Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

Eleven days ago, I argued that Instructure was treating a vendor-level security crisis primarily as a status-page incident, and that the absence of any named executive owning the response — no equivalent of Josh Coates's 2012 "we are embarrassed, we are sorry, we will do better" — was eroding trust faster than the breach itself. Yesterday's customer-focused "Technical Deep Dive on Recent Security Incident" webinar was the company's most substantive public-facing communication to date. It also confirmed, in nearly every choice of format and phrasing, that the playbook has not changed.

The technical content was genuine, but the framing was lawyered and carefully read by script. And the people on screen — Chief Architect Zach Pendleton, CISO Steve Proud, and CrowdStrike incident response head James Perry — were, conspicuously, still focused only on the technical platform.

What Was on Screen

The webinar ran roughly twenty-five minutes, with a same-day rerun and a next-morning replay for customers who could not attend live. The short, tightly-produced format was itself the message: this is being handled as an engineering problem.

To Instructure's credit, the company was explicit up front about the scope it had chosen.

That is not bait-and-switch, as the description and target audience design was accurate. My disagreement is with the underlying scope choice and the message control.

Pendleton named one of the most important constraints at the top of the session, namely that due to a lot of attendees they would not be able to take live Q&A. But they promised to address some of the questions that had already been submitted prior to the webinar.

What followed was Pendleton asking a set of pre-selected questions, with Proud answering from prepared material. Other questions went into the webinar's Q&A function for later triage on the incident update page.

What Was Substantively New

Credit where it's due: the technical narrative was more detailed than anything Instructure has put in writing so far.

Both recent hacking events originated from the Free-for-Teacher tier, and both relied on stored cross-site scripting payloads (a linked file with hidden code) submitted via support tickets. The April 22 payload sat dormant until April 25, when a customer service representative opened the ticket; the code then executed in the rep's authenticated session and the threat actor used those elevated privileges to obtain data via Canvas's APIs between April 28 and April 30. Instructure detected the activity on April 29 and revoked access by April 30. The May 7 event was a second cross-site scripting vulnerability — this one in the Canvas discussion feature — exploited via a different code path and used to push a CSS file through the custom themes feature, deploying the ransom note to roughly 300 accounts before Canvas was placed in maintenance mode that afternoon.

The remediation was organized into three tiers — access and authentication hardening (additional multi-factor authentication checkpoints, disabling OAuth token generation via JavaScript, an Okta reauthentication framework for customer-account access), platform and web security controls (the cross-site scripting fixes and consolidated sanitization), and threat detection (CrowdStrike Falcon across the Canvas platform, behavioral alerting tied to the specific tactics observed). Free-for-Teacher is being reinstated in what Proud called a "secure limited capacity" with all administrative and support functionality stripped out.

That is real and useful information, and IT teams will be able to do something with it. The webinar earned the "technical deep dive" half of its billing.

The "crisis response" half is where the gaps are.

The May 6 Problem

The most consequential admission in the webinar was understated. Proud described that the second exploit “allowed the threat actor to sidestep our earlier fix.”

Instructure publicly told customers on May 6 that Canvas was fully operational and there was no ongoing unauthorized activity, a message that I flagged in my earlier post as not holding up to reality. By the next day, the related-but-distinct cross site scripting path — one that survived the May 1–5 remediation work conducted with CrowdStrike already engaged — was exploited successfully enough to deploy the ShinyHunters ransom note across roughly 300 accounts.

The technical question this raises is not whether Instructure fixed the specific vulnerability they found first. The question is whether they did proper variant analysis on that vulnerability — looking for sibling bugs, related token-generation flows, the same class of issue in other surfaces — or whether they shipped a narrow patch and called it done. The May 7 outcome suggests the latter. The webinar did not address it as a process failure. It treated the second vulnerability as a separate event with its own timeline rather than as evidence that the first remediation was incomplete.

The Pattern Problem

The webinar discussed two attack events — April 22/25 and May 7. It did not discuss the third.

ShinyHunters publicly took credit for a September 2025 social-engineering breach of Instructure's Salesforce instance, well before either of this spring's Canvas exploits. Outside reporting has tied that earlier incident to the same threat actor now claiming the Canvas breach. The webinar did not name ShinyHunters, did not reference the September 2025 incident, and did not characterize what is now at least three publicly known compromise attempts as a pattern of repeated targeting.

There may be sound legal reasons to avoid naming a threat actor under active forensic and law-enforcement engagement. There is no equally sound reason to omit the recurrence framing entirely. A customer hearing this webinar with no outside context would conclude they were learning about two inter-related bounded incidents. A customer who has read the trade press would conclude that the company is presenting an incident timeline while declining to acknowledge the broader recurrence problem. Those are very different positions for a vendor to be putting its customers in.

The LTI Question

The webinar's clearest treatment of the Canvas partner ecosystem came as a side note in Proud's brief comment about expanding the company's web application firewall (WAF) coverage.

That is a meaningful admission. The integration layer — LTI tools, embedded apps, the customizations institutions and partners build on top of Canvas — is constraining how aggressively Instructure can lock down the application surface, and those tradeoffs are still being negotiated. LTI was not the attack vector. But it is in scope for the remediation work in a way the webinar otherwise did not engage.

What the webinar did not address: whether LTI-based integrations could have been exploited to access integrated applications; whether the proactive cycling of "many partner tokens" was precautionary or evidence-driven; whether integrated apps got any guidance beyond the generic log-review recommendations. Perry's "no lateral movement" finding from CrowdStrike narrows the blast radius within Instructure's product portfolio. It does not clear the partner ecosystem, and the webinar made no attempt to.

That ongoing gap in communication — not just from the webinar — has led to third-party integration vendors absorbing the customer-education work in Instructure's place. The security models for LTI 1.1 and LTI 1.3 are fundamentally different: 1.1 uses shared consumer keys and secrets between the LMS and the tool; 1.3 uses OAuth 2.0 with asymmetric public/private key cryptography. LTI 1.3 integrations generally do not require token rotation in response to an LMS-side incident the way 1.1 integrations do. Those are distinctions Instructure was in the best position to communicate. Many customers received generalized security language and credential-rotation guidance that did not draw the line, which then generated token rotation requests against tool vendors for whom rotation was not technically meaningful. Tool providers ended up producing the practical 1EdTech standards education the original communications should have included — migration guidance from 1.1 to 1.3, customer reassurance, and weeks of explanation about why a Canvas breach did not require their 1.3 customers to do anything.

The Continuity Question

The most striking omission was not technical at all. Across twenty-five minutes of webinar, Instructure said nothing about academic continuity. Nothing about students who could not access assignments. Nothing about finals that were pushed back.

This is the breach's actual customer-facing impact, and the webinar treated it as out of scope.

Some of that silence has a legal explanation. Acknowledging operational harm in detail before potential lawsuits creates discoverable admissions. But the harm is already documented in public — by the institutions themselves, in their own crisis communications, in trade and general press coverage. I do not believe that declining to acknowledge what is already on the public record meaningfully reduces litigation exposure. It does meaningfully reduce trust. That asymmetry should drive the comms strategy, and it visibly is not.

The "No Evidence" Pattern

The most-repeated scripted phrase across the webinar was "no evidence" — and it was almost always positioned defensively. No evidence of employee credentials before cycling, lateral movement out of Canvas, data exfiltration from the May 7th breach.

In each case the statement was most likely true and is genuinely useful for customer log analysis. But "no evidence of X" is not the same as "X did not happen," and the cumulative effect of stacking those phrases through a twenty-five-minute session is to leave customers with a sense of reassurance the underlying facts do not quite support. That is also lawyer-vetted construction. It is what you say when discovery is still alive and class actions are foreseeable.

The Org Question

The Chief Architect fronted both customer-facing webinars. Within that role, the briefing fit — the agenda was the architecture and the controls, and the briefing delivered competently against both. But putting the Chief Architect at the center of two consecutive crisis communications, rather than adding a non-technical member of the executive team, is itself an organizational signal.

The CISO scope is the harder case. The security section was substantive within the traditional CISO mandate — attack path, containment, hardening, monitoring, no-lateral-movement, token controls — but the traditional CISO scope is itself part of the issue. A modern CISO at a platform company whose customers are public institutions in the middle of finals does not get to treat customer operational impact and ecosystem trust as someone else's department. If the role as defined inside Instructure stops at the Canvas platform perimeter, that role definition is a problem the company will need to address regardless of how this specific incident closes out.

And the broader scope-of-response gap is bigger than any single role. A Canvas-scale breach is not a security event with academic, operational, and partner external consequences attached. It is a platform crisis composed of academic, operational, partner, and security dimensions. Treating the security dimension as the public face of the response leaves the other three effectively unaddressed. To my knowledge there is no parallel webinar for academic-continuity contacts. There is no parallel briefing for LTI partners. There is no acceptance that the company missed its own May 6 resolution claim, that the response is following a pattern of repeated ShinyHunters targeting, or that institutions carried the public explanation through the worst week.

There is concrete evidence of how this gap is playing out. Institutions did not turn Canvas access back on when Instructure said it was ready on May 6. Many waited days; some waited longer. Some required their own internal validation before allowing students back in. Others appear to have been operating on the assumption that the vendor's all-clear was incomplete — or that they simply did not have the information they would have needed to validate it on their own.

