The Locksmith’s Forecast

The framing is Ray’s. He calls QuickLaunch the digital locksmith — pragmatic hired help, working on your locks, not selling you a brand of lock. The metaphor pulls forward into this list. Every prediction is a locksmith’s read of who holds the keys, who lost them, and what changes when the lock itself becomes an agent.

I asked the questions. Ray answered. I went and found the receipts.

---

1. SMS and Email One-Time Passwords Become a Risk, Not a Control

The question

I asked Ray which prediction he was most certain about. He didn’t hesitate.

Ray SMS OTP is already on borrowed time. The bypass kits are commodity. Reverse-proxy phishing captures the authenticated session after the code is typed, so the second factor doesn’t even slow the attacker down. The reason SMS persists is that institutions wired it into compliance language a decade ago and now treat it as the floor. The next twelve months will make that posture indefensible. Not because the technology changes — because the regulatory floor and the federal guidance both move past it, and the auditors catch up.

The receipts available right now

CISA published Implementing Phishing-Resistant MFA in October 2022 and has been clear in every follow-on advisory that SMS-based authentication does not meet the bar. The Volt Typhoon advisory series in early 2024 specifically called out MFA-bypass techniques that defeat SMS. In December 2024 CISA followed with mobile communications best-practice guidance after the Salt Typhoon telecom breach, recommending phishing-resistant MFA and explicitly cautioning against SMS-based authentication for high-value accounts.

The NIST SP 800-63B revision currently in force already classifies SMS as a restricted authenticator that agencies must demonstrate justification to keep using; the SP 800-63-4 update process is in flight and consistently signals tighter restrictions, not looser. On the practical side, the U.S. Patent and Trademark Office moved off SMS authentication in 2025, and federal SaaS contracts began naming phishing-resistant MFA as a procurement requirement well before the end of the fiscal year.

None of this is hidden. It is on cisa.gov, csrc.nist.gov, and in every published incident report from the major IR firms. Ray’s prediction is that institutions will start treating SMS the way the federal floor already treats it. That lag is the prediction’s actual content.

---

2. Ghost Accounts and Financial-Aid Fraud Stay Unsolved at the Bottom of the Sector

The question

I asked why he was so sure smaller institutions would still be carrying this in eighteen months, when the urgency is already loud.

Ray Because the urgency is loud at the wrong table. The CIO knows. The director of financial aid knows. The cabinet doesn’t fund the fix because the fix is unglamorous and the line item shows up as IT overhead. Meanwhile the attacker tooling gets cheaper every month. The gap between what an institution can defend against and what an institution is willing to pay to defend against is the entire shape of this problem. Twenty years of stale-credential work taught me one thing: the structural problem doesn’t fix itself, and the fix doesn’t come from procurement.

The receipts available right now

The California Community Colleges Chancellor’s Office has reported on bot-driven enrollment fraud across the 116-college system in successive cycles — with district-level fraud rates well above 50 percent at some campuses, and one Fortune story this summer documenting 26 percent fraud across 1.2 million applications across 75 colleges. The U.S. Department of Education expanded FAFSA identity verification requirements for the 2025-26 cycle in response to disbursement to ineligible identities, including disbursements traced to deceased Social Security numbers.

The pattern is structural: the receiving institutions have neither the budget nor the staffing to add an identity-verification layer that fits academic populations (incarcerated students, dual-enrollment high schoolers, refugees without standard documents) without breaking access. That mismatch is what makes Ray’s eighteen-month horizon conservative. The fix exists. The fix doesn’t get bought.

---

3. Agentic Capability Ships Inside Vendor Solutions. The How-To-Implement Does Not.

The question

I asked Ray to be specific about which capability and which gap.

Ray Look at Microsoft, look at Salesforce, look at Anthropic. The capability is real and it’s shipping. Copilot Studio has agents. Agentforce has agents. Model Context Protocol is what makes any of this connect to your data without re-plumbing every integration. The capability layer is solved or solving. The campus-specific implementation layer — how do I deploy an agent that talks to Banner without violating FERPA, how do I scope the permissions for a financial-aid agent so an attacker can’t use it to lateral into the SIS, who owns the agent when the practitioner who built it leaves — that’s nowhere. The vendor decks all say just configure it. Configuration is the work. Configuration is what the institution doesn’t have staff for.

