Cybersecurity in Canada was the subject of a panel discussion and featured in discussions among CIGF participants throughout the day. Canada’s cybersecurity environment continues to change at unprecedented speed, driven by advancements in AI, post-quantum computing and the commercialization of sophisticated new cyber tools, among other factors. The velocity of these changes is outpacing preparedness across industry, government and civil society, demanding new approaches, tactics and greater levels of collaboration to protect Canadians and Canadian critical infrastructure.

Canada faces an increasingly hostile environment. State-based adversaries are engaging in espionage activities, pre-positioning themselves to set up disruptive activities in the future or launching active disruptions now. Ransomware-as-a-service continues to expand, along with crypto-based payment systems, which allow attackers to hide their real-world identities. At the same time, a variety of powerful AI-driven digital tools are enabling highly sophisticated attacks and dramatically lowering barriers to entry for cybercriminals. In addition, evidence suggests that Salt Typhoon and Volt Typhoon, which are associated with China-based advanced persistent threat (APT) groups, are now persistent in telecom networks in the U.S. and elsewhere.

The commercialization of mercenary spyware, such as Paragon, is another key development in the cybersecurity landscape, giving bad actors the ability to compromise even the most highly secured devices and gain total visibility into a user’s digital footprint, locations and communications. Paragon is associated with new spyware abuses against civil society and journalists in Italy, continuing a troubling pattern of spyware abuse in democratic countries. Panelists highlighted recent research that suggests Canadian-based services may be customers within the mercenary spyware ecosystem.

Participants also heard that a significant portion of Canada’s cybersecurity risk now resides in the private sector, particularly in telecommunications networks and other critical infrastructure, making it more challenging for government to effectively address threats that exist outside public sector control.

To strengthen Canada’s security posture in this dynamic environment, Canada has introduced a new cybersecurity bill (C-8), which imposes new obligations on organizations in critical infrastructure sectors, including mandatory cybersecurity programs and a 72-hour incident reporting requirement.[1]

While this bill represents an important step forward, panelists highlighted the importance of giving organizations sufficient lead time to prepare for new obligations, continuing to create a culture of reporting rather than one driven by fear of penalties, and ensuring that organizations don’t experience data fatigue as a result of excessive or overlapping reporting requirements.

To address the many challenges, Canada must focus on improving training and awareness across sectors, expanding access to modern cybersecurity tools, strengthening collaboration between government, industry and civil society, and modernizing oversight frameworks to reflect current technological realities.

[1] Bill C-8 had been recently introduced at the time of CIGF 2025. The description reflects the bill’s status and obligations as discussed during the November 13, 2025 session.