Ecosystem partners describe the same gap from their side: they did not get the information they needed from Instructure either, and several have told me as much. When customers and partners are independently signaling that the company's response did not include them, the response architecture is not working. Customers and partners are not adversaries in a security incident; they are participants in it, and they need to be treated as such. The choice to communicate at them rather than with them is the most concrete signal yet that the company needs to include both groups in how it handles security issues going forward.

The Bottom Line

The webinar was useful for what it was: a substantive technical briefing for IT teams, delivered with appropriate forensic backing, on what happened and what was done about it. And a clear improvement over earlier communications.

It is insufficient as a crisis response.

What the comms posture across this week suggests is a company optimizing for litigation exposure — narrow claims, careful "no evidence" phrasing, script reading, no acknowledgment of recurrence or ecosystem risk or academic continuity — when the more consequential threat is to institutional trust. For a vendor whose moat is built on being the academic operating layer that institutions can rely on, that is the wrong optimization. The litigation will be defended either way. The trust, once lost, is much harder to argue back.

The main On EdTech newsletter is free to share in part or in whole. All we ask is attribution.

Thanks for being a subscriber.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

I will be at the Open edX conference this week and would love to meet any readers who are attending.

But what did I read this week, and was it interesting?

The reactive university

We hear a lot about higher education institutions shutting down and facing budget challenges, and I suspect we will be hearing a lot more. But two cases this week caught my eye and got me thinking about some of the broader patterns emerging across higher education.

Nottingham

At the University of Nottingham in the UK, thousands of staff were told this week that they were at risk of redundancy. The university reported an £85 million budget deficit last year and warned that it could run out of money by 2031.

These cuts come on top of cuts made last year when Nottingham also faced a budget deficit.

The university attributed those cuts to a “real decline in students wanting to study on those courses over the last five to ten years.”

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

Some of the most interesting conversations I have don't fit neatly into a newsletter post. They're longer, more exploratory, and more candid—and they lose something important when compressed into written form. So I've launched a new addition to OET+: The On EdTech+ Podcast, a private audio series for premium subscribers.

There are already two episodes live. You can listen directly on the website—each has a built-in player and auto-generated transcript—or add the private feed to your podcast app (instructions below).

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

Update, May 11, evening: After this piece was published, Instructure made two material changes. The noindex tag on the Incident Update page has been changed to index, follow—someone went into the page and explicitly told search engines to crawl and follow it. Instructure has also published an update confirming that the company “reached an agreement with” ShinyHunters. Most likely meaning paying the ransom. Both moves address concerns raised below. The analysis below documents Instructure's posture as it stood through Monday afternoon.

******************************

On Saturday, Instructure made a meaningful statement addressing the cybersecurity incident communications failure that I described on Friday. CEO Steve Daly made a direct, simple apology in a named statement on its Incident Update page, and the company updated the FAQ section of that page with better, more direct answers.

But the improvement is still mostly in form, not substance.

The core of the communications issue is that Instructure is using vendor-operations language about an academic-continuity event. Academic leaders from U Illinois, U Chicago, ASU, and many others are announcing canceled or delayed finals—this is and continues to be a big deal. This is not a complaint about tone for tone’s sake; it is about whether the company is describing the same incident its customers are experiencing.

The 2010s Canvas pitch was that Canvas understood the academic mission. The LMS as enterprise infrastructure was in service of that mission, not the point. The 2026 Canvas voice has shifted register.

Focus on Controlling the Message

Three days after the May 7 ShinyHunters hack and the avalanche of complaints from Instructure customers, the company is still relying on carefully worded static updates rather than answering direct questions from higher ed’s trade press. That matters because the unresolved questions are not media-process questions; they are customer-risk questions.

The Associated Press asked about ransom payment and got no answer. Inside Higher Ed noted a more important lack of response.

Customers still have questions and need more than controlled static updates.

Language Tells a Story

I want to build on a key point that I made Friday.

Instructure’s statement to IHE positions this as an inconvenient platform security incident that caused stress.

“Inconvenience and concern” is not the framing that we’re seeing from educators, as noted in today’s Higher Ed Dive article [emphasis added].

Academic continuity is whether an institution can meet its core obligations, and this is the core impact around which any response should be centered.

Instructure's institutional voice is unfortunately the voice of a platform vendor managing an incident, not the voice of an education company recognizing that the incident hit its customers in the middle of finals.

Scale Matters

Beyond the academic continuity acknowledgement, there is a related issue around the academic scale of impact. Nowhere have I seen Instructure acknowledge the numbers of education institutions or the massive end-of-term impact.

There were reportedly more than 8,800 education institutions and ministries impacted with hundreds of millions of student records, including private communications between students and faculty. The 2024 PowerSchool hack impacted fewer institutions, but there was more sensitive information involved for tens of millions of users—social security numbers, addresses, medical records. By institutional reach and academic disruption, the 2026 Instructure cyber attack appears to be one of the two most significant education data breaches to date, alongside PowerSchool.

The timing, of course, makes the situation worse as it comes right before or during final exams for so many colleges and universities. We’re not just talking about a day or two loss of system during the middle of a term; we’re talking about universities having to extend their terms to allow for rescheduled final exams, canceled final exams in some cases, and other impacts that affect the institution’s operations and reputation and risk profile.

Instructure should not wallow in this scale, but it should acknowledge how significant this security incident is for so many of its customers. And as we’re seeing, part of the issue is the concentrated risk of so much of education in so few academic platforms.

Transparency Matters

The other issue that needs to be addressed is the channel of communications. The incident_update page carries a noindex directive, meaning Instructure has published the page publicly while signaling search engines not to include it in search results. I found no comparable evidence that this is a general practice across Instructure’s corporate site; the site’s robots.txt blocks various administrative, search, and file paths, but that is different from applying noindex to a public incident-communications page. Instructure in the past (including the September 2025 ShinyHunters incident through Salesforce) acknowledged and described any incidents in public, searchable blog posts.

Instructure did hit the right tone in CEO Daly’s statement.

The best-faith reading is that Instructure used noindex rather than robots.txt because it wanted the incident page to remain publicly accessible and crawlable while discouraging Google from treating it as a normal, durable search result. That is technically coherent: blocking the page in robots.txt could prevent search engines from seeing the noindex directive, while a page-level tag allows the company to publish a live operational update hub without inviting it to become permanent search collateral. But that same choice also has a longer-term effect: it suppresses ordinary search discoverability not just after the incident is resolved, when the company may reasonably want stale interim language to fade, but also during the incident, when customers, students, parents, reporters, and institutional stakeholders may be searching for the authoritative source. The question, then, is not whether noindex is technically defensible. It is whether a central public incident page should be configured in a way that limits search visibility at precisely the moment when discoverability is part of the trust obligation.

Likely due to all of the media coverage today with links to that page, the Incident Update page is now showing up as one of the top results for basic searches like “Instructure security incident”, whereas it was absent from searches yesterday. But if Instructure keeps that noindex page tag, the search discoverability may go away soon.

Protecting Data

Sometimes what isn't stated matters as much as what is.

This hack was an extortion attempt. ShinyHunters set a May 12 deadline: pay or the data goes public on the dark web. According to AP reporting through PBS NewsHour, citing Emsisoft threat analyst Luke Connolly, Instructure and Canvas were removed from ShinyHunters’ dedicated leak site by Friday. That removal is not, by itself, confirmation of payment; researchers describe it as consistent with negotiation underway or a settlement reached. AP asked Instructure directly whether the company paid and received no answer.

That silence is its own data point—not proof that a ransom was paid, but evidence that customers are not being given a clear account of the most consequential part of the incident response. If Instructure paid, the company may have made a defensible emergency judgment that payment could reduce the immediate risk of public data release. But that is not the same thing as protecting the data. The attackers already had it, and payment offers no reliable guarantee that copies were deleted, contained, or will not be monetized later. It also runs against the standard advice from law enforcement and cybersecurity agencies, which warn that paying ransoms encourages future attacks and provides no assurance that data will be recovered or contained.

The point is not to second-guess an impossible call from the outside. The point is that affected institutions deserve more than silence about how the resolution is being managed. The form is improving. The substance is still being managed rather than shared.

Next Steps

Trust is earned through actions, in CEO Daly's own framing. The action of signing the apology was real, and worth crediting. So was the disclosure about the Free-For-Teacher root cause and the engagement of CrowdStrike.

But the actions still missing are also real. The scale of the breach has not been publicly acknowledged. The academic continuity framing is being articulated by everyone except the company at the center of it. Higher ed's trade press is being deflected to a static page. Direct questions about the most material aspect of the resolution are going unanswered. The page hosting the company's "consistent communication" commitment is configured not to be findable through search — a configuration Instructure has not changed, even as media backlinks appear to have temporarily made the page visible in search results.

Canvas built its market position in the 2010s on a posture of openness, customer alignment, and trust. That posture is not yet visible in Instructure’s response to this incident. One step forward. One step back. The next step is theirs.

The main On EdTech newsletter is free to share in part or in whole. All we ask is attribution.

Thanks for being a subscriber.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

This was a tough week for some in higher education as they struggled with LMS outages. Given that, I was tempted to construct a post only of good news and funny stories. But then I read a series of reports that in different ways touched on the issue of cost in higher education, and I couldn’t help myself.

