UNLV's Cyber Clinic path to success

The Cyber Clinic at UNLV, a nonprofit student-run organization, has grown in popularity since 2025 by continuously protecting small businesses throughout the Las Vegas valley, and the Cyber Clinic is on the hunt for new members. 

Since 2021, the nonprofit student-run organization has offered free services and cyber protection education to small local businesses. However, since the 2023 cyberattacks against MGM Resorts and Caesars Entertainment, the Cyber Clinic's clientele has grown significantly as small businesses feared they were next. 

“We go around, and we try to help out small businesses,” said Aubhan Mahapatra, the project coordinator. “It's typically a very expensive procedure. There's plenty of consulting companies here in the valley, but they'll usually charge at price points that are typically unreachable for many of these businesses.” Mahapatra’s been with the clinic for one and a half years, with his current position for half a year. 

Mahaptra’s role as President of Project Coordination consists of assisting in personal development, handling client management, and working closely with other departments for organizational alignment. Mahapatra is in the last semester of his graduate program, where he will soon have a Master of Science in cybersecurity and management information systems.

Although small businesses are not the only ones who benefit from the Cyber Clinic. Students who join benefit from gaining real hands-on experience by engaging with a range of clientele and conducting procedures that are present within the field. Such as the CARE process, which is abbreviated for consultation, assessment, remediation, and education. Remediation is only offered if the clinic sees fit. Then, clients will have the choice to proceed to the remediation. 

“You always want somebody who can guarantee that they're protecting your things, your intellectual property, and your assets,” Mahapatra said. “So, there's not a huge demand in the industry for inexperienced cybersecurity professionals. Everyone is usually only going to want to hire the best, and students can't be the best just for the sake of being students.”

Members of the clinic recognize the ongoing battle within cybersecurity. Cyber attackers are not directly on the hunt for certain people or businesses; however, cyber attackers are on the hunt for who is the most vulnerable and proceed from there. 

“There's a bunch of different other kinds of malware. Most of them persist on you never knowing because the longer they can stay on your computer, that's just more information they can get from you,” Mahapatra said. “Cyber attackers are finding what your credit card information is or finding what kind of sensitive information you type into your keyboard. Anything they can put into your computer, they'll be able to see. So, it's their interest to never be found. Malware is really scary nowadays, and it's also silent.”

With the internet being an infinite road that bridges people and businesses from all over the world into one space, cyberattacks can happen at any time of the day or year. There is no direct catalyst in the rise of cyber-attacks, instead, it is the lack of protection knowledge. While the internet is not the safest of all places, it is one of the most valued. 

“We had an old legacy system, and it worked great for what it was,” Mahapatra said. “The issue was it didn’t do a good job of bringing a board of new people. There’s tons of people at UNLV, and the cybersecurity program has grown exponentially over a few semesters. When I first joined some of my classes, there were only like 20 to 15 people. Now there's around 40.”

The cybersecurity bachelor’s program spiked in popularity within the past two semesters. Student enrollment spiked to around 200 students, and Mahapatra took the opportunity to create a new system that is accessible to all students and of the organization to further their cybersecurity skills. Mahapatra acted quickly in a short amount of time to create a system that would disrupt the past comfort level of the old one. Since Mahapatra’s contribution, he believes it is one of his proudest accomplishments at the clinic. 

“Even changing that process, it affects questions that are asked later on during an engagement,” Mahapatra said. “It changes questions necessary for when we do our reporting and our deliverables. It was a very, very, very large cascading domino effect that you don't really see when you're working. We eventually revamped a lot of our documentation, our processes, our internal systems, and it did accelerate the rate at which we could perform these client engagements.”

With Mahapatra’s actions, the clinic’s turnaround time for completing the CARE procedure was able to drop by 20% to 30% of client engagements. By doing so, students would be able to be more thorough and more organized, so they can proceed to the next client without back-and-forth auditing. The Cyber Clinic also stresses the importance of their role within cybersecurity as they do not tackle cyber-attacks, but rather provide the education their clients need to lessen their vulnerability. 

“There are three types of services we provide: consultations, assessments, and remediation,” Yasmeen Atout, the assistant project coordinator, states.  “Now, not all clients who request assistance qualify for these services because the main thing that we do is move on to education and preventative measures. If someone is undergoing a cybersecurity attack, we are not able to help them. We won’t be able to go into their computer and fix the attack because that’s not the service we provide.”

Atout works under Mahapatra, handling tasks such as drafting important paperwork, tracking clients, communicating and managing engagement teams, overseeing projects across the clinic, and providing students with the resources they need. With Atuot on the route for her bachelor’s degree in cybersecurity, she joined the clinic in the spring semester of 2025 and has held her current position since the fall semester of 2025. 

