Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

InstructureCon came to Louisville this year under the theme “Education in the Making” at an interesting moment: two and a half months after a high-profile cybersecurity incident, and one year after a conference full of flash but short on delivered product. The biggest question was whether Instructure would take the data breach head-on in front of its own customers, or manage around it.

In May I argued that Instructure was treating a platform crisis as an engineering problem: no named executive owned the response, the technical briefings were lawyered and script-read, academic continuity went unmentioned, and customers and partners were being communicated at rather than with. A users conference is where that argument gets tested in front of the people who lived through it.

Instructure passed by a wide margin. The incident was addressed directly in the opening keynote, given its own slot the next morning, and surrounded by security and privacy panels—one of them moderated by a customer CIO. Nobody appeared defensive. In a room where anger would have been the easy default, the company was appreciative of a community that had every reason to still be angry. If anything it overcorrected. There is a point at which continued contrition stops reassuring a room that has already decided to stay, and Instructure ran past it. This audience extended its grace back in May. What it needed by Thursday was a reason to be excited about next year.

It did not really get a compelling one, and there was a pattern. Product announcements kept getting deferred: Don’t worry, you’ll hear that tomorrow morning at the product keynote. Oh, you’ll hear more at the Solutions Spotlight. But then the Solutions Spotlight tried to cram Canvas, Mastery, and Parchment into 40 minutes with thin demos. I gave the company that feedback directly, and the response was a follow-up meeting yesterday to make the case that there is more product substance than I saw.

But at the conference, there were only a handful of announcements and live demos, and the biggest one was for a future product not even part of Canvas.

There is a four-pillar strategy underneath all of this, and on paper it holds together. But a strategy is a claim about what the product and services work adds up to, and that claim lands only when the work is visibly underway. Kudos on genuinely handling the breach; poor marks for generating momentum.

Below: the breach response, the continuity roadmap behind it, and the executive question it exposed; the IgniteAI update and the pricing deadline that moved; the product story and the strategy that sits above it; the partner and platform work; and Foundry, along with the governance question already trailing Project Athena.

The customer organization keynote framed the May incident and the response to it as a turning point rather than a technical failure, with transparency named as the operating principle. Instructure reports meeting with more than 365 institutions and roughly 500 conversations since the event, and it is clear that they were listening. The top ask on continuity planning was gradebook access. The second was communication—both from the company, and help for institutions and faculty to reach their own students.

Measure that against the specific things that were missing in May. At the time I wrote that no named executive owned the response, that the academic continuity issue—schools delaying finals, reworking assignments—went unmentioned, that higher ed’s trade press was being deflected to a static page, and that ecosystem partners had no briefing of their own. All of that has changed. CEO Steve Daly took a named role of responsibility and has kept it. Continuity is now the organizing frame rather than the omission. Partners got their own track. And the company met the room with appreciation rather than message control.

Chief Architect Zach Pendleton handled the technical half. The framing was that attacker economics have changed due to AI advances—exploit timelines have compressed to a fraction of what they were seven years ago, a version of the argument I made in June about why EdTech moved into the target zone.

Remediation for Instructure runs along three lines: reduced attack surface, stronger identity controls including a step-up authentication layer on top of existing SSO, and faster detection.

The academic continuity roadmap is the part institutions strongly asked for. Instructors get a dashboard reminder to back up their courses. Administrators get bulk gradebook exports, entering an early adopter program with no upgrade required, followed by course roster exports so an institution can reach its own students when Canvas is unavailable. Further out and explicitly uncommitted: read-only access during outages, offline grading, and a customer-controlled failover instance.

My read: the roster and gradebook downloads landed better than anything else that morning, which did not surprise me. They address the exact pain institutions felt in May and June, and they carry a message a typical technology company does not send: we are not going to protect and control information that is already yours. That is a real concession of leverage, and the room heard it as one. The caveat is at the far end of the list, where institutions that do not want to depend on Instructure during an outage need the independent failover instance—planned for the coming months on AWS, but described without much detail.

But good intentions, transparency, and a real desire to improve are not the same thing as making the organizational changes required to operate differently. There are signs of change here and signs of stasis.

