CIRA published its 2026 Cybersecurity Survey on October 6, built on responses from 503 Canadian cybersecurity decision makers surveyed in June and July, spanning private businesses and public institutions including municipalities, schools and hospitals. It is the most useful Canadian dataset of the quarter, and the headline is a gap: 76 percent of organizations increased their cybersecurity budget over the past year, but only 67 percent believe their investment keeps pace with the threats, down from 74 percent a year earlier. Spending went up and confidence went down.
The number that matters most for small business
The share of organizations operating with annual IT budgets under 50,000 dollars more than doubled, from 11 percent to 23 percent. Nearly a quarter of respondents are now running security on a budget that will not stretch to a dedicated tool for every problem. That is not a failure, it is the normal condition of a small organization, and it changes what good advice looks like. At that budget the win comes from sequencing and configuration rather than acquisition: turning on what you already pay for, in the right order.
Canadians want their data in Canada
91 percent said it matters that their cyber records are stored and processed in Canada, and 89 percent said it matters that a vendor is Canadian-owned, headquartered here, or operating here. That is close to unanimous, and it is a commercial fact as much as a privacy one: if you sell to Canadian organizations, where your data sits is now a question you should expect on a purchase form. We have written about data residency and sovereignty before, largely as a compliance topic. This survey reframes it as a sales requirement.
Incidents, ransom payments and insurance
Four in ten organizations experienced a cyber attack in the past year. Among those hit by ransomware, 75 percent paid. That figure deserves a flat statement: paying is common, it is not a strategy, and it is expensive evidence that the recovery plan was not ready. Meanwhile 82 percent now carry cyber insurance, up from 59 percent in 2021, which tracks what we see in practice, insurers becoming the de facto auditors of small-business security.
87 percent say they have an incident response plan. Worth being honest about that one: having a document and having a plan someone has rehearsed are different things, and the 75 percent payment rate suggests a fair number of those documents have never been tested under pressure.
Doing more in-house, and the AI worry
67 percent now manage cybersecurity internally or on-site, and among organizations running SIEM, XDR or SOAR tooling, 63 percent are building that capability in-house, up sharply from 40 percent last year. That is a notable swing back toward internal ownership. Two-thirds have integrated AI tools into their workflows, while more than eight in ten decision makers are concerned about threats from AI tools or AI-enabled attacks, which is the same adopt-first-govern-later pattern showing up in every survey this autumn.
What to actually do
- If your IT budget is under 50,000 dollars, sequence instead of shopping. Multi-factor authentication, a password manager, tested backups and patching come before anything with a dashboard.
- Answer the data-residency question before a client asks it. Know where each significant system stores your data and whether a Canadian region is available.
- Test the plan you say you have. One tabletop walkthrough of a ransomware morning will tell you more than another policy document.
- Prove a restore, do not assume one. The 75 percent payment rate is what an untested backup looks like on the invoice.
- If you are bringing security in-house, be deliberate about it. Tools generate alerts, and alerts need a named person with time. In-house without capacity is just a quieter gap.
The takeaway
The most honest reading of this survey is that Canadian organizations are not complacent, they are stretched. Budgets rose and confidence still fell, because the threat moved faster than the spend. For a small business the useful response is not to spend more, it is to get the order right and to know which handful of things would actually matter on a bad day. That is the work we do with clients, and it is cheaper than the alternative the survey measured.