The three reports I’m writing about this week all concern cost in one way or another, but they point to a similar tension. People often experience higher education as opaque and difficult to navigate. Part of that is because institutions do not always communicate clearly, but it is also because higher education itself is highly complex and increasingly dependent on hidden infrastructure, invisible labor, and complicated cross-subsidies to make the system function. At the same time, students, families, and the public increasingly want certainty and predictability while often being reluctant to spend significant time navigating the system or seeking information outside familiar and convenient sources. That leaves higher education with a real challenge, and one the sector will have to work much harder to solve.

Good investment, bad vibes

Trust, broadly considered as a belief in the value of higher ed and that higher ed actors behave in a way that is fair, is one of the key issues facing higher education, here in the US and abroad. Many signs point to trust in higher education slipping and, if not addressed, the issue could potentially imperil the sector, and have a long term negative impact.

A new report from Strada looks at the issue of trust through the lens of the cost of higher education and especially transparency around those costs. Their findings provide some significant insights into the issue and should be a wake up call, especially for some specific parts of higher education.

What jumped out immediately was the disjuncture between students’ belief in the importance of higher education, and its value as an investment but their simultaneous belief that higher education institutions prioritize making money rather than educating students.

On the question of the importance of higher education, current college students (which in the US means all tertiary students, for our readers in other countries) say that higher education is either extremely important or very important at a rate higher than any other group.

On the question of whether college is an investment, the numbers of college students who think it is a great investment are lower, than, say high school students, but overall a large plurality of college students think it is either a great or a good investment, a higher rate than any other group bar high school students and the two groups are pretty close.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

There is still a lot we do not know about the Canvas cyber incident, and this is not the time for overconfident technical diagnosis. The situation is still active, the forensic details matter, and cybersecurity incidents are not the same as cloud outages. Legal, forensic, and law-enforcement constraints are real.

Late on Friday, May 8, Instructure published a substantive public Security Incident Update & FAQ on its main website. That is, in significant part, what should have happened days earlier. It is the right format, and it contains real information. But it does not retire the broader trust question this week has raised. Particularly in the 2010s, Instructure earned a reputation for being unusually direct with customers, including when things went wrong. That reputation was tested this week, and the test is not over.

The 2012 Contrast

Back in 2012, Canvas suffered what Instructure itself called "A Bad Day for Canvas." In a public post, then-CEO Josh Coates explained that roughly one-third of Canvas customers experienced serious performance problems during a major outage, described what had happened, and ended with the kind of plain-language apology that customers remember: "We are embarrassed. We are sorry. We will do better." That was not corporate perfection. It was public ownership, signed by a named executive. It became part of the Canvas story.

This week's incident is far more serious and far more complicated. A cybersecurity incident involving confirmed data exposure, redirect-based extortion claims, and law-enforcement involvement cannot be handled like an availability outage. No one should expect Instructure to publish details that compromise an investigation, expose customers to additional risk, or make forensic work harder.

But the communications issue is not that Instructure failed to provide every detail. The issue is that for most of this week, Instructure treated a vendor-level security crisis primarily as a status-page incident.

The Status Page

On May 6, Instructure marked the incident "Resolved" on its status page, saying Canvas was fully operational and that the company was not seeing ongoing unauthorized activity. The message recommended customers enforce multi-factor authentication on privileged accounts, review admin access, and rotate API tokens or keys where applicable. It also said this would be the company's final update via that status page, with further updates provided through other channels and through direct communication with impacted customers.

It Was Not Resolved

That framing did not hold up for long.

By Thursday morning, May 7, users at multiple institutions were blocked from Canvas and instead saw redirect messages from ShinyHunters, the group claiming responsibility for the breach and posting a list of affected schools. As the NY Times reported, students at Harvard were among those who hit the ShinyHunters page when trying to log in.

By Thursday afternoon, Instructure had taken Canvas offline in response.

By Thursday evening, customer institutions—not Instructure—were carrying the public explanation, while Instructure's own public posture remained status-page language about maintenance mode and login difficulties. Baylor's May 7 update was particularly direct.

That guidance did more than notify users of downtime; it confirmed that the May 6 "Resolved" framing was no longer accurate. Baylor's earlier update also told its community that Instructure had notified customers of a data breach, that Baylor data stored on Instructure servers was impacted, and that Instructure had contracted with a forensics firm to investigate the extent of the breach. Other institutions followed a similar pattern. AP reported that the University of Iowa, Virginia Tech, the University of New Mexico, the University of Florida, Princeton, and UT San Antonio were among those notifying students, parents, or campus communities, with UT San Antonio even pushing back Friday finals in response to the outage.

Friday's Update

Late Friday, Instructure published its Security Incident Update & FAQ at instructure.com/incident_update—the kind of substantive, central, public source that should have anchored the week's communications from the start. The page provides material new information.

Instructure says it first detected unauthorized activity on April 29 and notified impacted organizations on May 5. The May 7 activity that produced the ShinyHunters redirect pages was tied to the same underlying incident. The company has identified the vector as a vulnerability related to Free-For-Teacher accounts and has temporarily shut those accounts down—a meaningful, customer-facing decision given how widely Free-For-Teacher is used in K-12 and informal education contexts. The page confirms that the data taken in the April 29 incident includes user names, email addresses, student ID numbers, and messages between Canvas users. Instructure says it has found no evidence that passwords, dates of birth, government identifiers, or financial information were involved, and no evidence that data was taken during the May 7 activity. Law-enforcement engagement now includes the FBI, CISA, and international partners.

The page also includes a line worth quoting directly: "Trust is earned through actions and we're committed to earning yours."

That sentence is the right framing. It is also what the rest of this piece is about.

What the page does not say is as telling as what it does. Reporting from TechCrunch, Times Higher Education, and others has put the scope of the breach at roughly 9,000 institutions and somewhere between 200 and 275 million user records, with billions of messages between students and teachers among the data ShinyHunters claims to have exfiltrated. The May 8 FAQ does not acknowledge any of those figures, does not characterize the volume of data taken in any form, and does not address the extortion claims and May 12 deadline that drove the May 7 redirect pages and the resulting institutional scramble. Listing the categories of data involved without acknowledging the scale is a partial disclosure presented as a full one. Customers reading the FAQ would not learn that this is among the larger education-sector data exposures on record. That omission is a choice, and it is the kind of choice that erodes the trust the rest of the page is asking customers to extend.

What Trust Was Built On

The May 8 page is a real step. It is the format the situation called for, and the content is more candid than what came through the status page earlier in the week. But trust is earned through actions, in Instructure's own words, and the actions across this week tell a more complicated story.

For most of the week, the clearest public evidence that the incident had escalated came not from Instructure's own public channels, but from the customers and partners forced to explain the situation to their users.

This matters because Canvas is not just another enterprise system tucked away in administrative workflows. It is the day-to-day academic operating layer for millions of students and faculty. It is where students get assignments, submit work, access grades, review lecture materials, message instructors, and prepare for finals. When the platform is unavailable, defaced, or tied to exposed messages and identifying information, this is not merely a back-office security issue. It is an academic continuity issue.

A public FAQ on Day Five of a confirmed-data-exposure cyber incident is not the same as a public statement on Day One. And the May 8 page is corporate voice. There is no named executive on it, no equivalent of the Coates "we are embarrassed, we are sorry" moment, no signed ownership. The 2012 standard was not just the format; it was the signature.

The operational situation may also stabilize faster than this week's public timeline suggests—whether through forensic containment, negotiation with the threat actor, or other means. That would be welcome for institutions in the middle of finals. But operational resolution is not communications resolution, and a quiet return to normal would not retire the questions this week has raised.

Canvas rose in part because customers believed Instructure was different. More open. More responsive. Less defensive. More willing to own the problem instead of managing the optics. This week, that difference was hard to see until Friday afternoon—and even then, only partially.

The company built a lot of trust in the 2010s by being unusually candid when Canvas had a bad day. This week, Canvas had a much worse week. Trust is earned through actions. Instructure has now taken one, but the standard it helped set calls for more.

The main On EdTech newsletter is free to share in part or in whole. All we ask is attribution.

Thanks for being a subscriber.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

I apologize for the oversight, but there was a version-control error on slides 34 and 35 in describing Brightspace’s market position. I have updated the slides and have the revised version available below.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

This year’s report shifts emphasis. Previous editions centered on market share data. This year, the more important questions are strategic.

The data matter and are included, but the market has matured to the point where the more interesting questions are strategic. How are vendors positioning for an AI-transformed landscape? What does the Anthology/Blackboard bankruptcy resolution mean for competitive dynamics? Is the LMS category itself evolving or commoditizing?

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

The State University of New York's Board of Trustees executive committee approved a Systemwide AI Policy on April 30. The policy is worth reading not because it is unusually bad or unusually bold, but because it is so representative of where higher education AI policy currently sits. It creates a responsible-use framework, recognizes real institutional risks, points campuses toward local implementation, and says many of the right words about privacy, accountability, equity, shared governance, and training.

It also largely misses the point of where AI is heading and how students are impacted.

This is not just a SUNY issue. Across higher education, too many AI policies still read as if the core question is how to manage ChatGPT usage without upsetting existing academic processes. Should students be allowed to use AI? How should faculty disclose expectations? How do we protect privacy? How do we avoid bias? How do we preserve academic integrity? These are all legitimate questions, but they are no longer sufficient questions.

Two strategic failures stand out. The policy is governing yesterday's AI. And the policy explicitly endorses the inconsistency students are reporting in their day-to-day experience moving through courses. Neither is an accident, and the explanation in both cases is the same—a policy designed to fit comfortably alongside everything that already exists is a policy that will not change what institutions actually do.

