I believe I would be doing the readers of AV in IT a disservice if I did not address the recent Canvas outage. Before anyone comes at me, no I am not a security expert and no I do not do anything with Canvas. With that said I am someone who has talked about security in AV since day one. As well as someone who is always looking at risk factors.
Background:
On May 6th 2026 I learned about Instructure, the parent company that runs Canvas, was aware of a cybersecurity incident. At that time this incident did not affect Canvas. On May 7th 2026 this all changed as about 9,000 education institutions discovered that their Canvas service was inaccessible. This outage was not just limited to higher education but also adult education and even grade schools.
Latest News on Instructure Outage:
https://www.cnn.com/2026/05/07/us/canvas-hack-strands-college-students-finals-week
https://www.chronicle.com/liveblog/heres-the-latest-on-the-canvas-outage-that-hit-colleges
I am not writing this article about Instructure or Canvas. I am writing this article about cloud services as a whole. For a while now I have seen a push for more services to be moved to the cloud and trust me I am even looking at cloud services. With that said it is important to weigh all the pros and the cons of using a cloud service while also understanding the risk factors.
“But James there is no personal information being stored in the cloud service I am looking at so who cares?”
You might be saying to yourself ‘but James there is no personal information being stored in the cloud service I am looking at so who cares’ This might be true. You might be looking at a cloud service that does not deal with any personal information. This does not mean a cyber incident will not cause problems to your school and your students. Look at the Instructure situation. Canvas might not hold sensitive information that could be sold on the black market but this outage prevents countless students from accessing their course materials. This is also right around the time that many schools are holding finals or about to hold finals.
This incident is with Instructure and not the schools themselves which means that there is very little our schools can do beside monitor the status while Instructure works on getting services restored.
What are schools to do while Instructure works on restoring services? Do they have backup LMS that students can use? Do professors have their materials offline that they can provide to their students? Will this outage take a couple of hours? a day? a week? or a month?
I am not saying you shouldn’t move services to a cloud platform. What I am asking is, are you taking into account all the risk factors?
“Are you taking into account all the risk factors?”
What will you or your school do if that service is no longer available? Can education continue or does everything come to a halt? When you boil down cloud services you can see that cloud service is nothing else than someone else’s computer. This move can help many schools, mainly the smaller schools, as these cloud services have dedicated folks to patch, update, and run these services which free up our staff for other duties.
This also means that again you are at the mercy of the other folks while you have little to no control.
Think about cloud services like renting an apartment. Yes the landlord is responsible for making sure you have a suitable living environment but what if they don’t meet that responsibility? Yes as a renter you have rights and protections but at what cost? You take them to court and you might win but during that time you were still impacted.
