Ottawa Finally Has a Security Strategy

The bottom line

1. The strategy is overdue and gets the threat picture mostly right.
2. It is a framework, not a plan. The real test is the legislation promised within a year.
3. Security leaders should not wait for Ottawa. The threats it describes are already here.

It took Canada 22 years to write a new national security strategy. The last one came out in 2004, before smartphones, before ransomware gangs ran like businesses and long before an AI model could find a flaw in code that runs most of the web. So when the federal government released The Plan for a Stronger Canada: National Security for Canadians on Oct. 29, the first reaction in the security community was relief. The second should be impatience.

Credit where it is due

The strategy gets several things right. It treats cyber as a core national security issue rather than an IT problem. It commits to stronger digital capabilities for law enforcement and the Communications Security Establishment (CSE), to carrying out the National Cyber Security Strategy, and to an "all-threats" approach to critical infrastructure. It puts emerging technologies, including AI compute, quantum, semiconductors and telecommunications, at the top of the eight sectors Canada says it must control.

Most important, it names frontier AI as one of the greatest threats Canadians face. That is not hype. One week before the strategy landed, AI-discovered vulnerabilities in PHP forced federal, provincial and private websites offline across the country. Officials told reporters that these models have sped up how fast criminals can find and exploit software flaws before fixes exist. Canadian defenders lived that reality on Oct. 21. It is good to see Ottawa say it out loud.

Thirteen pages is not a plan

Here is the problem. The document is 13 pages long, and by its own design it is a high-level framework. The actual policies on defence, foreign affairs, economic security, public safety and intelligence are still to come. The legislation to modernize national security law is promised "within the next year." A First Ministers meeting is planned but not scheduled.

None of that is unusual for a framework. But Canada has a long habit of announcing cyber ambitions and then moving slowly on the follow-through. Attackers do not work on parliamentary calendars. The help desk phishing campaign that hit Bay Street law firms this month did not wait for a policy review, and neither will the next one.

The strategy also says little about the people and organizations that actually run Canada's networks. Most critical infrastructure is owned by the private sector, and many of the organizations that matter most, from regional utilities to municipal governments to mid-sized hospitals, have small security teams and smaller budgets. A national strategy that does not speak to them directly leaves a gap exactly where attackers like to look.

What Ottawa should do next

If the government wants this strategy to mean something, the coming year should deliver three things.

First, clear rules. The new legislation, together with Bill C-8, should spell out exactly who must report incidents, how fast and to whom. Vague obligations create confusion, and confusion slows response.

Second, money and help for the middle. Expanded powers for CSE and police are useful, but they do little for a small utility that cannot afford a security analyst. Funding, shared services and practical guidance for under-resourced operators would do more for national resilience than any new authority.

Third, transparency. Modernized intelligence powers are coming. Canadians will accept them more readily if the government is clear about how they will be used, overseen and limited. Trust is part of security.

Do not wait for Ottawa

For CISOs and IT leaders, the message is simple: the threats in this strategy are not future risks. AI-accelerated exploitation, social engineering at scale and attacks on the network edge are happening now. Patch faster, move to phishing-resistant MFA, test your incident response and know your reporting obligations under Bill C-8.

The strategy promises to be updated at least every four years. Let us hope the next one does not take another 22.