The policy is protective, by design or otherwise

The unifying logic of the document is protective. It acknowledges AI prominently enough to satisfy a board vote, a press release, and a regulatory landscape that increasingly expects institutions to have something on file. It does so without constraining any process, governance body, or faculty assumption that currently exists. Existing institutional frameworks are not challenged; they are encouraged to ‘extend’ to AI. Campuses must publish or update policies, but the structure of the work is to weave AI into the existing policy landscape rather than force a reconsideration of that landscape.

Existing procurement practices remain intact, with new language to be added "to the extent possible." Existing shared governance arrangements are explicitly preserved as the right venue for pedagogical decisions, with course-level discretion protected by name. The risk-based governance requirement defers categorization to each campus, which means in practice that whatever each campus is currently doing will likely qualify.

This is not an accusation of bad faith. There are legitimate reasons to write a protective AI policy. Faculty governance norms are real. Operational disruption is costly. The technology is moving faster than institutional processes can absorb. And the alternative—a policy that addresses difficult questions and constrains current practice—would have triggered fights the system office reasonably might want to avoid.

But the consequence is the same regardless of intent. Institutional policies that avoid the real but challenging problems faced by students and faculty will fail to make a difference. The two strategic failures that follow are not separate from this design choice.

The policy is governing yesterday's AI

Read the AI System definition carefully. It describes a system that uses "model inference to formulate options for information or action." Formulate options. That is the pre-2025 framing—AI as recommendation engine, with a human reviewable surface between output and institutional action. It is not language that contemplates systems that take action themselves, chain tool calls, execute code, or operate inside institutional systems autonomously. The entire document is structured around the chat-era assumption that there is always a human in the loop to review what the AI proposed.

A few weeks ago I described the uneven nature of AI developments, with inflection points and phase changes.

SUNY’s policy presents a good example.

The accountability principle has the same vintage problem. "The ultimate accountability for work completed and actions made by, or in conjunction with, AI systems must rest with human beings." True in the abstract. Operationally meaningless when applied to systems that generate hundreds or thousands of micro-decisions inside workflows no human reviews in real time. The policy does not distinguish human-in-the-loop from human-on-the-loop—the difference between a person reviewing each consequential output before action and a person supervising a system that is already operating. This is the inflection point from late 2025. A governance framework that cannot see the distinction cannot assign accountability for agentic action; it can only restate the principle that someone is responsible.

Procurement is the next casualty. The requirement to "preserve SUNY's decision-making authority" was written for a product landscape in which decision-making was discrete and reviewable. Current vendor offerings routinely include agentic capabilities that take multi-step actions inside institutional systems—drafting and sending communications, modifying records, executing code against institutional data, navigating administrative workflows. The policy has no vocabulary for any of this. It cannot ask vendors the questions that need to be asked, because the framework was not written from a posture that knows those questions exist.

The deepest version of this blindness is in program outcomes. The policy treats AI exclusively as something used inside SUNY. It does not treat AI as something reshaping the labor markets SUNY credentials are supposed to prepare graduates to enter.

That distinction matters. If agentic systems compress entry-level work in software, finance, legal services, marketing, customer support, and business analysis, then AI policy is also workforce policy and curriculum policy whether the document admits it or not. The Education principle addresses AI literacy. Literacy is necessary and not sufficient. The harder question—whether the programs students are paying to complete still terminate in the labor markets the institution implies they do—is not in the document.

No policy can address all problems, but a systemwide AI policy that bills itself as providing a framework should at least frame the big questions that need to be addressed..

The policy reinforces the inconsistency students are reporting

If the first failure is about what the policy cannot see, the second is about what the policy refuses to coordinate.

Surveys of students on AI policy tend to raise the same issue, perhaps best expressed by the Cal State Student Association earlier this year [emphasis original].

In the SUNY policy, the third guiding philosophy states that pedagogical AI policies should be developed through shared governance and "should take care not to limit creativity and experimentation in teaching, research, and learning." Read in context, that sentence does the opposite of what students would want. It pushes pedagogical AI decisions down to shared governance bodies—which in practice means departments, then individual faculty—and explicitly protects course-level discretion as a value the policy will not constrain.

That is the language of preserving faculty autonomy. It is not the language of cross-course or cross-section coherence for the students who actually move through SUNY's curricula. Students are encountering different AI rules in adjacent courses in the same program, or different rules across sections of the same course, with no coherent expectation about what they are supposed to learn to do—or not do—with the technology by the time they graduate. The SUNY policy does not engage that finding. The Roles and Responsibilities requirement is institutional—management and oversight—not pedagogical. The Education principle covers AI literacy curricula, not students' day-to-day experience navigating a patchwork of course-level rules. In practice, that amounts to endorsing variability as the price of preserving faculty autonomy.

A policy that took student consistency seriously would have to constrain faculty discretion in some defined way—a minimum syllabus disclosure standard, a baseline taxonomy of permitted, restricted, and required AI uses, or a program-level coherence requirement that departments articulate consistent expectations across the courses a student actually takes. Each of those creates friction with shared governance. SUNY's policy resolves the tension by deferring entirely to faculty-level autonomy and treating the resulting variability as a feature. That is the protective posture in its sharpest form, and it is the position that produces exactly the experience students keep reporting.

The inconsistency students experience is the visible surface of a deeper question the policy declines to engage: assessment integrity. This is what faculty are most often grappling with right now—not whether AI is broadly useful or broadly threatening, but what counts as a student's own work in a course where AI tools are accessible, capable, and in many cases permitted by the institution itself. The SUNY document does not contain the words cheating, plagiarism, integrity, assessment, or authorship. The closest it comes is a single phrase distinguishing pedagogical AI policy from policy "relating to student evaluation and grading," and that distinction is used only to push assessment governance further down—to the same course-by-course discretion that produces the inconsistency in the first place.

The result is that students and faculty are experiencing the same structural failure from opposite sides. Students see a patchwork of rules across courses with no coherent expectation about what they should learn to do with AI by graduation. Faculty are left to manage, individually and without institutional backing, the harder question underneath: what a student's submitted work actually demonstrates, and by extension what a SUNY credential is now supposed to mean. Those are not separable problems. Inconsistent AI rules across courses are not just an inconvenience for students; they are the form a system-level integrity vacuum takes when it is pushed down to the syllabus level. A policy that declines to engage either side is, in practice, a policy that has decided this question is too costly to take a position on.

The pattern, not the document

These are not separate critiques, and they are not specific to SUNY. The policy that mis-categorizes the technology and the policy that declines to coordinate the student experience are the same policy, and the design logic that produces both is showing up across the systems and institutions writing AI policies right now. Acknowledge AI prominently. Constrain nothing currently in place. Defer the operational questions to local discretion or to a future review cycle. The result is a document trustees can approve, press offices can announce, and the field can quietly continue to ignore in practice.

A policy that does not threaten existing assumptions cannot govern a technology that is already overturning them. The questions these policies decline to engage will not wait for the next review cycle. Students are already living inside the gap.

The main On EdTech newsletter is free to share in part or in whole. All we ask is attribution.

Thanks for being a subscriber.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

At ASU+GSV earlier this month the AI counter-revolution went mainstream. ASU leaders and others pushed back hard against Big Tech’s influence in education, voicing real concerns about cognitive load, the value of struggle, and what gets lost when students offload thinking to tools. That pushback deserves to be taken seriously.

Yet something more interesting—and potentially more lasting—also happened. In panels that drifted off script, people started talking seriously about what learning actually is and what it is for. Not as abstract philosophy. As an urgent operational question. The trigger, almost always, was AI.

AI may be giving us permission to have more honest conversations about learning outcomes and educational mission, even if it did not create the underlying problems.

The counterrevolution has a targeting problem

The pushback on AI in education is producing some legitimate thinking—cognitive load, the value of struggle, what gets lost when students offload thinking to a tool. That argument deserves to be taken seriously. But it also requires honesty about what it is targeting.

A report released this week by Yale’s Committee on Trust in Higher Education highlights how deep these problems run. It details a decades-long erosion of public trust caused by pervasive grade inflation that has undermined credential integrity, intellectual monocultures on campus, affordability pressures, and debt burdens at professional schools that outrun expected earnings. The committee places significant responsibility on higher education institutions themselves for allowing these issues to accumulate over many years.

None of those problems were created by AI. Grade inflation was accelerating before ChatGPT existed. The debt-to-earnings mismatch was documented long before generative models could write a student essay. Intellectual insularity on campus is not a technology problem. These are choices institutions made, or allowed to accumulate, over a long period.

What ties them together is the long, quiet push to make education transactional. By “transactional,” I do not mean simply that students care about jobs or that institutions care about outcomes. I mean that higher education increasingly operates as a managed exchange rather than a formative experience: students accumulate credits, credentials, and services, while institutions reduce friction, protect revenue, and move students through the system. In that environment, too many decisions get optimized for completion, satisfaction, and administrative self-protection rather than for rigor, intellectual development, or a coherent educational mission. And when the underlying goal becomes the piece of paper more than the learning it is supposed to represent, a cheating culture has room to flourish. Academic dishonesty becomes easier to rationalize when students see themselves as completing transactions rather than undergoing formation, and when institutions themselves send signals that progress toward the credential matters more than the integrity of the process.

Cognitive offloading to AI is simply the latest symptom of that same transactional mindset.

