Cybersecurity in 2025: Navigating Risks and Building Resilience
As the Canadian Cybersecurity Network (CCN) reflects on the state of cybersecurity heading into 2025, the outlook is both challenging and filled with potential for innovation. The rapid digitisation of industries and an increasingly interconnected world has heightened the stakes, requiring businesses, governments, and individuals to adopt more robust approaches to cybersecurity.
To explore the path forward, CCN engaged with some of Canada’s foremost cybersecurity leaders. Their insights paint a vivid picture of the challenges and opportunities on the horizon.
The Impact of Bill C-26: A New Era for Cybersecurity
Alon Goldberg, VP of Security Architecture at ION United, believes that Bill C-26, set to take effect in 2025, will be a transformative force for operational technology (OT) cybersecurity.
“This legislation will compel organisations to treat cybersecurity as a non-negotiable priority, particularly for critical infrastructure,” Goldberg said.
He highlighted how the bill encourages collaboration between industries and the government, fostering a unified approach to defending Canada’s digital ecosystem. Goldberg stressed that the days of lax cybersecurity practices are numbered as regulatory oversight tightens.
“With so much of our economy dependent on secure systems, this is Canada stepping up to meet the demands of a more connected future,” he added.
Shifting Focus: Preparedness Over Prevention
Nick Scozzaro, CEO of ShadowHQ, emphasised the importance of incident preparedness.
“For 2025, the top priority for businesses should be enhancing their ability to prepare for, respond to, and recover from cyberattacks,” Scozzaro said.
According to him, organisations must assume attacks are inevitable. Without robust incident response plans, even minor breaches could result in catastrophic consequences such as revenue loss, reputational harm, and legal repercussions.
“These plans can’t just sit on a shelf,” Scozzaro explained. “They need to be regularly tested through tabletop exercises and updated based on real-world incidents.”
AI: A Double-Edged Sword
Artificial intelligence (AI) will play a pivotal role in both defending against and enabling cyber threats in 2025, according to Robert Falzon, Head of Engineering at Check Point Canada.
Falzon outlined several key developments:
- Democratisation of Cyber Threats: Advanced AI tools will empower less skilled attackers, increasing the number and sophistication of threats.
- Expanded Attack Surface: AI’s adoption will broaden vulnerabilities, particularly in software supply chains. Ensuring data integrity and understanding AI model provenance will become critical.
- New Skill Demands: The integration of AI will create roles like AI security ethicists and machine learning defence specialists, reflecting the need for education and new expertise.
“Children, in particular, need education to navigate their perpetually connected lives,” Falzon added, calling for government support in public awareness and education.
Evolving Threats: Exploiting Human Vulnerabilities
Paul Haynes, President & COO of eSentire, warned of cybercriminals exploiting employees through innovative methods like fake job offers, browser updates, and SEO poisoning.
“Email defences have hardened, so attackers are targeting broader internet vulnerabilities,” Haynes said.
Stolen credentials remain a significant challenge. With valid credentials, attackers can move undetected, enabling ransomware or business email compromise. Haynes urged organisations to prioritise employee training and enhanced monitoring to address these risks.
Resilience in a VUCA World
Rod Labbe, CEO & CISO in Residence at Mining and Metals ISAC, called for a shift from traditional cybersecurity to operational resilience.
“It’s not about preventing every attack; it’s about ensuring your business can operate and recover without missing a beat,” Labbe explained.
This sentiment aligns with the growing focus on zero-trust architectures, supply chain resilience, and robust recovery strategies.
Navigating the Industry Landscape
Sean Jennings of CIM Solutions raised concerns about the quality of cybersecurity solutions as vendors engage in price wars.
“There’s a danger in this race to the bottom,” Jennings cautioned.
He also noted that insurers are increasingly driving higher cybersecurity standards, though some organisations adopt solutions solely to meet insurance requirements rather than addressing actual business needs.
A Collaborative Future
As 2025 begins, Canada’s cybersecurity landscape underscores the need for collaboration, adaptability, and innovation. Stricter regulations like Bill C-26, advancements in AI, and evolving cyber threats demand a holistic approach to security.
The message from cybersecurity leaders is clear: resilience is the cornerstone of success in this volatile digital age. By thinking strategically, preparing diligently, and investing wisely, Canada is poised to navigate the challenges and seize the opportunities of 2025.
The Bottom Line
In an increasingly interconnected world, cybersecurity is no longer optional—it is essential. Whether through regulatory reform, AI-driven defences, or fostering a culture of preparedness, the steps taken today will define Canada’s ability to thrive in the face of tomorrow’s threats.