This is an interesting case. If an employee is liable for the loss as a consequence of a data breach in a university system then does that mean it's acceptable

This is an interesting case. If an employee is liable for the loss as a consequence of a data breach in a university system then does that mean it's acceptable for an employee to do their own penetration testing of university systems handling their money? This would help them better understand the weaknesses to protect themselves and push the university to fix their systems. Yes, this professor could have been phished and given up their credentials to a bad guy, but that shouldn't entirely offload the liability onto the employee as the university should have had strong measures in place for validating changes to routing numbers.