Which makes the counterrevolution’s targeting problem clear. The concern about offloading thinking to AI is legitimate. But if that concern does not extend backward—to the assessment regimes that reduced learning to completion metrics, to the credentialing inflation that substituted credential accumulation for demonstrated capability, to the affordability spiral that made the transactional degree a rational response to irrational costs—then it is reacting to a symptom while leaving the disease unexamined.

What AI is doing, at its most useful, is forcing the question: what are institutions actually for, and are they doing it? That question was available before. The permission to ask it urgently, apparently, required a technological disruption large enough that ignoring it was no longer comfortable.

The binary is the enemy

The most useful voices at ASU+GSV this week—and there were several—were the ones refusing to choose sides. Not pro-AI, not anti-AI. Pro-learning, with AI as one variable among many. Lev Gonick’s focus on measuring and supporting learning rather than debating the technology is the right frame. Leadership in this moment looks like holding that position under pressure from both directions—the vendor floor pushing adoption and the counterrevolution pushing resistance.

The binary resistance mentality may feel satisfying in the moment, but it is unlikely to change the practical integration of AI the way its loudest advocates hope.

What the workforce conversations got right

The most grounded thinking at the conference often came from workforce sessions, and not by accident. Workforce has a reality check built in that pure pedagogy conversations lack—employers, hiring data, economic mobility. When workforce panelists talked about what graduates actually need, the conversation had to stay tethered to evidence. That discipline is a model for how the broader learning conversation should work, and it’s worth naming as a contrast to the sessions that stayed in aspiration.

The permission question

One of the more refreshing conversations at ASU+GSV was the simple reminder that real learning usually involves struggle. Not pointless friction or bureaucratic hoops, but the kind of effort that comes from reading a full book closely enough to wrestle with an argument, sitting with confusion long enough for understanding to develop, or working through an idea in a process that can be frustrating precisely because it is formative. That matters because education loses something essential when learning is reduced to checkboxes, task completion, or the fastest path past difficulty. AI did not create that tension, but it is helping force a more serious conversation about it.

If AI anxiety is what finally opens serious conversations about learning quality, institutional purpose, and the thirty-year drift toward transaction, that is worth something regardless of how the technology itself plays out. The risk is that the industry—vendors, investors, institutions—uses AI as a focusing mechanism without reckoning with the structural damage that preceded it. Permission to have the conversation is not the same as having it honestly. ASU+GSV showed both the opening and the risk in the same week.

The main On EdTech newsletter is free to share in part or in whole. All we ask is attribution.

Thanks for being a subscriber.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

Regional Public Institutions (RPUs) are under increasing enrollment pressure, even as other parts of the public sector continue to grow. Online learning is often seen as a bright spot. As a group, RPUs have expanded their online enrollments—particularly at the graduate level—suggesting that online education may help offset broader declines.

But that story looks different once we shift from overall to the markets where RPUs actually operate. RPUs are, by design, state-based institutions. And despite the perception of online education as a national market, much of online enrollment remains local or regional.So rather than asking whether RPUs are growing online, the more relevant question is: What does their position look like within state-level markets?

Using data from Phil’s Hidden Geography of Online Learning project, I examined fully online enrollments across states. What emerges is a more complicated picture: RPUs are often competing in markets where they are not the dominant players—and in many cases, not the strongest ones.

Methodological note: First, his analysis uses Phil’s analysis which uses data on fully online enrollments, and so excludes students taking a mix of online and on-campus courses. That is an important issue, and one where RPUs likely would shine, but we must defer that to another day. Second, defining RPUs is not straightforward—there is no single agreed-upon category—so I use from the Alliance for Research on Regional Colleges (ARRC). While imperfect, this approach provides a consistent basis for examining RPU positioning across states.

The problem RPUs are trying to solve

Just over a year ago, Phil wrote about Diverging Fortunes in Public 4-year Institutions. He was responding to a report from the Alliance for Research on Regional Colleges (ARRC), but extended the analysis to show how enrollment in RPUs was diverging sharply from non-RPUs.

Phil did find a bright spot in enrollment trends. RPUs have been far more aggressive than non RPUs in growing online enrollments, particularly in the graduate space.

Aggregate success hides local reality

But this is aggregate data, and RPUs are typically state-focused. Additionally, while this is shifting, much of online learning remains local. What does fully online enrollment in RPUs look like at the state level?

Phil’s Hidden Geography project, which looked at fully online enrollment by state, gave me an opportunity to explore this. What emerges are three different types of RPU positioning in state markets for online learning.

• A market where RPUs are competitive but not in control

• A market where RPUs are missing or where they play a minimal role

• A highly contested market where RPUs’ online presence is being squeezed on multiple fronts

It is not easy to do a 1:1 comparison across institution types, as there are different numbers of institutions, but ratios tell us a lot about market strength regardless. My analysis looks at all RPU, community college, private, and other public enrollments—not just those shown on the Sankey charts—but the charts continue to provide excellent illustrations of market structure.

Three ways RPUs show up in online markets

Looking across states, three patterns emerge in how RPUs are positioned in online markets:

Competitive—but not in control

In some states, RPUs are significant players in fully online enrollments. States such as Texas, Georgia, Alabama, Arkansas, and Idaho fall into this category. In these markets, RPUs capture a meaningful share of in-state online students and compete directly with both community colleges and national providers.

But “competitive” does not mean dominant. Even in their strongest markets, RPUs rarely control the online landscape. Instead, they operate as one of several major players in a system where community colleges often anchor access and scale, and where national providers maintain a steady presence. In Texas and Georgia, for example, the scale of the RPU sector contributes to their visibility, but these states also have large and active community college systems and a wide range of other institutional actors.

We might expect RPUs to play a strong role in states like Texas and Georgia, given their scale. But even in smaller systems, such as Arkansas, with only eight RPUs, they can still emerge as major providers—suggesting that scale alone does not determine their position.

What this means is that RPUs are not shaping the market so much as participating in it. They are able to attract students, sometimes at significant scale, but they do not have a structural advantage that allows them to dominate in-state online enrollments.

Even in their strongest markets, RPUs are not setting the terms of competition. They are operating within systems shaped by other actors—particularly community colleges—and competing for share rather than defining the market itself.

If this is what the strongest RPU markets look like, other states reveal a very different reality.

Minimal or missing RPU states

If the competitive states show the upper bound of RPU success in online markets, other states reveal a very different reality. In some states, RPUs are simply not meaningful players in fully online enrollments. The most striking example is California, where RPUs—primarily the Cal State system—are largely absent from the in-state online enrollment landscape. Due to California not participating in SARA, I cannot show the data the same way, but note that apart from National University, all others in the Top 12 list are community colleges.

What is notable is not just that RPUs are weak in these states, but that other sectors are filling the space. In many cases, community colleges dominate by aligning closely with workforce needs and price sensitivity, while national and private providers capture demand for scale or specialization, as we see in Iowa.

These are not isolated cases. States such as Mississippi, North Carolina, and Michigan show similar patterns, albeit to varying degrees. In these markets, RPUs are present but capture only a small share of fully online students, often trailing far behind other sectors. In these states, RPUs are not simply losing share—they are ceding their traditional role within the state’s higher education ecosystem, and it will become increasingly difficult to re-establish that role in a competitive online market that is becoming increasingly mandatory.

The squeeze (and the most common case)

If the competitive states represent the upper bound of RPU success, and the minimal states show where RPUs are largely absent, the most common pattern falls somewhere in between.

In many states, RPUs are neither dominant nor missing. Instead, they are one competitor among several in highly contested markets. States such as Colorado, Illinois, Virginia, Pennsylvania, and New York illustrate this pattern. In these markets, RPUs are present and often enroll substantial numbers of online students—but they do not appear to have a clear advantage over other sectors. New York is a particularly striking example of this type of market, made more surprising by the large number of RPUs in the state.

What distinguishes these states is not just the number of competitors, but the nature of the competition. RPUs are competing across multiple dimensions simultaneously. National providers bring scale, brand recognition, and significant marketing capacity. Community colleges offer lower-cost, locally-oriented programs that align closely with workforce needs. Private institutions often occupy niche positions, whether through mission, modality, or program specialization.

The result is a form of structural competition in which RPUs are squeezed from multiple directions. They are not simply competing for share within a single market segment—they are operating in an environment where different types of institutions are better positioned to meet different aspects of student demand. RPUs are competing, but on terrain defined by others.

This helps explain why RPUs often struggle to establish a strong position in these markets. Their traditional strengths—regional identity, access mission, and broad program offerings—do not translate as directly into advantages in fully online education, where scale, cost, and specialization play a larger role than they do on-campus.

In these states, online education has not created a new avenue of growth for RPUs so much as placed them into a more competitive and structurally complex market—one in which they are rarely the dominant actor.

Across these different state contexts, one pattern is clear: RPUs have entered online markets, but they are rarely the institutions shaping them.

What this means for RPUs

Taken together, these patterns point to a different way of understanding the challenge facing RPUs. The variation across states suggests that the challenge is not simply one of adoption. It is one of position.

Market position matters more than modality

The key question is increasingly not whether institutions should move online; it is where they sit within the markets they enter. RPUs (at least outside of California) have clearly embraced online education. But as the state-level data shows, simply offering online programs does not confer advantage. In many cases, RPUs are entering markets where other providers—community colleges, national institutions, and privates—are already better positioned to compete.

A modality shift is not a strategy (expect to hear more about this from me in the coming weeks). It does not, on its own, change an institution’s competitive position.

