Protecting student data through smarter vendor risk management. Thousands of Software as a Service tools create risks districts cannot manage equally. A rightsized program starts with visibility and focuses resources where exposure is greatest. Nathan Eddy works as an independent filmmaker and journalist based in Berlin, specializing in architecture, business technology and healthcare IT. He is a graduate of Northwestern University's Medill School of Journalism. Recent breaches involving Canvas and PowerSchool, resulting in the theft of millions of individuals' private information, have intensified attention on third-party technology risk in K-12 education environments. The incidents underscore that a district can protect its own environment and still be exposed through a vendor - a risk difficult to contain when the average district relies on thousands of ed tech tools, many delivered through Software as a Service (SaaS). While small IT teams cannot investigate every provider with the resources of an enterprise security organization, they can build a defensible program by establishing visibility, ranking risks and setting minimum requirements. What the Canvas breach reveals about K-12 vendor risk. Large education platforms concentrate risk because one compromise can affect many customers at once. Matt Leger, research lead for IDC Public Sector's worldwide education and education technology digital strategies, says districts increasingly depend on outside providers to keep daily operations and instruction running. "Schools have become very dependent on third parties to do what they need to do for teaching and learning to happen every day," he says. Moving systems to the cloud may strengthen an individual district's security, but it can also create shared dependencies outside the district's direct control. Vendor reviews should therefore consider not only data protection but also hosting arrangements, redundancy, recovery capabilities and the operational consequences if a widely used provider becomes unavailable. Building a SaaS inventory for your district. Building a SaaS inventory is a strong first step toward better understanding a district's vendor risk profile. Districts should begin with known systems, such as student information, learning management, finance, communications and identity platforms. They should then add classroom tools, browser applications, administrative software and services purchased outside of central IT. The inventory should record the owner, purpose, data handled, users, integrations, hosting environment, authentication method and renewal date for every tool. Mapping connections matters because a compromised application may provide a path into another system. "Without investing in a full cloud access security broker platform, I think the most common and effective way is through the use of unified threat management firewalls to identify which platforms are being accessed," says Chester Wisniewski, director and global field CISO at Sophos. How to tier ed tech vendors by risk level. Districts should not devote equal scrutiny to every application but rather evaluate what type of information is being shared with vendors and then use that to determine which ones to scrutinize most, based on impact. High-risk vendors include those handling regulated or highly sensitive information, supporting mission-critical operations or integrating broadly with other systems. This tier typically includes student information systems, learning management platforms, identity providers and any tool with single sign-on access or broad application programming interface connections. A compromise in any of these can propagate across multiple systems. Tools that collect health, financial or behavioral data on students also belong here, regardless of their operational role. Medium-risk tools may access limited student records or support important but replaceable functions. A tool moves from medium to high risk when its access scope expands, either through broader system integrations, additional data collection at renewal or connections to other platforms. Low-risk products should receive basic review if they use little or no identifiable information. Reference tools, general productivity applications and anonymous content platforms typically fall here, though districts should verify that assumption rather than take it on faith. "Districts should also determine what student data each tool genuinely needs and restrict access accordingly," says Mary Schlegelmilch, business development manager for education at Cisco. That principle applies at the tiering stage; if a tool is requesting more data than its function requires, that itself is a signal worth flagging. Vendors who exhibit high levels of transparency typically have a stronger security culture as well as more mature practices." Chester Wisniewski Director and Global Field CISO, Sophos Contract language that protects districts before a breach. Security expectations should appear in the request for proposals and remain enforceable in the