Blank Canvas
Why my LMS failure has me thinking about a redesign for resilience and redundancy.
TLDR from the TLDR Bot
The recent Canvas ransomware incident exposed a major weakness in higher education: many colleges rely on one cloud platform for course materials, assignments, grades, communication, and accreditation, creating a single point of failure.
The author argues that colleges should “decouple” these functions by using separate tools and maintaining backups, so teaching and learning can continue even if one system goes down.
Students and faculty should adopt practical safeguards such as keeping local and cloud backups, exporting gradebooks, saving course materials offline, and maintaining alternative ways to communicate.
Using multiple digital tools is not just a safety measure; it also helps students build workplace skills like organization, cybersecurity awareness, version control, and adaptability.
The main lesson is that trust and resilience matter more than convenience. Higher education should design its digital systems like airplanes, with redundancy and overlapping safeguards that keep operations running when one part fails.
Several years ago, I assigned Malcolm Gladwell’s book Outliers to my English 101 students. While his chapter “The Ethnic Theory of Plane Crashes” has multiple errors that seem to foreshadow AI’s algorithmic bias, one lesson from that chapter came to mind on Thursday, May 7, when I tried to submit my final Old English paper to Canvas and was faced with a “system maintenance” screen instead.
Gladwell argues that airplane crashes are rare because airplanes are designed with multiple redundancies. Several things have to fail simultaneously before a plane goes down. Pilots train for those failures, and backup systems are built into nearly every critical component.
As the Canvas hack shows, higher education has taken a very different approach to its digital infrastructure (as of this writing, May 11 at 9:00 p.m., it looks like they decided to pay the ransom). Last week, for the more than 40% of schools using Canvas as a learning management system (LMS), the one-stop-shop model for content delivery, assessment, and student communication proved to be a single point of failure.
“Why can’t students just take their finals in blue books like I did?” one of my friends complained on Facebook when Idaho State University (the school where I am studying for my English Ph.D.) announced they were cancelling final exams.
Ah, my friend! Little do you know! Over the past decade, we have consolidated course content, assignment submission, grading, communication, assessment, and accreditation data into a single proprietary cloud platform. Canvas has become the digital equivalent of the campus power grid. When it works, the system is remarkably convenient. When it fails, as we saw during finals week, teaching and learning can grind to a halt.
It’s time to talk about trading some convenience for some resilience. With the advent of agentic AI, the barriers for hackers of cloud-based systems are pretty darn low. Any SaaS is potentially vulnerable: According to a May 2026 Inmotion Real Estate report, 80% of small and mid-sized businesses experienced at least one cyberattack in 2025. There’s even a new term for this behavior: “vibe hacking.”
The Canvas breach exposed how dependent colleges and universities have become on a one-stop shop for nearly every aspect of academic life. I believe it’s also a time for us to prepare for the next time by rethinking that architecture and separating the major functions of the learning management system into tools and workflows that can continue operating even when one platform is unavailable.
Decoupling the Learning Management System
The LMS currently performs at least five distinct functions:
Delivering course content: Course materials should be portable and easy to export. I design my courses in Pressbooks, which allows me to distribute content as web pages, PDFs, and EPUB files. If the online platform disappeared tomorrow, I would still have complete copies of my course materials and could share them immediately with students. If the Pressbooks site were compromised, I’d still have pdf versions of my textbooks. Content accessibility matters. Students cannot learn from content trapped inside a system they cannot access.
Collecting assignments: Every important assignment should exist in at least two places: on the student’s device and in a cloud backup service such as Google Drive, Microsoft OneDrive, or Dropbox.
Managing communication: Faculty need a reliable way to contact students outside the LMS. During the recent outage, many instructors discovered that Canvas was the only place where they had easy access to announcements and student messages. At my institution, I was fortunate to have access to a separate student information system that allowed me to email my students directly.
Recording grades: Grades and personally identifiable information require the most secure environment possible. Faculty should export gradebooks regularly and keep offline backups. A simple CSV file can preserve an entire semester’s worth of work.
Generating assessment and accreditation data: Assessment data tied to program and institutional outcomes should be exportable and stored independently of any single vendor platform. Accreditation is too important to depend entirely on proprietary software.
These functions do not need to reside in the same environment. In fact, as recent events have demonstrated, there are good reasons to keep them separate.
Redundancy as Workforce Preparation
Some readers may object that students and faculty do not want to manage multiple systems. Believe me: as both a student and as a faculty member, I get it. But the modern workplace rarely packages communication, project management, file storage, and reporting into a single dashboard. Professionals move constantly among email, shared drives, project management software, spreadsheets, and specialized applications. They keep track of deadlines, organize files, and recover when systems fail.
The workplace does not come with a Canvas to-do list. When students learn to maintain backups, track deadlines independently, and navigate multiple digital tools, they are developing skills that employers actually value:
Organization
Data management
Cybersecurity awareness
Version control
Adaptability
Personal responsibility
In other words, redundancy is actually workforce training.
Practical Safeguards for Students and Faculty
What can we take away from this moment? As a student, here’s my action plan:
Keep local and cloud backups of important work
Maintain due dates in a personal calendar
Save copies of substantive discussion posts
Download instructor feedback
Check institutional email regularly
As a faculty, I’m setting a new workflow for myself this summer:
Export the gradebook weekly
Download assignment submissions periodically
Maintain offline copies of course materials
Keep a current class roster with student email addresses
Establish an alternative communication plan
Continue to build my courses in an LMS-agnostic platform (I personally love Pressbooks).
Sure, rhese practices introduce a small amount of additional friction. They also provide a remarkable amount of protection.
Trust as the Real Infrastructure
The real issue for me is not that Canvas was hacked (I wrote that “not” statement! It’s not ChatGPT!). Technology will fail. Vendors will make mistakes. Hackers will continue looking for vulnerable systems.
The real question problem is trust. Instructure’s failure to communicate effectively—they initially reported that they had the security breach under control—makes me wary of what comes next. And I think this is only the beginning—every cloud-based SaaS is vulnerable.
Higher education cannot afford to place all of its instructional eggs in one proprietary basket and hope nobody drops it. The future of digital learning should resemble an airplane: multiple systems, overlapping safeguards, and enough redundancy to keep flying when an engine fails.
Now excuse me while Claude and I vibe code a bespoke LMS.
How did the Canvas hack affect you? What safeguards are you putting into place? Did you vibe code your own LMS last weekend? These are strange times indeed! Happy prompting!
AI Acknowledgment Statement:
This post was kind of a new process for me. I dictated most of it into the Notes app on my phone. Then I asked my Liza Long Persona bot to organize the content without changing my voice, but the initial result read like AI, so I basically rewrote the whole thing but kept most of the organizational structure. IDK maybe 80% Liza, 20% bot?