The main competitor is not who RPUs think it is

Much of the discussion around online education assumes that the primary competition comes from national providers. In some states that is true, but Phil’s Geography of Online Learning project shows that national providers constitute an important but thin overlay across what are fundamentally state-level markets. In most states, the more immediate competition is local. Community colleges, in particular, play a central role in shaping online markets, often dominating enrollments by combining lower cost, local access, and workforce alignment. Private institutions add another layer of competition through niche positioning and program specialization.

The result is that RPUs are not simply competing “up” against national brands. They are competing in multiple directions at once—and often against institutions whose strengths are more directly aligned with the needs of online students.

Online amplifies structure—it does not erase it

Online education is often framed as a way to transcend geography and expand reach. But in practice, it tends to reinforce underlying market structures. Institutions with scale, strong brand recognition, or clear cost advantages tend to benefit most. Those without these advantages often find themselves competing in more complex and fragmented markets.

For RPUs, this means that online is not a neutral expansion of opportunity. It is an environment that amplifies both strengths and weaknesses. In that sense, online education is less a growth strategy than a stress test—one that reveals how well institutions are positioned to compete beyond their traditional boundaries.

The main On EdTech newsletter is free to share in part or in whole. All we ask is attribution.

Thanks for being a subscriber.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

It is April and, right on cue, it snowed here in Salt Lake City on the last typical day of snowfall. Given the drought, I suspect it made us all happy.

Here’s what caught my attention this week.

What I missed: From testing to infrastructure

Earlier in the week over at On Student Success I wrote about the new partnership between Khan Academy, TED, and ETS to offer low-cost undergraduate degrees. My argument was that Khan Academy didn’t fully understand the challenges of learning at scale, especially when it comes to engaging students, and that this gap matters given the ambitions of the new venture.

I also suggested that the Khan TED Institute may be underestimating the difficulty of entering what is already a crowded and highly competitive market for online degrees. I stand by that assessment, and I want to come back to it in more detail, particularly in terms of how EdTech vendors think about learning.

But I missed something important, and it was surfaced in an excellent post from the Higher Education Executive Intelligence newsletter (hereafter HEEI). In my own coverage, as in much of the early commentary, the focus was on Khan and on TED. The ETS component of the partnership received far less attention. That is a mistake. ETS is not a supporting player here. It is a central part of the strategy and helps explain what this initiative is actually trying to do. And this angle deserves more analysis.

What looks like a partnership story is, in fact, a business model story, and a signal that one of higher education’s core infrastructures is being reworked. To understand that shift, you have to start with what is happening to ETS itself. The context is straightforward. Demand for standardized testing has been declining, and with it the stability of the revenue model that sustained ETS for decades. The argument in the HEEI post builds from that starting point.

These tests weren’t just products. They were part of the infrastructure that made large-scale admissions and international mobility possible. Moving away from that model is not a simple adjustment. It is an ambitious shift.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

In California, Oregon, New York, Nevada, and Vermont, more than 40 percent of graduate borrowers in those states’ institutions already borrow above the new OBBBA loan caps. In Arizona, Delaware, New Hampshire, and Utah, the share is 15 percent or lower. What looks like a federal finance policy debate is much more than that—it is also a local enrollment and pricing problem.

That is why the new PEER Center brief is so useful. The report, How New Graduate Loan Limits Will Affect Individual Colleges, takes underlying data prepared by the U.S. Department of Education’s Office of the Chief Economist and estimates the share of borrowers and loan volume above the new OBBBA limits, using academic years 2020 through 2023. The authors are careful to note that the granular estimates involve imputation and should be treated as estimates rather than precise point values, particularly at the program-by-institution level.   

The problem is that PEER’s public brief is much stronger on data than on visual explanation. That is not a knock on the work itself. Quite the opposite: the dataset is good and the policy relevance is obvious. But it is hard to get a quick feel for the geography of the impact just by reading tables. So I took their state-level data—based on the institution location—and built a visualization to make the variation easier to see. The maps below represent my attempt to answer a simple question that the tables make important but not intuitive: where will these new caps hit hardest, and what kind of graduate borrowing is driving the differences?

National View

The first thing the map makes clear is that this is not some uniform policy reset. It is a highly uneven shock that will hit institutions based on where they operate and what they offer. There are clusters of states where large shares of graduate borrowers already exceed the new caps, and there are others where the effect looks much more modest.

But the map also helps show something else that matters for institutional leaders. Share is not the same thing as scale. California and New York combine high affected shares with very large underlying loan volumes above the limits, while some smaller states may look intense in percentage terms without carrying the same aggregate dollars at risk. That distinction matters when thinking about both institutional exposure and broader market effects. 

A few states show the range of the story

Rather than dump all 50 state images inline, it is more useful to look at a few examples that show the patterns.

New York and California provide the clearest examples of both breadth and scale. PEER estimates that 42 percent of graduate borrowers in both states are above the new limits, with $925 million out of $2.69 billion (NY) and $1.37 billion out of $3.97 billion (CA) in loan volume above the caps. That is not a niche policy effect. That is a major financing shift for a large and complicated graduate education market.   

Then there are states such as Vermont, where the intensity is high but the scale is much smaller. Vermont at 40 percent, making both stand out on the map, but they do not carry the same system-level dollar exposure as California or New York. This case shows why percentage alone can mislead.

On the other end, Arizona help show the lower-impact side of the range. PEER estimates that just 15 percent of graduate borrowers in Arizona are above the new limits. Those are not trivial shares, but they point to materially different local conditions than the states at the top of the chart.

The geography matters, but it is not the whole story

The map is the entry point, not the conclusion.

What PEER's report makes clear is that most of the real action sits below the state level, and it splits along two different logics. Professional programs—medicine, law, dentistry, pharmacy, veterinary medicine, osteopathic medicine—get hit because per-student borrowing runs well above even the higher $50,000 annual professional cap. The exposure there is about loan depth per borrower. Non-professional fields like MBA, nursing, social work, physical therapy, physician assistant, and occupational therapy show large aggregate impacts for a different reason: borrowing per student is lower, but enrollment is high. The exposure there is about breadth. Institutions built around the first group face a pricing and financial-aid redesign problem. Institutions built around the second face an enrollment and access problem.

That is the key analytical point to carry into any state image. This is not mainly a red-state versus blue-state story, nor is it simply a public versus private story. It is a geography-plus-program-portfolio story, and the same state average can hide very different campus-level realities depending on which mix of professional and non-professional graduate programs an institution runs. PEER's state tables show meaningful variation by institutional control and credential level that reinforces this: the statewide number is a starting point, not a diagnosis.

State view download

For this post, I am focusing on the national visualization and a handful of state examples to make the pattern legible. If you would like to download all 52 images, however (50 states + DC + US), download the PDF file below.

State Charts from PEER Loan Limits.pdf

17.63 MB • PDF File

Download

Stay tuned

This post makes the geography visible. The harder questions sit underneath: which institutions are most exposed given their specific program portfolios, how the professional-program depth problem differs from the non-professional enrollment-scale problem, and how these financing shifts interact with the broader affordability and accountability pressures already building. Those are questions we plan to return to in future On EdTech+ analysis.

The main On EdTech newsletter is free to share in part or in whole. All we ask is attribution.

Thanks for being a subscriber.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

ASU+GSV’s theme this year is Fusion, explicitly framed around turbulent times and the convergence of forces reshaping education. The organizers are not pretending this is a normal year or a simple celebration of innovation. They see the turbulence, and they named it. And yet, based on a few days of sessions and hallway conversations, too much of the conference was programmed around the profitable half of it.

That is the story here. The problem is not that ASU+GSV somehow missed a few important topics. The problem is that the conference puts on display a broader EdTech blind spot about the actual crisis confronting colleges and universities.

• The visible conference is the familiar one: AI tools, transformation narratives, packed sponsored sessions, and a steady stream of claims that better technology can unlock the next phase of higher education.

• The missing conference is the one that should be happening alongside it: financial sustainability, student loan limits, institutional accountability, accessibility, program viability, and the growing question of whether institutions can continue to operate under mounting external constraints without changing their underlying models.

There is not much being fused, and that second conference is largely absent.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

Last week I shared a post looking at The Locality of Online Education, using AI tools (mostly Claude Code) to generate custom graphics based on three separate but connected datasets.

The locality analysis required something that was genuinely beyond what I could reliably do in December: combining multiple independent datasets—VOL survey reports across 14 years, NC-SARA institutional enrollment data, and IPEDS nationwide figures—into a coherent analytical framework with charts precise enough to publish. The December attempt with NotebookLM collapsed on a simpler version of that problem. Last week it worked.

This experience points to what I consider to be a better framing to understand AI and its implications for education in general but also EdTech specifically. Rather than viewing AI as one thing that is increasing in capabilities quickly, or even exponentially, what we’re really seeing is a whole new set of capabilities separated by inflection points. It’s not just a matter of being able to do certain tasks better over time—it’s more a matter of discovering the ability to do tasks that simply could not be done, at least in a reliable cost-effective manner just months ago.

This distinction matters because most strategy and policy discussions still assume steady improvement, not phase changes.

AI Phase Changes

This observation is not new, and it even predates the LLM era of AI. Vasant Dhar from NYU described the paradigm shifts in AI development from the late 1960s through the introduction of general purpose LLMs in late 2022. From expert systems to machine learning to deep learning to general purpose computing.

