When attackers disrupted access to Canvas during finals week, the technical method was not the most important part of the story. The timing was. The attackers did not merely target a platform. They targeted the one week when that platform mattered most.
The attackers understood that. They targeted the window, not just the system.
Pressure Windows Are Not Theoretical
Every organization that handles time-sensitive operations has pressure windows: periods when disruption does not merely inconvenience—it cascades. This can occur when the cost of unavailability is not linear but exponential and when the decision-making pressure on leadership compounds with every hour the system stays down.
Each of these windows is known and predictable. Each represents a moment when disruption creates maximum pressure and maximum leverage for an attacker who understands the operational calendar.
What Attackers Understand That Organizations Don’t
The sophistication that made the Canvas attack instructive was not technical. It was operational. The attackers understood the institution’s calendar. They understood that finals week created a pressure window in which the institution’s leadership would face maximum urgency, minimum operational flexibility, and intense visibility. They understood that a ransom demand during that window would land differently than the same demand during summer break—that the cost of saying no was higher, the pressure to resolve quickly was greater, and the public visibility of the disruption was guaranteed.
“They targeted the window, not just the system.”
The incident response framework that asks “What systems matter?” is asking the right question for a technical response. However, it is asking the wrong question for a survivability response. The survivability question is “When would disruption hurt the most?” The answer to that question shapes not just the technical response but the entire governance and decision-making framework that determines whether the organization can function under pressure when it arrives.
Incident Planning for Pressure Windows
Most incident response plans are built around system categories: tier-one systems, critical infrastructure, and priority restoration order. The plan identifies what gets recovered first and builds the technical response around that hierarchy.
This hierarchy is correct but incomplete. It does not account for the operational calendar—the windows during which even a partial disruption of a tier-two system creates a tier-one organizational consequence.
A testing platform may not normally be classified as a tier-one system. During most of the academic year, a temporary outage may create inconvenience, delay, or administrative burden, but it may not threaten the institution’s ability to operate.
During finals week, however, that same platform becomes operationally critical. Students depend on it to complete exams. Faculty depend on it to administer and grade them. Academic leadership depends on it to preserve fairness, continuity, and credibility. What was technically classified as a tier-two or tier-three system can become a tier-one institutional dependency because of timing. The technical recovery tier did not predict the operational consequence tier.
Building incident response plans that account for pressure windows requires organizations to do work that most have not done:
map the operational calendar against the system dependency map,
identify the intersections where system unavailability during specific periods creates disproportionate consequences, and
build the response and escalation frameworks that explicitly account for those intersections.
This mapping is not a security exercise. It is an operations and leadership exercise—the kind of preparedness work that requires support beyond the CISO and Risk and Emergency Management. The pressure windows are operational facts, and the incident plans need to reflect operational reality.
The Decision Framework That Pressure Windows Require
The second implication of timing-aware attacks is less about incident planning and more about pre-incident decision frameworks.
The leadership team that has not pre-established the decision-authority framework—who decides what, under what criteria, and with what documentation requirements—will make those decisions under maximum pressure, without the governance infrastructure that reasonable organizations are expected to maintain.
The decision will be made. It always is. The question is whether it will be made with the deliberateness, documentation, and governance discipline that will withstand the scrutiny that follows, or whether it will be made reactively, by whoever is in the room, without a record demonstrating that the organization was prepared for exactly this kind of pressure.
Pressure windows do not create bad decisions. They reveal whether the decision frameworks that should have existed were built before they were needed.
The Preparation That Timing Demands
Institutions that have identified key windows, mapped system dependencies that become critical during them, built the incident response frameworks that account for high-pressure periods, and pre-established the leadership decision frameworks that allow governance to function will be the most resilient.
The institutions that have done that work will still experience incidents. What will be different is the response—the disciplined, documented, and governed response of a leadership team that anticipated the pressure, built the frameworks in advance, and can demonstrate, under scrutiny, that the organization was prepared for what followed the breach, not just for the breach itself.
Organizations will not eliminate every attack. But they can eliminate the leadership chaos that attackers count on when they strike during the worst possible moment.
The attack surface is timing. The defense is preparation that accounts for it.
