CYBERSECURITYAfter the Canvas Breach, Security Takes Center Stage for SaaS Providers

When a software-as-a-service (SaaS) platform fails, it doesn’t just fail one customer; it fails whole sectors. That’s the security problem hiding inside organizations becoming more and more dependent on SaaS providers. Customers need to focus on resilience, availability and security. They should ask ‘Will it work when we need it, can we trust it with our data, and what happens when it fails?’ As AI makes it cheaper to write software, these become the real differentiator, not instead of being impressed by smooth functionality and slick interfaces.

We’ve just seen a very real example of risks in sectoral dependency on SaaS platforms. A breach in the Canvas learning management system in the first week of May 2026 exposed student records and took systems offline, affecting 275 million users at more than 8,800 institutions. Affected organizations in Australia included the Queensland Department of Education and top-tier universities such as the Australian National University, the University of Melbourne and the University of Technology Sydney. Learning and assessments were disrupted for several days until Canvas’s parent company, Instructure, said it had reached an agreement with the attackers to have the data destroyed. This has been widely assumed to mean that the company paid a ransom.

The incident brings home the question of how we have become so dependent on SaaS, and what expectations we should have of providers of such services. The journey to today’s concentrated, heavily outsourced service provider landscape has been a long one. Two decades ago, organizations were busy outsourcing back-office functions, based on the theory that a specialist could do it better and cheaper than an in-house team. Technology outsourcing came next, first to infrastructure as a service, in which cloud providers bought the hardware and rented it out. Over time, more of the stack was owned and managed by third parties, leading to platforms as a service and ultimately to SaaS. Under SaaS, the supplier provides the physical data center, the hardware, the operating system and the software application, and rents out the whole package for users to remotely access and use. The proposition has been that specialists could deliver at scale in a way that in-house teams could not match, freeing customers to focus on their core business.