final agreement. Addressing security requirements at the RFP stage gives districts leverage before a vendor is selected, making it harder for a preferred vendor to negotiate those provisions away after the fact. Once contracts are on the table, they should define authorized access, breach notification deadlines, service levels, backup and recovery obligations, data deletion, audit evidence and each party's incident response responsibilities. For example: * Breach notification windows should be explicit and should require the vendor to notify the district even when the full scope of an incident is not yet known. * Subprocessor disclosure clauses are worth including, as many SaaS vendors rely on their own third parties to deliver the service, and those relationships extend the district's exposure. Leger says that, within contracts, districts need to embed requests pertaining to resilient design, which can include zero-trust controls, stronger identity management, reauthentication between sensitive functions and plans for maintaining service during a vendor outage. Right-to-audit provisions support this, giving districts or their representatives the ability to request evidence of security controls rather than relying solely on vendor-provided assurances. Vendor monitoring without enterprise tools. Monitoring can begin with inexpensive, repeatable checks. "The easiest thing is to contact [the vendor] and discover which security and privacy certifications they have achieved and inquire as to which frameworks they use for managing risk," Wisniewski says. Districts can subscribe to vendor security notices, review public incident disclosures and require annual updates from high-risk providers. "Vendors who exhibit high levels of transparency typically have a stronger security culture as well as more mature practices," he adds. He advises districts to document those reviews so they can show how monitoring decisions were made. Shadow IT: finding unapproved apps that store student data. Firewalls, endpoint security and device management systems can reveal cloud and locally installed applications. Districts can compare those discoveries with the approved catalog and investigate exceptions. Leger cautions that technology alone will not expose every tool, particularly when employees and students use personal devices or cellular connections. Schools need a nonpunitive process for educators to disclose what they use. Training should explain why unreviewed tools create risk while recognizing that teachers usually adopt them to solve real instructional problems. An accessible review process gives staff a safer alternative to bypassing central IT. Building a vendor incident response plan for K-12. An incident plan should identify the district owner for each vendor, escalation contacts, legal and communications roles, procedures for revoking access and steps for continuing critical services. Risk tiers should drive how detailed those playbooks are. High-risk vendors warrant named contacts, documented revocation steps and tested runbooks, while medium-risk vendors can be covered more lightly. Exercises should test what happens when a provider is unavailable or a compromise spreads through an integration. Two scenarios worth running explicitly: * A critical vendor going down during a high-stakes window, such as state testing or enrollment * A breach propagating from one integrated tool into another Even a short tabletop discussion with IT, administration and legal stakeholders can surface gaps that a written plan misses. K-12 districts also face a communication obligation that enterprise organizations do not. When a vendor breach involves student data, parent and community notification may be required - and the plan should designate who owns that process, what triggers it and how messaging will be coordinated with legal counsel. The inventory and risk tiers determine which vendors require the most detailed playbooks. Plans should be reviewed whenever services, data flows or contract terms change. "Knowing what your service-level agreement is with those vendors, whom to contact and what steps you can take, from both a continuity and containment perspective, is a bare minimum," Wisniewski says.

InstructureCon 2026: an empire trying to stay rebel. Justin Ménard July 29, 2026 Key Takeaways: * Transparent Breach Response: Instructure leadership publicly addressed their May 2026 security incident, owning early communication failures and detailing how an XSS vulnerability in the now-discontinued Free for Teacher tier led to exposed API keys. * Dual-Track Innovation via Instructure Foundry: To keep core Canvas, Mastery, and Parchment systems stable while accelerating AI development, Instructure launched Foundry, a standalone unit building tools like Project Athena. * Shift Toward Agentic AI and Practical Utility: The platform is expanding beyond simple chatbots to task-executing agents via Model Context Protocol (MCP), while offering practical solutions like CSV gradebook backups for system outages. I just got back