CIRA survey finds Canadian firms spending more on security but feeling less covered
Canadian organizations are spending more on cybersecurity but fewer of them believe it is enough, according to an annual survey released Oct. 6 by the Canadian Internet Registration Authority (CIRA), the non-profit that manages the .ca domain.
The findings matter for smaller employers because the gap between threats and resources is widening at the same time attacks remain common. Four in ten organizations in the survey said they had experienced a cyber attack in the past year, The Canadian Press reported.
What the survey found
CIRA polled 503 people who make cybersecurity decisions for their organizations in an online survey conducted in June and July. Because it was an online, non-random sample, no margin of error applies.
- 76 per cent said their cybersecurity budget rose over the past year.
- 67 per cent said the budget was sufficient, down from 74 per cent a year earlier; 17 per cent said it was not keeping pace with threats.
- Among organizations hit by ransomware, 75 per cent said they paid the ransom, typically at least $25,000.
- 87 per cent have an incident response plan, and 82 per cent carry cyber insurance, unchanged from last year and up from 59 per cent in 2021.
- Two-thirds have built AI tools into their operations, and more than eight in ten decision-makers said they are concerned about AI-based threats.
Respondents also put a high value on keeping data at home. Ninety-one per cent said it matters that cyber records are stored and processed in Canada, and nearly seven in ten said they prioritize data sovereignty over price when choosing a vendor. Cost and a limited choice of Canadian suppliers were cited as the main obstacles.
Jon Ferguson, CIRA's vice-president of cyber and DNS, said "cybersecurity challenges are increasing while resources are becoming harder to secure," adding that security teams face more threats, greater complexity and higher expectations.
Why the ransom figure stands out
Security agencies, including the Canadian Centre for Cyber Security, advise against assuming a payment will restore data or stop a leak. The Cyber Centre's Ransomware Threat Outlook 2025-2027 warns that stolen data can still be used for further extortion after a ransom is paid, and that attackers may use details of a victim's insurance policy to set their demand.
The survey covers organizations of varying sizes, and the published coverage does not break out results for small businesses separately.
What to do
- Test your incident response plan, not just write it. Know who calls the insurer, the bank and police.
- Keep offline or immutable backups and confirm you can restore from them; that is what removes the pressure to pay.
- Keep copies of your cyber insurance policy out of shared drives and email where an intruder could find it.
- Turn on multi-factor authentication for e-mail, banking and remote access.
