Canadian firms say cybersecurity budgets falling short as attacks grow: survey

A recent survey conducted by the Canadian Internet Registration Authority reveals that many Canadian companies are losing confidence in their cybersecurity budgets' capacity to combat the growing number of sophisticated threats they encounter. Of the 503 decision-makers surveyed, 76 percent reported that their organizations had increased their cybersecurity budgets over the previous year.

While most organizations allocate at least $50,000 to IT, a significant portion of firms, around 17 percent, feel their cybersecurity budgets are insufficient to cope with the escalating threats. Sixteen percent expressed uncertainty about the adequacy of their cybersecurity investments. Jon Ferguson, vice-president of cyber and domain name system at CIRA, noted that the survey underscores the increasing challenges faced by security teams, as they grapple with more threats, heightened complexity, and heightened expectations amidst economic and operational uncertainties.

Canadian educational institutions and healthcare facilities have recently experienced cyber intrusions, including a breach of education software affecting multiple schools and cyberattacks on the Hospital for Sick Children in Toronto and Winnipeg's Health Sciences Centre. The survey aimed to assess how organizations are adapting to a shifting threat landscape, particularly driven by the use of artificial intelligence and extensive online data transactions.

Four out of ten organizations polled experienced a cyber attack in the past year, with 75 percent of those hit by ransomware paying the demanded ransom, typically around $25,000 or more. Experts generally discourage companies from paying ransoms, advocating instead for bolstering security measures and enhancing staff training in handling cyber threats.

Eighty-two percent of participants have cybersecurity insurance, a figure unchanged from last year but up from 59 percent in 2021. Two-thirds of the respondents have integrated AI tools into their operations, yet more than eighty percent of cybersecurity decision-makers remain concerned about AI-based threats. The survey also delved into data sovereignty, an increasingly significant consideration as trade tensions persist.

Ninety-one percent of respondents emphasized the importance of data residency in Canada, with 89 percent expressing a preference for Canadian-owned vendors. While nearly seven in ten prioritize data sovereignty over cost when selecting a cybersecurity provider, four in ten have reviewed U.S.-based or foreign cybersecurity firms in the past year, citing cost and the limited availability of domestic vendors as primary deterrents.