Instructure took a meaningful step forward this weekend in its response to the Canvas cybersecurity incident. CEO Steve Daly issued a direct, named apology. The company added more substance to its Incident Update page. It disclosed the Free-For-Teacher root cause and named CrowdStrike as part of the response. Those are real improvements. But the response still has a deeper problem: Instructure is describing this as a platform security incident, while its customers are experiencing it as an academic continuity event. Canvas is not just another enterprise system. It is where students get assignments, submit work, access grades, prepare for finals, and communicate with instructors. When Canvas is unavailable, defaced, or tied to exposed messages and identifying information—especially during finals week—the impact is not merely “inconvenience and concern.” It hits the core academic operations of institutions. That distinction matters. Academic leaders from universities including Illinois, Chicago, and ASU have been announcing canceled or delayed finals. Higher ed trade press is still being deflected to static statements. Direct questions about ransom payment are going unanswered. The scale of the breach and end-of-term disruption has not been fully acknowledged by the company at the center of it. There is also a transparency issue. Instructure’s Incident Update page carries a noindex directive, meaning the company has published a public page while signaling search engines not to include it in search results. That may be technically defensible for a live operational page, but it is much harder to defend for the central public source during an active incident, when customers, students, parents, reporters, and institutional stakeholders are searching for authoritative information. The point is not that Instructure has done nothing right. It has. The point is that the form of the response is improving faster than the substance. Canvas built its market position in the 2010s on openness, customer alignment, and trust. That posture is not yet visible enough in Instructure’s response to this incident. One step forward. One step back. I wrote more in today’s On EdTech post: onedtech.philhillaa.com/p/on…