Cyber Security & Privacy Insights for Canadian Business

OSFI has endorsed 12 AI practices. What a financial institution’s board should be able to show

19 Oct, 26

OSFI has endorsed the Financial Stability Board's twelve sound practices for responsible AI. Not a new rule, but a clear signal of the evidence boards will be asked for, six months before E-23 takes effect.

WestJet had MFA. The attacker went around it. Here is what the regulator asked for next

19 Oct, 26

The Privacy Commissioner closed the WestJet breach file without a finding, after an independent assessment of its new safeguards. Three lessons for boards: MFA resets, independent evidence and reporting speed.

Loi 25 : quatre vérifications qu’un conseil peut demander d’ici la fin de l’année

30 Sep, 26

La Loi 25 est entièrement en vigueur. Quatre vérifications qui révèlent le plus souvent un écart, et la question qu’un conseil devrait poser.

Canada’s cyber law has passed. It binds nobody yet. Here is what is worth doing

30 Sep, 26

The Critical Cyber Systems Protection Act is law but not in force, and its schedules are empty. What it will require of designated operators, how it reaches their suppliers, and what is worth doing now.

The AI transparency consultation has closed. What a board should do while Ottawa decides

30 Sep, 26

The federal AI transparency consultation closed on 23 September. It binds nobody, but its five questions describe records every organisation should already keep. Four things worth doing this quarter.

Three checks on your cookie banner, none of which need a consultant

1 Sep, 26

A consent banner is one of the few things anyone can inspect from the outside in ninety seconds. Most are unedited plugin defaults describing a business that is not yours. Three checks, and the one you may not be able to fix.

116 companies called for a defensive surge. Who in your business would answer?

28 Aug, 26

More than a hundred technology companies warned this week that AI-enabled attacks are about to get much worse, and told every organisation to fix its vulnerabilities. Most Canadian mid-market businesses cannot act on that advice, and the reason is governance, not tooling.

Your AI assistant will not break your file permissions. That is the problem.

27 Aug, 26

Microsoft says Copilot only reaches content a user is already authorised to see. That is precisely why an AI rollout turns a decade of quiet oversharing into something anyone can find by asking.

Why MFA on Corporate Email Is the Best Security Money Your Business Never Spent

24 Aug, 26

MFA blocks over 99% of account-compromise attacks, and corporate email is the account attackers want most. What the Google and Microsoft studies show, and how to roll MFA out well.

Cyber Attacks on Canadian Small Businesses: What the Numbers Show

24 Aug, 26

45% of Canadian small businesses were hit by a random cyber attack in a single year, and national recovery costs doubled to $1.2 billion. The latest statistics on cyber crime against Canadian SMBs.

Briefings

Quick Links

Contact Us