from Louisville for InstructureCon 2026, and the atmosphere was a mix of celebratory community and high-stakes damage control. It is a different vibe when you are the undisputed market leader with a target on your back. For years, Instructure grew by being the "rebel alliance" fighting the "evil empire," but now they are the empire, and they are trying to figure out how to stay agile while managing a massive, global user base. Here is my deep dive into where they are heading and what it means for the Learning Management System market. Owning the "fumble": how Instructure's leadership addressed the May breach. You cannot talk about Instructure right now without talking about the May 2026 security incident. To their credit, they did not sweep it under the rug. CEO Steve Daly and the leadership team were surprisingly transparent, admitting they "fumbled" on early communications. The technical breakdown was a cross-site scripting (XSS) vulnerability. An attacker inserted bad code into a support ticket through a Free for Teacher account (now discontinued). When a support agent clicked the ticket, the code executed in their browser, allowing the attacker to snag an API key and begin "sucking down data." While leadership led with humility on stage to win back trust, some customers and partners are still rightfully frustrated about the initial silence. The AI training gap: data vs. Reality. Instructure released new research that should be a wake-up call for every CIO. Their survey of 1,125 stakeholders found that 90% of higher education students are already using AI at least occasionally. However, the "support gap" is massive: 45% of K-12 teachers and 41% of HigherEd professors report receiving no formal AI training. Most respondents are optimistic about the technology, but they have a hard boundary: they want AI for concept explanations and brainstorming, but 88% to 94% are skeptical of using it for high-stakes grading or academic decisions. Instructure Foundry: disruption from within. The biggest strategic announcement was Instructure Foundry. This is a standalone organization designed to "disrupt from within". Why do this? Because when you are as big as Canvas, you cannot move at the speed of AI without breaking the reliability millions of people depend on. Foundry gets its own incremental funding and AI-native teams to chase "moonshots" and adjacent markets without slowing down the core roadmap for Canvas, Mastery, and Parchment. It is a parallel track of scale versus exploration. The first Foundry project is Project Athena, an AI study coach. Unlike a generic chatbot, Athena is grounded in the student's actual Canvas course context, including assignments, deadlines, and learning objectives. It focuses on skill mastery (generating personalized quizzes and study guides) rather than just giving away the answers. Agentic AI: the next feature war. ListEdTech Inc. has moved past the "Chatbot" era. Instructure is doubling down on "Agentic AI," which includes systems that do not just talk but actually execute tasks across platforms. * The Power of MCP: They are using the Model Context Protocol (MCP) to allow their agents to talk to third-party tools like Microsoft or WooClap. This is their play for "openness," the idea that you should not need ten different bots for ten different systems. * Bulk Automation: The "Ignite Agent" (now for admins and teachers) can perform massive tasks, like restructuring modules across 50 courses at once or identifying every student who scored under 70% on a quiz to send them automated review materials. The "brilliant" Simple fix. Sometimes the best tech isn't AI, it's a CSV file. To address the number one concern after the breach, which was what happens if the system is down, Instructure built a simple continuity tool. It allows teachers to dump gradebooks to a CSV file so learning does not stop if the lights go out. It is a "set it and forget it" solution that addresses the anxiety of the moment with basic, functional utility. The ListEdTech bottom line. Instructure is in a tough spot. They have increased R&D spending by 25% over two years to harden their systems and fund this new innovation track. While competitors like D2L and Blackboard are positioning themselves around "outcomes" and "learner experience," Instructure is trying to execute on scale and connectivity. With major wins like the North Carolina Community College system, which is the first state to have all higher ed and K-12 on one platform, they are proving the power of their network. But with pricing sensitivity rising and a new "Foundry" organization meant to act like a startup, they are essentially trying to be two companies at once. They aren't the underdog anymore, but they are clearly trying to prove they can still innovate like one. Disclosure: Instructure covered travel expenses for the author to attend InstructureCon 2026. This post reflects the independent perspective of ListEdTech. Instructure had no editorial input, and this content was not shared with or reviewed by them prior to publication.