The two main services the clinic provides, consultation and assessment, vary from each other. The engagement team does not touch any of the client’s devices during consultations due to the client’s level of comfort. As for the assessment, the team works on the devices that the clients consent to. These devices range from routers, point of sale systems, and phones.

“For remediation, it’s only for certain clients who choose to go through with it. Only clients that have done an assessment can do remediation. The engagement team will go back in with the tools recommended and the vulnerabilities they found,” Atout said. “When I was in my assessment (engagement team) era, you wouldn’t believe what I saw. I won't say who for confidentiality reasons, but I was shocked when people still use ‘password123’ because there’s no way this was real!” 

While internet safety education has always stressed the importance of strong passwords, common passwords are still one of the top disadvantages small businesses and people have when it comes to cyber-attacks. The Cyber Clinic stresses that small businesses and students strengthen their cybersecurity skills with the resources they provide. 

Mikayla Tuzon, the President of the Cyber Clinic, started her cybersecurity journey with a different background from most students. With a bachelor's in journalism and a public relations concentration, she provided the clinic with the media content it needed to thrive in other areas. Tuzon joined the clinic two years ago and became president of the clinic six months ago. 

“I was able to complete my internship as part of the journalism program,” Tuzon said. “I was able to write articles and briefs about the clinic. I will definitely say that myself and one of the students came into the clinic knowing nothing, like barely anything about cybersecurity. But, I wanted to learn, and through the clinic, I learned a lot about cyber security to the point where now I’m doing it as my master’s.”

With her presidential role, Tuzon not only provides leadership and the overall direction of the clinic, but she also oversees the day-to-day operations and conducts the weekly general meetings. While the clinic provides on-hand experience with clientele engagement, it builds students up in all aspects of their careers and within themselves. The clinic is flexible around students’ schedules so they can manage an academic and work-life balance.

“We typically aim to do around three to five assessments a month. We had this whole initiative last semester called ‘Push to 30’ where we tried to reach 30 clients in two to three months, because we were meeting with the Commissions of Congress,” Tuzon said. “We wanted to basically showcase if we have the bandwidth and have the resources and everything. And, of course, access to a bunch of small businesses within the valley. We were able to push out so much work, and within two to three months, we actually surpassed our goal of 30, and we’re able to reach about 40 clients (assessments).”

Assessments take time, and when not all students are able to participate due to conflicting schedules, the number of clients seen within a semester varies. Nathaniel Boyle, Vice President of the Cyber Clinic, acknowledges the time assessments and the follow-up procedures typically take. 

“A rough estimate of completing an assessment can be a week or maybe two, so we have to break it up,” said Nathaniel Boyle, Vice President of the Cyber Clinic. “The actual time we spend in the business is about an hour or two, but then there's a week within the month where we write and polish all reports.”

Boyle has been with the organization since the fall semester of 2024, and he has held his current title since the fall semester of 2025. Boyle is now finishing his last semester of graduate school with a master’s of Business in management information systems, cybersecurity, and data analytics.

As the Cyber Clinic showed their determination, they went beyond their goals. It allowed Boyle to focus on a different aspect of the nonprofit student organization. With Boyle’s determination, he was able to establish good bylaws within the Cyber Clinic to lean back on an ethical code of conduct. It allowed students to get a glimpse of the professional expectations and pace for their future work environments. 

“My goal is to have everyone, every student, I come into contact with be prepared for working in an office,” Boyle said. “There’s a lot of different frameworks and standards in the cybersecurity industry, and it's kind of, you know, what fits you best. Part of one of the main things I do for the clinic now is because I have this corporate experience before going back to school. I can provide that kind of oversight or mentorship to the clinic.”

The Cyber Clinic takes battles beyond the scenes of what students and small businesses may think. The nonprofit student-run organization continues to manage its success by adapting to an ever-changing industry that will always have conscious cyberattacks and threats. With the clinic providing education and internet safety for small businesses throughout the valley, the Cyber Clinic notes that the experience students gain will build confidence in a field that will need it greatly. 

“Even if you don’t realize it, you’ve already been practicing cybersecurity,” Mahaptra said. “If you have a password on a computer or something that limits access, then you’ve been practicing cybersecurity. Everyone has some skill set that can benefit the clinic. No matter how tangential your degree is, there’s things in your degree that absolutely can be related to cybersecurity in some way. We accept any individuals into the clinic. Whatever background you might have, it kind of goes hand in hand with another big idea in cybersecurity. Cybersecurity is everyone’s job.”

Cyber Clinic officers join together for their weekly meeting. Taken by Abbey Steinman on 05/01/26.

Vice President of Project Coordination, Yasmeem Atout, outside the AEB building. Taken by Abbey Steinman on 04/29/26