The receipts available right now

Salesforce launched Agentforce in September 2024 with a developer SDK and a marketplace promise. Microsoft has been shipping configurable Copilot Studio agents through 2024 and 2025, with administrative controls layered on as the production estate grew. Anthropic published the Model Context Protocol in November 2024 and the ecosystem of MCP servers grew faster than any prior agent-tooling standard in this space. All three give an institution the building blocks. None of them give an institution a higher-ed-specific deployment guide.

That gap is the prediction. The capability is here. The guidance is not. The institutions that figure it out first will not figure it out from the vendor documentation.

---

4. AI Identities Cause Major Harm at Two or More High-Profile Institutions

The question

I asked Ray if naming a specific number of institutions wasn’t putting himself out on a limb.

Ray The limb is the point. A prediction without a number is a feeling. Two or more is the floor I expect the data to clear. The mechanism is already in production at the enterprise side. We just haven’t seen it land on campus yet, and the only reason for that is that higher ed adopts agents nine months behind the enterprise. The clock started when Copilot Studio went GA. The first incident is already inside the window.

The receipts available right now

The Cloud Security Alliance and GitGuardian have been publishing on non-human identity exposure through 2024 and 2025, documenting attack patterns where compromised machine credentials and over-provisioned service accounts become the entry vector. The enterprise NHI literature treats this as a current attack surface, not a theoretical one. Verizon’s 2025 DBIR documents stolen credentials as the leading initial access vector for basic web application attacks.

Higher ed has run on service accounts the same way enterprise has for two decades. The only structural difference is that the agent now uses the service account at machine speed and at the breadth of the agent’s reach, not at the narrow scope of a single human role. When this lands on a campus, it will land hard. Ray’s prediction is the floor, not the ceiling.

---

5. AI Agents That Work Across Applications Beat AI Features Bolted Inside Them

The question

I asked why he framed this as a pattern shift instead of a feature comparison.

Ray Because comparing features misses the architecture. The in-app chatbot is the same product the LMS vendor was trying to sell you in 2019 with a new wrapper. The agent that sees across your SIS, your LMS, your CRM, your financial-aid system, and your faculty workflow is a different category. It doesn’t compete with the in-app feature. It makes the in-app feature small. The institutions that adopt agents will not be choosing between agents and embedded AI. They will be choosing to stop investing in embedded AI because the agent ate its lunch.

The receipts available right now

Anthropic published the Model Context Protocol on November 25, 2024. The premise of MCP is exactly the cross-application pattern Ray is naming: an agent talks to many tools through one shared interface, instead of every vendor building a private chat surface inside their own app. The MCP server ecosystem grew through 2025 to cover developer tools, productivity surfaces, calendar and email, and an early wave of enterprise data sources.

Salesforce’s Agentforce launch was paired explicitly with a multi-system integration story. Microsoft’s Copilot strategy in 2025 leaned into the connected-app pattern. The investment pattern across the agent vendors is converging on cross-application from below. The in-app pattern is not getting more investment. It is getting less.

---

6. OAuth-Based Student Access and Bring-Your-Own-Identity Disrupt Campus IAM

The question

I asked Ray why BYOID would beat the inertia of an institutional identity stack that has been running for twenty years.

Ray Because the student already has the identity. They show up to campus on day one with an Apple ID, a Google account, a Microsoft personal tenant, and whatever the high school district handed them. The institution’s job is to bind one of those to their academic record and stop pretending it has to mint a new credential from scratch. The friction of provisioning a brand new institutional account for a population that already has three of them is its own argument. The economics catch up to the friction. The cabinet votes with the budget.

