The recent Canvas ransomware incident has reignited debate over whether organizations should pay when attackers steal sensitive data and threaten to release it. But focusing on the ransom decision alone misses the bigger issue: why education organizations remain vulnerable to this kind of extortion in the first place.
The Canvas incident highlights a major containment gap facing the education sector. The issue isn’t just that attackers gain access; it’s that environments aren’t built to limit what happens next.
Once inside, attackers can move laterally to reach high-value data, turning an initial foothold into a full-scale extortion event. Schools, universities, and education technology providers are then left with few good options. Paying ransoms can incentivize future attacks, while refusing can put student privacy, institutional trust, and academic continuity at risk.
While breaches are inevitable, the scale of disruption doesn’t have to be. What separates a contained incident from a full-scale crisis is whether an organization can limit what happens after an attacker gains access. Most environments still aren’t built to do that.
By adopting a containment-first approach grounded in an “assume breach” mindset, zero trust, and segmentation, organizations can restrict lateral movement, reduce an attacker’s leverage, and prevent breaches from escalating into widespread data loss and operational disruption.
The pressure to restore systems
The Canvas incident showed how timing can turn a ransomware incident into an operational crisis. Occurring near the end of the academic year, it hit at a moment when academic workflows depend heavily on digital platforms for exams, assignments, and grading.
Universities were forced to postpone tests and adjust deadlines, underscoring how quickly an incident can escalate when systems are not designed to limit operational impact.
During high-stakes moments like these, attackers understand that operational downtime increases pressure to restore systems, giving them leverage to turn a disruption into a successful extortion event.
Ransomware recovery is as much an operational challenge as a financial one.
According to a recent report, ransomware attacks take an average of 132 hours and 17.5 people to contain and remediate.
That impact extends beyond financial costs. It pulls people away from their day-to-day responsibilities and forces organizations into crisis response. When an attack spreads across systems, recovery becomes exponentially more difficult.
With containment controls in place, attacks can be stopped early. Even when an initial compromise cannot be prevented, security teams can limit how far attackers move, restrict access to critical systems, and reduce overall disruption.
Assume a breach before a systemwide crisis unfolds
The first step to a successful containment strategy is adopting an assume-breach mindset. This acknowledges that breaches will happen and shifts the focus from prevention-only to detecting incidents and limiting their impact.
It drives organizations to implement proactive security measures, protocols, and tools designed under the assumption that attackers may already be inside the network.
In doing so, organizations are better positioned to protect their crown jewels—the assets whose compromise would have the greatest operational impact. These include Social Security numbers, financial records, and administrative services that keep classrooms functioning.
Risk visibility is foundational to assume breach. Organizations need clear insight into workloads, applications, users, devices, and environments. Observability provides that visibility by showing systems communicate in real-time. With this view, security teams can spot risks faster, understand normal behavior, and detect unusual activity. This clarity helps teams to create and enforce policies that block unauthorized access in real-time. It also limits lateral movement risk across the environment.
Zero trust: Always verify, never trust
A strong containment strategy must consider how education environments operate, which requires collaboration and continuous access. As hybrid learning and digital services become more central to daily operations, the attack surface expands.
Zero trust helps secure this environment by verifying every user, device, and connection before granting access. It provides visibility across hybrid systems and turns the assume breach mindset into daily practice: verification is continuous, and access is limited to only what users and systems need to perform their functions.
While implementing zero trust can feel daunting for resource-strapped education organizations, it doesn’t have to be. A phased approach—starting with identifying and securing critical assets—makes adoption more manageable.
From there, zero trust policies can be gradually extended across systems, allowing organizations of any size to strengthen security at a practical pace.
Segmentation turns strategy into containment
A critical component of zero trust, segmentation limits lateral movement by dividing environments into smaller, controlled zones – isolating threats before they spread.
This starts with enforcing clear boundaries around the systems that matter most. A compromised classroom device does not need access to payroll systems. A breached learning application should not reach student records.
A vendor connection does not require unrestricted access to internal infrastructure. Segmentation enforces these boundaries and reduces the blast radius.
It also improves response speed. When teams understand how systems connect and restrict unnecessary communication, they can isolate affected areas without shutting down the entire environment, helping preserve academic continuity while responding to an active incident.
