyone has some skill set that can benefit the clinic. No matter how tangential your degree is, there’s things in your degree that absolutely can be related to cybersecurity in some way. We accept any individuals into the clinic. Whatever background you might have, kind of goes hand in hand with another big idea in cybersecurity. Cybersecurity is everyone’s job,” Mahapatra articulates.

Made with Squarespace