What has happened in the past few years extends these phases changes, but at a much faster pace. Ben Thompson has described the AI era in terms of three inflection points.

• Chat with GPT3.5 in Nov 2022 - The basis for the modern AI started in 2017, but the GPT3.5 release made the world see the possibilities. This phase, however, was marked by wrong answers and even hallucinations when the AI tool didn’t know the answer.

• Reasoning with GPT o1 in Sep 2024 - This phase meant that AI would get answers right much more often, but more significantly, the AI could reason about its responses and even re-evaluate its approach to answer questions and iteratively improve.

• Agents with Claude Code/Opus 4.5 and OpenAI Codex/GPT 5.2 in Dec 2025 - The foundation models Opus 4.5 and GPT 5.2 were big improvements, but the combination with non-LLM capabilties in Code and Codex changed the game. The generic concept of an agent changed, and the combined probabilistic / deterministic capabilities meant that real tasks could be accomplished, providing a whole new level of value.

Each of these inflection points changed not just what AI could do, but what it made practical to do. It is that third phase change that I have experienced in the past few months.

Moving Past Evolution in Institutions and Vendors

The problem is that much of current strategy—both institutional and vendor—is built on a model that no longer fits the reality.

Most colleges and universities have responded to AI in good faith, developing policies, principles, and task forces at a rapid pace. But those efforts are largely grounded in assumptions from the previous phase of AI capability. The focus is on human-in-the-loop oversight, on mitigating hallucinations, on defining appropriate versus inappropriate use cases in relatively bounded terms. Those are not wrong concerns. They are incomplete.

They assume a category of tool that is fundamentally assistive—something that helps a student write a paper or helps a faculty member generate content, but remains unreliable enough to require constant supervision. That was a reasonable assumption in late 2022 and even into 2023. It is less reliable today, and it will be even less so going forward.

If AI capabilities are evolving through phase changes, then policies built on prior-phase assumptions risk being out of date before they are fully implemented. The issue is not that institutions are behind. It is that they are calibrating to a moving target as if it were stable.

A similar pattern shows up on the vendor side, but in a different form.

Most EdTech product development I see today treats AI as a feature layer—an enhancement to existing workflows. Add a chatbot to the LMS. Improve content generation in courseware. Automate pieces of advising or student support. Again, none of this is wrong. In many cases, these are useful improvements.

If the underlying capabilities are going through phase changes, that assumption deserves more scrutiny. When tools can not only assist with tasks but execute multi-step workflows, check their own work, and produce reproducible outputs, the boundary between “tool” and “system” starts to blur. In that context, improving existing features may be less important than rethinking what the product is actually for.

This is not an argument that current policies or product strategies are misguided. It is an argument that many of them are anchored in a prior phase of AI capability, even as the ground is shifting underneath them. Implicitly, this assumes a smooth continuum of improvement rather than a shift in what the system is.

The practical challenge, then, is not simply adopting AI. It is recognizing when the category of what is being adopted has changed.

Moving Past Evolution in Public Policy

The same dynamic shows up even more clearly in public policy, particularly at the state level and in the EU.

Most current AI policy frameworks are grounded in a version of AI that is already fading—systems that are brittle, narrowly scoped, and primarily risky because they produce incorrect outputs or embed bias. As a result, the policy focus centers on transparency, explainability, human oversight, and risk categorization. Again, none of this is wrong. But it reflects a continuity assumption: that we are regulating a stable class of tools getting incrementally better.

That assumption is increasingly strained.

When AI systems begin to cross phase thresholds—moving from generating outputs to executing workflows, from requiring constant supervision to performing bounded tasks with internal validation—the nature of both risk and impact changes. The policy question shifts from “how do we constrain unreliable tools?” to “how do we govern systems that are becoming operational actors?”

Many current frameworks, particularly in the EU, are highly structured around predefined risk categories and compliance regimes. Frameworks built around disclosure, risk tiers, and mandated human oversight. The problem is not that these are too strict; it’s that they are too static. They assume that capabilities evolve gradually enough for categories to remain meaningful over time. Phase changes break that assumption.

The result is a growing mismatch: policies designed for yesterday’s AI are being applied to today’s systems and will likely be enforced against tomorrow’s. That doesn’t just create compliance burdens—it risks missing the most important changes in how AI is actually being used.

The challenge for policymakers is similar to that facing institutions and vendors: not simply to regulate AI, but to recognize when the object of regulation has fundamentally changed.

The Addition That Matters

This is what the phase change looks like in practice. I might have been able to produce the locality analysis in mid-2025 with enough Excel manipulation, Tableau work, manual data collation, and AI assistance on the margins. But I probably wouldn't have. The opportunity cost would have been prohibitive—a week of grinding work for a newsletter post. In the end, I would have reported the VOL numbers, noted the methodology caveats, and moved on.

What's changed in this case is not that AI made me faster at work I was already doing. It's that it has made certain analytical projects feasible that would have remained in the "worth doing but won't get done" category. That distinction—expanding what gets done at all—is more important than speeding up what already gets done.

The practical challenge, then, is not simply adopting AI. It is recognizing when the category of what is being adopted has changed—and then acting as if that recognition actually matters. Most institutions, vendors, and policymakers are not doing that yet. They are calibrating carefully to a target that has already moved, and will move again.

The phase changes are not waiting for the strategies to catch up.

In future posts, I’ll explore what this means for institutional strategy and policy assumptions that may already be out of date.

The main On EdTech newsletter is free to share in part or in whole. All we ask is attribution.

Thanks for being a subscriber.

Programming note 1: We are releasing today’s post in front of the paywall, as we periodically do with this series. If you want weekly insights from Morgan in this series, you can sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

Programming note 2: Phil will be moderating two panels at ASU+GSV on Tuesday afternoon. At 2pm in Coronado E, I am moderating an LMS at 30 panel with Blackboard co-founder and future CEO Matthew Pittinsky and D2L founder and CEO John Baker. At 3:50pm at Harbor C, I am moderating an institutional accountability and Workforce Pell panel. Come join the conversation!

Now on to Morgan’s post.

In honor of those in the US who celebrate Tax Week, my reading this week focused on higher education finance. I want to share just two of the more interesting things I read with you. This week’s reading on higher education finance had a consistent theme: the system is under real financial pressure. But the explanations—and especially the solutions—often seem to be aimed at the wrong problem.

The numbers game

The SHEEO State Higher Education Finance Report attracted a lot of attention this week, most of it focusing on the decline in state financing per FTE. To my mind, that misses some of the more interesting findings in the report.

The increase in student share of program cost

The proportion of the total cost of their education that students pay has increased enormously since 1980, (from 20.9% in 1980 to 38.4% in 2025), and varies hugely by region. But it has declined substantially since 2013.

The report notes that typically the student share increases during times of recession.

Students now fund nearly twice as much of public higher ed as they did in 1980. We should be watching closely to see if this trend continues in the near to medium term especially given the constraints on student fee increases.

Net tuition revenue per FTE

This is down substantially this year, 3.5%, which is the second-largest decline on record.

This recent trend is highly unusual.

Higher ed as the balance wheel

The report cogently makes the point that higher education acts as a balance wheel for states. A place to cut funding when times are hard and in ways that can be made up for later.

So state higher education funding is often less about strategy than managing budget. In other words, higher education funding doesn’t follow strategy. It follows the business cycle. But will these trends continue, given current narratives about higher ed—especially if we formally enter a recession?

If the system is broken, control it

A new HEPI report picks up on this sense of financial instability—but takes the argument in a very different direction.

The report’s starting point is simple: the UK higher education system is financially unstable. The sector is now seeing its third consecutive annual decline in financial health, with the outlook continuing to deteriorate. That instability is already showing up in threats to the survival of institutions and in regulatory actions.

Its core claim is that institutions are behaving like competitive, revenue-maximizing actors without sufficient constraints.

From there, it argues for much stronger regulation to limit risk-taking and protect both students and the system.

Following the 1997 Dearing Report, which laid the groundwork for tuition fees, UK higher education institutions have increasingly operated as autonomous actors. That autonomy is now central to the report’s argument—but also, in its view, the source of systemic risk.

The report identifies three drivers of this risk. It points to over-recruitment domestically, the rapid expansion of international recruitment, and the growth of franchised providers—all driven by the need for increased revenue and all seen as sources of risk.

Because the debate around franchised providers is complex (and, after several months of reading, still somewhat opaque), I’m going to focus here on the two most important factors.

Over-recruitment and the problem of growth

Before 2015, UK higher education institutions were limited in how much they could grow from year to year, with enrollments capped at the previous year’s level plus 5%. Since those caps were lifted, some institutions have grown rapidly.

The report focuses on a group of what we might call growth-first institutions—providers that have expanded quickly, often in response to financial pressures and policy incentives. But it overplays its critique of this behavior. Growth is not always reckless—it is often a response to funding constraints.

If rapid growth is inherently destabilizing, then it is worth noting that some of the most prominent examples of large-scale expansion in US higher education—SNHU, WGU, and ASU—have built entire models around it. And they are succeeding with much higher rates of growth than any example in the UK.

The expansion of domestic recruitment has also been accompanied by rapid growth in international students, who, because of much higher fees, effectively cross-subsidize domestic provision.

While the report frames the instability of the international student market as the central issue, the underlying concern is more straightforward: growth itself—an absolute increase in the number of students.

