6 ways we’re hardening Canvas LMS after the security incident

Canvas LMS forms the foundation for many teachers and learners, and as most of you will have witnessed first hand, this foundation was recently tested.

Ever since the Canvas security incident in Spring, we’ve been strengthening our foundation and hardening the systems that you depend on to meet the demands of a rapidly changing education and security landscape. That work is ongoing, and it remains a priority.

At InstructureCon 2026, I answered your questions and presented more information about this ongoing work. Here’s what I shared: 

1. We’re reducing the attack surface

Our first focus has been reducing the number of places or pathways an attacker could potentially exploit to get into, manipulate, or move through a system and further hardening our application defenses.

After patching the vulnerabilities used in the attack, we turned our attention to how Canvas and our other applications protect themselves against cross-site scripting (XSS) and similar attacks.

We’ve consolidated existing protections and expanded them with additional checks and tools. The result is a security posture that is not only stronger, but easier to test — helping our teams identify and address vulnerabilities faster, before they can be exploited.

2. We’re strengthening identity and access controls

Strong application defenses are part of the equation, as is protecting access to sensitive systems and data. 

We already had controls including single sign-on and phish-resistant multi-factor authentication in place. Following the incident, we added stronger protections for administrators and employees, including step-up authentication and an additional MFA layer.

These controls are designed to reduce the potential “blast radius” of a compromised identity by requiring additional verification for sensitive access and actions.

As attacks become more sophisticated, identity has become one of the most important layers of modern cybersecurity. Our approach is to keep raising the bar for what it takes to reach sensitive systems and data.

3. We’re accelerating detection and response

Attackers are moving faster, and so our defenses have to move faster, too.

We’re improving real-time visibility into activity within Canvas by automating more of our security detection and response processes. We’ve also deployed new logging and monitoring capabilities, plus additional blocking tools including CrowdStrike Falcon and Fastly’s Signal Sciences web application firewall.

Together, those capabilities are intended to help us detect and block malicious activity earlier — including while attacks are still developing rather than after the damage has been done.

Prevention also remains critical. But when the time between vulnerability discovery and exploitation keeps shrinking, rapid detection and response become equally important parts of the defense.

4. We’re testing our defenses (and assumptions) more frequently

We don’t want to rely solely on our own assessment that these changes are working.

Internally, we’re using new AI-enabled tools and practices to create faster feedback and response cycles as we validate security changes.

Externally, we’re increasing the frequency of third-party penetration testing. Independent testing gives us another way to challenge our assumptions, discover gaps and validate that the protections we put in place behave as intended. And by using AI, we can run these types of tests more frequently without sacrificing sustainability.

We had good security practices before the attack, but the lesson we’ve taken is that we need these practices to be faster and more frequent if we’re going to adapt to the new security landscape. Our goal is to make security validation more continuous, and these changes help us get there.

5. We’re expanding security collaboration beyond Instructure

We aren’t the first organisation in the education sector to fall prey to threat actors and we won’t be the last. That’s why we’re expanding our work across the industry through our resilience and security advisory board. The same openness and collaboration that have helped education technology advance can also help the industry strengthen its defenses.

The objective is not simply to learn from our own experience. It is to share lessons, listen to partners and customers, and contribute to a stronger security posture across the education ecosystem.

6. We’re building for resilience when disruption does happen

Hardening systems means doing everything practical to prevent an incident, but true resilience requires asking another question: What happens if disruption occurs anyway?

No technology provider can credibly promise a world with zero incidents. That means our responsibility also includes making sure institutions have better options when the unexpected happens.

Since the incident, we’ve had more than 500 conversations across more than 365 institutions and business customers about what continuity actually means to them. Access to gradebooks emerged as the top priority, followed by communication, tested contingency plans and access to course materials.

That feedback is already influencing what we build.

We’re launching a new Learning Continuity Settings page designed to make backups accessible to more institutions without requiring them to build their own technical processes. The initial capability will allow admins to schedule bulk gradebook exports as CSV files, with course roster exports planned to follow.

We’re also working on new self-service options that will give customers greater ability to fully remove data from Canvas that they no longer need us to retain.

Beyond that, we’re exploring additional continuity capabilities with customers, including large-scale course-content backups, read-only access to content during an outage, potential offline grading capabilities and secondary Canvas instance failover.  

This is just the starting point

The work following this incident is about addressing what happened, but it is also about adapting to what comes next and continuing to listen to our community of dedicated educators.

We are by no means declaring this work finished. Like the work of education, the work of security is never done. We are, however, declaring our ongoing commitment to building greater resilience into the foundations of learning. We’ve done a lot of great work together in the last fifteen years, and we’re excited to keep working beside you to build the next fifteen years of teaching and learning.