Start with the changes, which are real and only partly trace to the breach. AI is reshaping how software gets built, and Instructure had already concluded that product and technology should not run as separate organizations. The company is creating a combined chief product and technology officer (CPTO) role and looking outside for the hire, on the reasoning that development cycles and product approaches now differ from anything the industry faced in the cloud era. The breach accelerated the timeline for these changes. CTO Michael Lysaght is departing, with Pendleton adding interim CTO duties until the CPTO arrives. Chief Product Officer Shiren Vijiasingam moves to lead Foundry, a new organization funded and set up by Instructure (more on that below), once that hire is in place. Instructure also changed two of its outside advisory firms over the advice it received during the incident (euphemism alert).

One detail helps explains the technology change. After Instructure’s September 2025 ShinyHunters breach through Salesforce—not a Canvas product issue—the company ran a security audit on its own products and built an 18-month remediation plan. After May, the CEO directed an all-hands effort that led to closure of the known issues in eight weeks. The gap between those two responses is not a resourcing story. It is a judgment story, and judgment is the job.

So the attitude has changed, but has the team beyond the CPTO-based reorganization? It is the executive team’s job to listen to its market and know its own audience. For the cybersecurity incident, what customers objected to was not so much the vulnerability as the response to it. What I criticized in May came down to Instructure not really hearing what customers wanted to see delivered.

My read: Instructure has changed course since June and has proven it is hearing its customers. What I cannot yet see is whether enough has changed to sustain the new attitude. The executive team is not turning over much, and the problem of misreading the audience needs is broad. I see more genuine change in attitude than I do in building an executive team that will still behave this way a year from now. Judge it the way I intend to: by whether the listening holds, and whether Instructure delivers what customers need going forward.

IgniteAI Agent shipped in March, and the conference additions were incremental. Bidirectional MCP support means an institution’s own agents can act on Canvas while the Ignite agent can act on partner tools, with Wooclap as the first working integration. File upload lets the agent turn a whiteboard photo or document into Canvas content, and a prompt builder adds wizard-style scaffolding for common workflows.

My read: our spring report (premium only) called the summer conversion of the agent from free to paid the thing to watch, on the reasoning that it would be the first real signal of whether agentic AI has a business model in higher ed. That conversion slipped a month and now resolves into the new tier structure, with Canvas Next as the tier enabling agentic usage this fall. Too early to judge uptake, and worth continuing to watch.

Instructure does have a strategy, embedded in the four pillars described above. A companion slide maps AI onto this strategy more broadly.

In briefings the company added a picture of the stack underneath: the core applications, a data access platform, an AI fabric of APIs and bidirectional MCP connections, and the intelligence engines on top of that.

I believe that the long-term thinking at Instructure thus far has been more strategic than its competitors, particularly around agentic AI and how it can and likely will change the user experience. Issues like not tying the AI agent to specific parts of the current UI workflow, and how this might enable future LMS deployment not even requiring the standard left column / top menus / dropdown options paradigm of the past two decades.

On paper this is a real strategy. Where Instructure has fallen short is in meeting current customer needs that give confidence in how the LMS will improve the educator and student experience. Real delivery issues. Weeks earlier at Fusion, D2L organized its conference around four pillars of its own, and the reason that worked is that more tangible advancements were already shipping and the pillars explained what they added up to. Instructure certainly has more product delivery offered this year than last, but the level of detail provided and the actual customer usage lags what I saw with D2L.

You can read that two ways. Instructure is not leading on delivery, even while making the bigger bet with the agentic approach, and I heard multiple customers ask for more concrete improvements to core workflows, even small ones. But there is now enough shipped to judge customer acceptance against, which was not true a year ago.

My read: strategy documents are cheap, and this one is better than most. The test of a vision at a users conference is whether customers can watch it run, and this year they were asked to take it on faith too often.

The least-covered thread of the week was the partner and platform work: a partner portal where vendors maintain product details and configure their API and LTI settings, Canvas Apps as the customer-side hub to discover and manage every integration, and usage and billing data so partners can see how their integrations actually get used.