The receipts available right now

Microsoft Entra External ID reached general availability in 2024, explicitly designed for the BYOID pattern. Apple expanded Sign in with Apple coverage through 2024 and 2025; Google did the same with Workspace for Education identity surfaces. The OAuth 2.0 specification is the connective tissue and the spec is stable. EDUCAUSE has been publishing case studies on BYOID pilots in higher ed through 2024 and 2025, and the FAFSA Simplification rollout itself relies on the FSA ID, a federated identity that already lives outside any single institution.

The traditional campus IAM stack does not lose because BYOID is technically better. It loses because the population the institution serves has already chosen.

---

7. Higher Ed Picks a Preferred LLM, and the Pick Is Probably Microsoft

The question

I asked Ray to defend the cynicism of the deployment-surface argument.

Ray Higher ed picks the model that’s already on every faculty laptop. That’s not cynicism, that’s twenty years of watching Microsoft Office become the academic floor and then Microsoft 365 become the academic floor and now Copilot is the academic floor. It doesn’t matter if Gemini is better on a benchmark. The licensing surface decides. The faculty already have it. The students already have it. The provost already paid for it. The model that wins is the one nobody has to procure twice.

The receipts available right now

Microsoft 365 A3 and A5 education licensing is the dominant productivity stack in higher ed, and Copilot is bundled into the A5 surface. ASU and OpenAI announced an enterprise partnership in January 2024 and several state systems followed with model-specific pilots through 2024 and 2025. University of Michigan’s Maizey, NCSU’s GenAI tooling, and a wave of system-level partnerships document that the preferred-LLM question is already being answered at the procurement layer, one campus at a time. The aggregate pattern, when measured, will reflect the deployment surface, not the model leaderboard.

---

8. In-Application AI Bundled Inside SIS and ERP Platforms Underperforms

The question

I asked Ray why he was singling out SIS and ERP specifically.

Ray Because the student lifecycle is not the employee lifecycle. ERP AI inside an HR platform has a clean object — the employee, the leave request, the payroll run. The SIS AI is trying to optimize a journey that crosses the application boundary every single day. Recruitment, application, financial aid, registration, advising, retention, completion. No SIS owns the whole lifecycle. An AI feature trapped inside one of them only ever sees a slice. The student isn’t inside the application. The student is across all of them.

The receipts available right now

Anthology, Ellucian, and Workday have all announced AI features bundled inside their platforms through 2024 and 2025, with marketing emphasizing convenience and embedded chat surfaces. Published outcome data — specifically, peer-reviewable adoption stories showing measurable lifts in retention, completion, or time-to-degree — remained thin through the announcement cycle. The Gartner cycle on agentic AI in 2025 began separating the agent narrative from the in-app feature narrative for exactly this reason.

This is the only prediction on the list where Ray is hoping to be wrong. The institutions that benefit most from in-app AI are the ones that need the help most, and a working in-app AI feature inside a Banner deployment would be a real gift to the field. The prediction holds because the architecture is wrong, not because the vendors aren’t trying.

---

Ray’s Corner

I asked Ray at the end of the conversation why he was willing to put numbers on these. He could have shipped this as a list of directions — the way most analyst notes ship — and dodged the falsifiability problem. Instead he gave me an 18-month clock on most of them and a 24-month clock on two.

Ray Because a prediction without a number is a feeling. I’ve been on a plane every week for the last twenty years watching institutions buy the same problem and unwrap it as if it was new. I have earned the right to be wrong, on the record, with timeframes attached. If I’m wrong, I’ll write the post about why. If I’m right, the people who acted on it will know it before the people who waited. That’s the only reason to keep writing.

The locksmith metaphor he leans on is operational, not decorative. The locksmith works on your locks. The locksmith doesn’t sell you a brand of lock. The locksmith is the one you call when somebody else already broke in.

Every prediction on this list maps to one of three locksmith questions: Who holds the keys? When the lock changes, who has the new key? When the agent finishes its job, who takes the key back?

If you read this list eighteen months from now and most of it landed, the receipts above are why — they were already on the public record when Ray made the call. If you read this list eighteen months from now and the predictions missed, the next post will be the one explaining what changed. That’s the contract.

#theWatchNeverRestarts

Eight predictions. Eight timeframes. The clock starts October 30, 2025.