CIRA survey: Canadian cyber budgets rise but confidence falls
Canadian organisations are spending more on cybersecurity than ever before, yet their confidence in that spending is eroding. According to CIRA's 2026 Cybersecurity Survey, 76 per cent of organisations increased their security budgets over the past year, but only 67 per cent believe current investment is sufficient to keep pace with the threat landscape. That confidence figure has dropped from 74 per cent in 2025, suggesting that rising budgets are struggling to outrun rising risk.
The survey, which polled more than 500 cybersecurity decision-makers across the public and private sectors in Canada, points to a fragmented landscape. At the lower end of the market, the share of organisations running annual IT budgets below $50,000 more than doubled, rising from 11 per cent to 23 per cent in a single year. That compression at the bottom coincides with a string of high-profile incidents, including a ransomware attack against Manitoba's largest hospital and a breach at an Alberta university that exposed student and staff data.
Jon Ferguson, vice-president for Cyber and DNS at CIRA, said the findings reflect conditions the organisation encounters routinely. "Security teams are facing more threats, greater complexity and higher expectations, all amid economic and operational uncertainty," he said, adding that organisations are increasingly prioritising sustainable capabilities and Canadian-based operations over short-term fixes.
Digital sovereignty moves to the centre
One of the survey's most striking trends is the hardening of Canadian data-residency as a procurement criterion. Ninety-one per cent of respondents said it matters that cyber records are stored and processed within Canada, and 89 per cent indicated a preference for vendors that are Canadian-owned, headquartered, or operating domestically. Nearly seven in ten said they would prioritise data sovereignty over price when selecting a cybersecurity vendor.
This shift reflects a broader pattern visible across allied nations. Concerns about US hyperscaler exposure, combined with evolving Canadian privacy legislation and the federal government's push toward sovereign digital infrastructure, are collectively nudging enterprise buyers toward domestic providers. CIRA, as manager of the .CA domain and a not-for-profit with a mandate to strengthen Canada's internet ecosystem, is itself a beneficiary of that sentiment shift.
AI threats outpace AI readiness
AI-enabled threats are now a mainstream concern. More than eight in ten cybersecurity decision-makers said they are worried about attacks facilitated by AI tools, even as two-thirds of organisations reported integrating AI into their own workflows. The survey does not break down which categories of AI-enabled attack are considered most serious, nor does it benchmark actual incident rates against prior years.
Elsewhere, the data signals a steady internalisation of security operations. Sixty-seven per cent of organisations now manage cybersecurity in-house or on-site. Among those using SIEM, XDR, or SOAR platforms, the share building capabilities internally jumped from 40 per cent in 2025 to 63 per cent this year. Cyber insurance adoption has also matured sharply, reaching 82 per cent penetration in 2026 compared with 59 per cent in 2021, as insurers demand demonstrable security controls before underwriting coverage.
Market and regulatory context
Canada's cybersecurity posture sits at an interesting junction. The country lacks a single consolidated cyber regulatory framework equivalent to the EU's NIS2 Directive, though Bills C-26 (critical infrastructure cyber obligations) and C-27 (privacy modernisation) remain in legislative pipeline. In the meantime, insurance underwriters are functioning as de facto standards setters by demanding evidence of baseline controls as a condition of coverage. For vendors, the 91 per cent data-residency figure represents both a commercial opportunity and a compliance signal worth tracking as Canadian procurement policy tightens.