The report never states explicitly why this increase in numbers is problematic, leaving the reader to infer the argument. In essence, it suggests that growth has become decoupled from capacity, quality, and sustainability—and therefore creates financial risk.

Institutions chase tuition revenue, hiring staff, building infrastructure, and taking on debt to support expansion. When enrollments fall, those fixed costs remain, leaving institutions financially exposed. In this view, prioritizing rapid growth over sustainability creates risk.

The report also argues that the growth of these growth-first institutions has system-level effects. As they expand aggressively, they draw students away from other providers, potentially destabilizing the sector.

Growth, the report argues, also outstrips capacity—not just in physical space, but in class sizes, faculty time, and student contact hours.

But the most significant concern is about quality. The report assumes that growth strains capacity and therefore necessarily degrades quality. It is an intuitively appealing argument—but one supported here by remarkably thin evidence.

That is a surprisingly limited evidentiary base for such a sweeping claim.

In response, the report proposes a series of interventions—many of them fairly draconian—including:

• Reinstating the caps on enrollment;

• Regulating grades (or marks as they would call them) and assessment by capping the number of first class and upper second class degrees that can be awarded;

• Capping course sizes;

• Standardised degree classifications for providers;

• Requiring accommodation guarantees; and

• Treating higher education more like the banking sector with regard to regulation.

Each of these proposals raises its own set of problems—and in many cases risks a significant over-correction toward regulation. But rather than unpack each of these, I want to focus on what feels like the report’s underlying assumption: a deep skepticism about growth itself.

First, growth in this case may create risk, but it is also a response to the system itself—specifically frozen domestic tuition, resulting funding gaps, and policy constraints. Institutions are not simply behaving badly; they are adapting.

Second, not all growth is problematic. Institutions like SNHU, WGU, and ASU have certainly pursued revenue, but their expansion is also driven by demand—by more students seeking degrees and by broader societal needs for a more skilled workforce. Expanding higher education can increase opportunity and improve outcomes for students at a macro level.

The system is clearly under real financial pressure. But if we misdiagnose the problem, we end up solving for the wrong things.

Growth is not the problem. The problem is a system that depends on growth without investing in the capacity to sustain it.

And that is a much harder problem to solve than simply imposing limits.

Parting thought

I am headed to Norway next month and for the first time will be renting a car. I had been thinking about speed limits anyway when I found this great comedy sketch comparing traffic fines in Norway and India.

Instagram post

The premium On EdTech+ newsletter is intended for a single recipient with occasional forwarding allowed.

Was this forwarded to you by a friend? Sign up, and get your own copy of the news that matters sent to your inbox every week. Sign up for the On EdTech newsletter. Interested in additional analysis? Upgrade to the On EdTech+ newsletter.

Two days ago, Risepoint released its 2026 Voice of the Online Learner (VOL) report. That series started in 2012 through Learning House, and then Wiley (through corporate M&A) in 2021 and then Risepoint (again through corporate M&A) in 2024. The survey is great for directly getting data from students themselves and from fairly consistent survey design. From 2012 - 2020 the report was known as Online College Students (OCS), but since then the VOL naming has applied.

What I’d like to explore is a broader question about the locality of online education.

There is a mantra of online education students largely choosing programs from local institutions, despite the anywhere-anytime nature of online. And despite the rise of online education mega-universities like Western Governors University (WGU), Southern New Hampshire University (SNHU), Arizona State University (ASU), University of Phoenix, Liberty University, and Grand Canyon University. The data, however, say the reality is more nuanced than the slogan, and 2020 changed the picture in ways that still haven't fully settled.

Rather than just reporting the new VOL numbers, I combined that survey data with the cleaner institutional enrollment census data from NC-SARA and IPEDS to get a more reliable read. One metric is within 100-miles proximity and the other related metric is in-state residency.

And what we see is a bifurcated system—for a subset of large online institutions, locality doesn’t matter, but for everyone else it is a big deal. The common view is a problem of averages, and sometimes those obscure more than they illuminate.

Within 100 Miles Proximity

The VOL reports address the question of whether the institution is within 100 miles of where the student lives. These reports are based on surveys of a sample of students (1500 - 3000 for each year). The following chart tracks the responses over the past 14 years.

Notes

• Directional rise through the 2010s. After a volatile early stretch (80% in 2012 → 54% in 2014), the share climbed steadily from the mid-60s to the high 70s by 2019, suggesting a real trend toward enrollment at nearby institutions during the pre-Covid decade.

• 2020 registered the series peak at 82%, but the value is derived from explicit distance sub-buckets and is best read as Covid-distorted noise rather than signal — that year's remote-learning disruption temporarily made everyone "within 100 miles" of their program.

• A sharp reversal post-Covid. The share dropped to 63% in 2021 and has ranged between 50–69% since, averaging roughly 10–15% below the 2016–2019 plateau. The late-2010s localism peak has not returned.

• Methodology changes complicate the post-2020 trend. Three shifts in the VOL era (sample redesign in 2021, question wording change in 2023, publisher change in 2024) overlap with the decline, so the magnitude of the true drop is uncertain — but the direction (down from pre-Covid highs) is consistent across all three survey configurations.

In-State Enrollments

There are two other data sources to consider, both of which focus on institutional enrollments as census reporting—NC-SARA and IPEDS. The data measure they use is based on institutional enrollments and whether online students reside in the same state as the institution. The following chart tracks data over the past 11 years.

Notes

• Remarkable pre-Covid stability. From 2015 to 2019, roughly 55–56% of fully-online students were enrolled at an in-state institution, varying by less than 2 percentage points across five years. This is the cleanest baseline in the study.

• A 16-point Covid spike to 71.9% in 2020 — the largest single-year movement in either series, reflecting students shifting enrollments closer to home as campuses went remote.

• Only a partial reversion. The share has drifted down each year since 2020 (65.9% → 62.5% → 61.6% → 62.1%) but has stabilized roughly 6–7% above the pre-Covid baseline, suggesting a durable, if smaller, shift toward in-state enrollment.

• Methodological continuity is validated. IPEDS nationwide figures (2015–2017) match the combined NC-SARA + IPEDS CA series (2018–2024) within 1–3% during overlapping years, giving confidence the 10-year trend is real and not an artifact of the 2018 data-source transition.

A Combined View of Locality

Let’s look at both measures of locality.

Notes

• Two independent data sources tell the same high-level story. A student-self-report survey and an institution-reported enrollment dataset both show (1) a pre-Covid tendency toward local institutions, (2) a 2020 Covid peak, and (3) an elevated-but-declining post-Covid state—strong triangulation across very different methodologies.

• The institutional data (Panel B) provide the cleaner signal. NC-SARA/IPEDS shows a stable pre-Covid baseline, a clean spike, and a gradual post-Covid plateau. The survey data (Panel A) is noisier, more volatile, and confounded by methodology changes—a reminder that self-report surveys at n≈1,500–3,000 carry meaningful year-over-year variance.

• The "permanent shift" conclusion hinges on which lens you use. Panel B suggests a durable new floor ~6–7% above pre-Covid (students are staying closer to home than they used to). Panel A suggests the localism trend may have actually reversed post-Covid. These are not necessarily contradictory—"within 100 miles" (proximity) and "in-state" (geography) are different concepts and can diverge, particularly in large states or near state borders.

• 2020 was the inflection point in both series. Whatever the long-run trajectory, Covid marks the moment that both measures broke from their prior patterns—the pre-Covid era is structurally distinct from what came after, and any analysis of online-learning geography needs to treat them as separate regimes.

Discussion

The data make more sense once you understand the structure of the online market itself. Using IPEDS data, there are 19 institutions with 25,000 or more fully-online students—WGU, SNHU, ASU, and their peers—schools with national brands, significant marketing reach, and student bodies drawn heavily from outside their home state and beyond 100 miles. For those institutions, the "students choose local" mantra does not apply.

But those 19 institutions are outliers. There are more than 1,000 institutions enrolling between 1,000 and 24,999 fully-online students. That long tail is mostly local—niche programs, regional reputations, students who already have ties to the institution or the area. The mantra has always been a description of that majority, not a universal law of online education.

What the two datasets also add is a cleaner picture of how Covid reshuffled the baseline. Both series show the same three-act structure: a pre-Covid era with a modest drift toward local enrollment, a 2020 spike that was more disruption than trend, and a post-Covid plateau that has settled above where things were before. The NC-SARA/IPEDS data—the cleaner signal—suggest that new floor is roughly 6–7 percentage points above the pre-2020 baseline and has held there for three years. Whether that represents a durable behavioral shift or a slow reversion still in progress is the open question.

For institutional strategy, the implication is straightforward. If your institution is one of the roughly two dozen with a genuine national brand in online education, your competitive frame is national and the locality data are largely irrelevant to your planning. For everyone else—the overwhelming majority of institutions with online programs — you are competing primarily for local and in-state students, and that has been true throughout the entire period these data cover, including post-Covid. That is both a constraint and a defensible position: local reputation, employer relationships, and regional accreditation carry real weight with the students most likely to enroll in your programs.

AI Note

The charts in this post were built with AI-assisted analysis using Claude Code—a workflow that worked considerably better than my December attempt to do similar longitudinal work with NotebookLM, which I documented here. For premium subscribers, I'll cover what was different this time, where friction remained, and what these results suggest about AI-assisted data work in practice.

The main On EdTech newsletter is free to share in part or in whole. All we ask is attribution.

Thanks for being a subscriber.