Two things in it matter more than the plumbing. Partners will be asked to disclose their own product AI features in the portal, so institutions can see what AI is running inside the tools they install. And Instructure is deprecating LTI 1.1: its own integrations move to LTI 1.3 by the end of this year, with partners encouraged—though not required—to follow by the end of the academic year. That ask went out at the partner summit on the conference’s first day, under a framing of shared stewardship of the platform.

There is a second story running underneath the platform work, and it is a commercial one. Instructure is monetizing its partner ecosystem far more aggressively than it used to—a higher cost to exhibit than at competing conferences, paid access to APIs, and a new co-sell arrangement offered in more than one revenue-share flavor. Partners I spoke with are, on balance, happier with Instructure than they were a year ago, and a number of them are trying the co-sell program cautiously rather than enthusiastically. I am not going to detail terms here, but the direction is worth naming, and there are signs D2L is moving somewhat the same way. The economics of LMS partner ecosystems deserve their own treatment, and I plan to come back to them in a future post.

My read: The practical caveat is that an app store is easy to announce and slow to populate, and that an ecosystem-wide migration on a voluntary timeline is the kind of ask that slips. The larger caveat is the posture. Openness toward partners was central to how Canvas won in the 2010s, when a cheap and easy ecosystem was part of the argument against Blackboard. What is taking shape now looks less like that Instructure and more like the Blackboard of the 2000s, when the platform’s gravity was something partners paid for. Back to the future.

The biggest news at InstructureCon was structural rather than product. Instructure Foundry is a standalone organization with its own funding, chartered to build in markets adjacent to the core. Our spring report argued that the most likely near-term disruption in this market would come from a vendor changing how it operates rather than from any single AI feature, and Foundry is an attempt at doing exactly that.

The structure is the interesting part. Investors provided incremental funding so Foundry does not compete for the money core Canvas, Mastery, and Parchment need—an answer to the standard objection that innovation gets paid for out of the products customers already buy. Teams are small and AI-native, and go-to-market is decided case by case: an accreditation application would need a different buyer and possibly its own sales organization.

Foundry’s first project is Athena, an AI tutoring agent that connects to Canvas but does not live inside it. What Instructure argues that separates Athena from D2L’s Lumi Learner Mode and the rest of the category is persistence: rather than generating study material on demand within a course, it maintains a longitudinal model of what a student has actually mastered and adapts as that map fills in. Less a study tool, in the pitch, than a tutor who has known you for a year.

Hinds Community College in Mississippi is implementing this fall alongside a pre-and-post research study run with Instructure’s research team. The company is deliberate about calling Athena a project rather than a product: it enters beta now, with general availability targeted for early 2027 and fewer than fifty institutions testing this fall. It will be sold to institutions on behalf of their students as a separate line item rather than a Canvas tier.

My read: the governance question will be interesting to watch. Because of the learner-centric consumer concept involved, Athena appears to place student usage outside direct administrator control as things are currently defined. I do not believe all control needs to sit in faculty and admin hands, but Instructure will have to navigate the different end-customers of its products, and that navigation is part of the experiment.

This might be the sharpest tension of the conference: a company that spent two days rebuilding trust on institutional partnership introduced its marquee new offering on a path that somewhat routes around institutional control and is outside of the core product.

Worth noting on the other side: Instructure reports students themselves preferring institutional delivery, on the reasoning that they did not want to risk being accused of cheating with a tool their school had not sanctioned, and the company’s own read is that faculty skepticism rather than student uptake is the harder problem.

The new category of learner-centric study tools deserves more room than a conference post can give them, and I plan to come back to the learner-facing AI question across vendors.

I came to Louisville with a big question about handling the cybersecurity incident, and Instructure answered it. On transparency this is a materially better company than the one I wrote about in May, period. The breach was addressed head-on, continuity is being built, partners are being brought back in, and nobody was defensive.

The second question, the one about momentum, was not as clear. There is a coherent strategy on paper and a thin year of delivery beneath it, and the one genuinely new product came out of Foundry, a separate organization.

There will be a lot to watch with Instructure over the next six to twelve months, particularly around the impact of the CPTO-based reorganization, whether the exec team continues with the new attitude, and customer acceptance of the company’s emerging AI-enabled enhancements.

The main On EdTech newsletter is free to share in part or in whole. All we ask is attribution.

Thanks for being a subscriber.