In April, an attacker reached the learning platform thousands of schools run their coursework on. Instructure detected unauthorised activity in Canvas in April, and a second intrusion followed in May. Sixteen months earlier, data was taken from PowerSchool through a support portal with no second factor, using a subcontractor’s stolen credentials. Neither was the school’s fault, since both came through as valid access.
Most advice schools are getting right now answers a different question.
What the speed story gets right, and where it stops
The big claim this year is that AI has made attacks too fast to respond to. It peaked at CrowdStrike’s Fal.Con in September, where George Kurtz retired ‘breakout time’, the gap between initial access and the first lateral move. His numbers had fallen for years: 62 minutes, then 48, then 29. Then he withdrew the metric on stage, saying “We were wrong. I was wrong. This was human speed with better tools, and breakout time is over.” In its place, he says, attacks now run at inference speed, leaving no time to respond at all.
Kurtz is right that attacks are accelerating, and I wouldn’t dispute that. AI cuts the time to do a single piece of work, like reading the code behind a login page or picking the useful account out of a list. What it does not cut is how long an intrusion lasts. That depends on things the attacker’s tools do not touch: how long until someone clicks, and how long the operator decides to wait. Dwell time is a decision, and no tool shortens a decision.
So quick work and a long campaign sit together perfectly well. The automated framework Dream Research Labs published in August ran twelve waves over four days, and it was not idle. And the fastest thing I have seen so far had no language model in it at all. Elastic Security Labs found a worm in the npm registry on August 4th that had backdoored more than 400 packages two days later.
That does not mean schools can be slow. Sophos tracked a crew this year that went from initial access to ransomware in under 17 hours, with operators phoning staff over Microsoft Teams to talk their way in. Seventeen hours is a response problem. Detecting and containing quickly is the right answer to it, but fast response only works on systems you already watch.
Enumeration used to cost something
What changed is how much gets tried at once. Dream’s agents started by decompiling the JavaScript a government site serves to every visitor, and mapped 21 connected systems. Nothing was broken into. The agents simply read what was publicly available, then ran up to eight sub-agents in parallel and returned public vulnerability sources whenever a technique stopped working. A human red team on a four-day job picks two or three promising paths and drops the rest. These agents kept testing all of them.
Most exposure management assumes an attacker takes the cheapest path and ignores the rest, so unlikely findings sit at the bottom of the backlog. That only holds if the attacker skips them too.
This hits education harder than most sectors, and not because school teams are worse at the job. One account usually opens email, the learning platform, student records, finance and dozens of outside applications, all through a single sign-on that many systems trust without rechecking. And much of the environment is published on purpose, from staff directories to the code behind a student login.
Authentication succeeds, repeatedly.
In the Dream case, the agents sprayed passwords built from employee ID numbers at a minor departmental portal, using usernames taken from APIs that needed no login, and beat the CAPTCHA with open-source character recognition. Eighty-five accounts fell. Eighty-four then signed in to the department’s internal system through a single sign-on bridge. Every one of those was a correct sign-in, logged properly, with no unauthorised access event to raise a ticket on. Turning access to a minor system into access to an important one is what single sign-on is for.
Canvas and PowerSchool are the same shape, with the first step moved outside the school. The credential falls at a supplier, and what reaches each institution is a real session its own controls were never going to question. There is nothing of yours to patch and no spray to catch. The Department of Education’s Federal Student Aid Office issued its Canvas security alert to institutions rather than to the vendor, which tells you where the exposure lands.
The sector numbers show how ordinary this is. In Verizon’s 2026 Data <a href="https://bitcomme.com/lemaitre-vascular-data-breach-investigation-edelson-lechtzin-llp-probes-class-action-claims-after-customer-data-is-exposed/" title="LeMaitre Vascular Data Breach Investigation: Edelson Lechtzin LLP Probes Class Action Claims After Customer Data Is Exposed”>Breach Investigations Report (DBIR), stolen credentials show up in 65 percent of the education breaches where someone actively broke in. A valid credential makes the sign-in itself look normal. What is left to judge is what the account does, which systems it touches, in what order, and whether it has ever done that before. Correlating that across the network, the identity layer and the cloud applications is what turns a run of ordinary sign-ins into one visible intrusion, and it is what makes a fast response possible at all.
What to do before reacting faster
Three things come before more speed.
- Map the trust before the endpoints. What does one stolen account reach? Which systems accept the same sign-in, which suppliers can start a session inside your environment, and which outside applications still hold tokens from a staff member who left two years ago. Most schools have never written that down, which makes the blast radius unknown rather than small.
- Treat multi-factor authentication as the floor, not the answer. It is necessary, and it is also what these attackers arrive holding: a real code from a real person. So verify access and reset requests on a channel the caller does not control. That is hardest at term start, when real requests peak. The University of Utah’s IT service logged 507 contacts on the first day of classes this August, mostly login and password problems.
- Rank findings by what they feed, not by how likely they look. An endpoint that returns staff names and sign-on identifiers without a login is a username list. What catches the spray that follows is its pattern across many accounts, not any single failed login.
Do those three first, and faster response becomes far more useful because you are watching the places attackers actually cross.