Announcing Canvas integration for Jotform enterprise: smarter education workflows. Table of Contents Summarize with: Jotform connects with hundreds of the world's most popular platforms, helping organizations automate workflows without switching between systems. Now, educators can add Canvas to that list. Canvas by Instructure is the most widely used learning management system in North American higher education, supporting millions of students and educators. Now, Jotform connects directly with Canvas to automate the administrative work that happens before learning begins. The integration solves an important challenge that many institutions still face. Every semester, schools process hundreds or even thousands of registrations before classes start. New learners submit applications. Employees register for training. Continuing education participants sign up for courses. Too often, teachers and administrators have to manually create Canvas accounts, enroll learners, and move information between systems. Now, Jotform automates that work. This helps schools scale their programs while giving educators more time to focus on what matters most: teaching and learning. Did you know? Canvas by Instructure is the market leader in North American higher ed, commanding a 50 percent market share by student enrollment. It also supports more than 11 million students and educators across U.S. K-12 schools. Available integration actions. The integration automates two of the most common administrative tasks educators perform before instruction begins. * Create new students: Automatically generate new student accounts in Canvas instantly upon form submission. Instead of submitting an IT ticket, waiting for approval, and manually creating student accounts, the integration securely creates a new Canvas user the moment someone submits a public-facing online form. External learners get immediate access, while staff spend less time on administrative work. * Enroll users to a course: Automatically enroll existing Canvas users into specific courses based on their form selections. Existing Canvas users, including students, faculty, and staff, can enroll in specific courses via online form. Once they submit the form, the integration automatically places them in the right Canvas course, eliminating manual roster updates and giving everyone faster access to the training or coursework they need. Use cases and benefits. From student onboarding to professional development, Jotform's Canvas integration helps automate many of the administrative tasks that happen before learning begins. Here are a few common ways schools and universities can use the integration to streamline workflows and improve the experience for learners and staff. How do I set up Jotform's Canvas integration? To integrate Jotform and Canvas, access the Settings in the Form Builder, select Integrations from the menu on the left, and search for Canvas by Instructure. Choose what action the integration will perform: Create Student or Course Enrollment. Click the Next button to continue the setup process. The following screen will ask for the specific Canvas account information: Your school's Canvas LMS domain, your Canvas LMS client ID, and your Canvas LMS client secret. Enter your Canvas LMS domain before gathering the remaining information from your Canvas account. To access the Canvas LMS client secret and Canvas LMS client ID, login to your Canvas instance as an administrator and go to the Admin menu. Select your account, click Developer Key, and then select API Key from the dropdown. Next, fill out the Key Settings. Give your integration a name that's easy to remember. In the Redirect URIs section, enter https://secure.jotform.com/integration/oauth/callback. Enter the email account associated with your Canvas account into the Owner Email field. While filling out your settings for the new Developer Key, you can choose to limit the Scopes related to that key. When your Scopes are set, click Save. The following screen will state that the developer key has been created and reveal your Canvas LMS client secret. You can copy the client secret and paste it into the Jotform Canvas integration setup page right away or generate a new one when you retrieve the Canvas LMS client ID in the next step. Once you close the popup that says Developer Key Created, you'll be directed back to the Developer Keys page. The Canvas LMS client ID, which is the final piece of information needed to set up the integration, is the number listed in the Details column. If you still need to copy and paste the Canvas LMS client secret, click the Regenerate Secret button before returning to the Jotform integration setup page. The button is below the Canvas LMS client ID in the Details column. Before moving on, slide the State button to the on position. Paste both credentials into your Jotform integration settings underneath your Canvas LMS domain, and click Authenticate to complete the connection. After the integration is authorized via a popup screen from Canvas, you can match fields in the Jotform Form Builder. Click Save to enable the integration. To add another action to your form, click the Add New Action button on the following screen. To edit your integration, click the pencil icon. Further actions are accessible via the more options menu (the icon with three vertical dots). From registration to learning. For many institutions, Canvas is the center of teaching and learning. Jotform extends that experience by connecting the forms people fill out before they ever log in, whether it's a program application, event signup, registration form, or employee training request. Together, Jotform and Canvas remove friction from the path to learning. Instead of spending time moving information between systems, educators can spend more time supporting students, and learners can start engaging with coursework sooner. Learn to live & work smarter, not harder! Get its top articles delivered straight to your inbox each week. Luke is a multidisciplinary writer whose expertise encompasses B2B, SaaS and sports. He co-authored Jotform for Beginners Volumes 1 and 2 and covers product tutorials, customer stories, third-party connectivity and more for the Jotform blog. A former associate editor at NorthBay biz magazine, Luke moonlights as a sports writer. His work has been published by USA Today, Yahoo Sports, and others, and he's covered live sporting events for the Argus-Courier in Sonoma County, Calif. You can reach Luke through his contact form.