Institutions already years behind private companies in their ability to tackle online threats, university chief of IT warns.