{ "version": "https://jsonfeed.org/version/1.1", "title": "Cyberphore Blog", "home_page_url": "https://cyberphore.com/blog/", "feed_url": "https://cyberphore.com/blog/feed.json", "description": "Expert analysis and daily briefings on cybersecurity for Canadian businesses.", "icon": "https://cyberphore.com/apple-touch-icon.png", "favicon": "https://cyberphore.com/favicon.svg", "language": "en-CA", "authors": [ { "name": "Cyberphore", "url": "https://cyberphore.com" } ], "items": [ { "id": "https://cyberphore.com/blog/ai-phishing-deepfake-payment-fraud-canada/", "url": "https://cyberphore.com/blog/ai-phishing-deepfake-payment-fraud-canada/", "title": "AI-Powered Phishing and Deepfake Payment Fraud in Canada", "summary": "How generative AI changed phishing, BEC and deepfake voice fraud in Canada, what CAFC and Cyber Centre data show, and the controls finance teams need.", "content_text": "Generative AI lets fraudsters write flawless, personalized phishing at scale, clone an executive's voice and even stage live deepfake video calls. Canadian Anti-Fraud Centre data show spear phishing losses rising sharply in 2026. Because people cannot reliably spot synthetic voices or faces, finance teams should rely on process: call-backs to known numbers, dual approval and strict rules for banking changes.\n\nKey takeaways:\n- AI removed the spelling mistakes and awkward phrasing that staff were trained to look for in phishing.\n- Voice cloning and live deepfake video now support payment fraud, as the confirmed Arup case showed.\n- The CAFC recorded about $57.7 million in spear phishing losses in the first half of 2026, against more than $68 million for all of 2025.\n- Never verify a request on the channel it arrived on; call back on a number you already hold.\n- Dual approval and a written procedure for supplier banking changes remove the single point of failure these frauds exploit.\n- If money has moved, call your bank first, then report to police and the CAFC the same day.", "image": "https://cyberphore.com/blog/og/ai-phishing-deepfake-payment-fraud-canada.png", "banner_image": "https://cyberphore.com/blog/covers/ai-phishing-deepfake-payment-fraud-canada.png", "date_published": "2026-11-14T12:00:00Z", "date_modified": "2026-11-14T12:00:00Z", "authors": [ { "name": "Cyberphore Security Team", "url": "https://cyberphore.com/blog/authors/cyberphore-team/" } ], "tags": [ "AI and emerging threats", "deepfake fraud", "voice cloning", "business email compromise", "phishing", "payment fraud" ], "language": "en-CA" }, { "id": "https://cyberphore.com/blog/bill-c-8-critical-cyber-systems-suppliers/", "url": "https://cyberphore.com/blog/bill-c-8-critical-cyber-systems-suppliers/", "title": "Bill C-8 and Critical Cyber Systems: What Suppliers Must Do", "summary": "Bill C-8 status as of November 2026, who the Critical Cyber Systems Protection Act will cover, and how vendors to banks, telecoms and energy will feel it.", "content_text": "Bill C-8 received royal assent on June 15, 2026. Its telecommunications amendments are in force, but the Critical Cyber Systems Protection Act is not yet in force and no operators are designated. Once they are, banks, telecoms, energy and transport operators must manage supply chain risk and report incidents within 72 hours, so their suppliers should expect tighter contracts, questionnaires and notice clauses.\n\nKey takeaways:\n- As of November 14, 2026, Part 1 of Bill C-8 (Telecommunications Act) is in force and the Critical Cyber Systems Protection Act is enacted but not in force.\n- No classes of designated operators have been named yet: Schedule 2 of the Act is still empty.\n- Designated operators get 90 days to set up a cyber security program that must identify, manage and mitigate supply chain and third-party risk.\n- Operators must report cyber security incidents to the Communications Security Establishment within a period set by regulation, capped at 72 hours.\n- Most suppliers will never be designated, but they will feel the Act through contract clauses, security questionnaires, audit rights and short incident notice windows.\n- Suppliers to banks already face similar pressure today through OSFI Guideline B-10 on third-party risk.", "image": "https://cyberphore.com/blog/og/bill-c-8-critical-cyber-systems-suppliers.png", "banner_image": "https://cyberphore.com/blog/covers/bill-c-8-critical-cyber-systems-suppliers.png", "date_published": "2026-11-14T12:00:00Z", "date_modified": "2026-11-14T12:00:00Z", "authors": [ { "name": "Cyberphore Security Team", "url": "https://cyberphore.com/blog/authors/cyberphore-team/" } ], "tags": [ "Compliance and certification", "bill c-8", "ccspa", "critical infrastructure", "third-party risk", "incident reporting" ], "language": "en-CA" }, { "id": "https://cyberphore.com/blog/canada-cyber-threats-small-business-2026/", "url": "https://cyberphore.com/blog/canada-cyber-threats-small-business-2026/", "title": "Canada's Cyber Threats for SMBs in 2026: What Matters Most", "summary": "Canada's cyber threats for small and mid-sized businesses in 2026: what the Cyber Centre and current data say about ransomware, BEC, AI fraud and suppliers.", "content_text": "For most Canadian small and mid-sized businesses, the threats that matter in 2026 are financially motivated: ransomware and data extortion, payment fraud through spoofed or compromised email, and AI-assisted impersonation, often entering through suppliers or unpatched edge devices. State actors matter mainly to firms in research, defence and government supply chains. The response starts with MFA, patching, tested backups and payment verification.\n\nKey takeaways:\n- The Cyber Centre judges ransomware will remain a significant threat to Canada through 2027, and says every Canadian organization almost certainly risks being targeted at some point.\n- Scams and fraud were a method of attack for 55% of Canadian businesses hit by a cyber incident in 2025, according to Statistics Canada.\n- Spear phishing, which includes payment redirection and CEO impersonation, caused $67.9 million (CAD) in reported losses in 2025, second only to investment fraud.\n- AI is making phishing, impersonation and deepfakes cheaper and more convincing, so call-back verification matters more than spotting typos.\n- Managed service providers and edge devices such as firewalls and VPNs are recurring entry points named in Cyber Centre reporting.\n- Start with MFA, automatic patching, offline or immutable backups, payment verification and an incident response plan.", "image": "https://cyberphore.com/blog/og/canada-cyber-threats-small-business-2026.png", "banner_image": "https://cyberphore.com/blog/covers/canada-cyber-threats-small-business-2026.png", "date_published": "2026-11-14T12:00:00Z", "date_modified": "2026-11-14T12:00:00Z", "authors": [ { "name": "Cyberphore Security Team", "url": "https://cyberphore.com/blog/authors/cyberphore-team/" } ], "tags": [ "Threat landscape", "cyber threats", "ransomware", "business email compromise", "ai fraud", "supply chain", "small business" ], "language": "en-CA" }, { "id": "https://cyberphore.com/blog/mdr-provider-canada-how-to-choose/", "url": "https://cyberphore.com/blog/mdr-provider-canada-how-to-choose/", "title": "Choosing an MDR Provider in Canada: Questions and Red Flags", "summary": "How to choose an MDR provider in Canada: what MDR covers, response time definitions, 24/7 staffing, data residency, contract terms and a scoring checklist.", "content_text": "Choose an MDR provider on five things: what it is allowed to contain without waiting for you, how it defines and reports response time, who staffs nights and weekends, where your logs and telemetry are stored, and how cleanly you can exit. Under PIPEDA you stay accountable for data a provider processes, and Quebec requires a privacy impact assessment before personal information leaves the province.\n\nKey takeaways:\n- MDR should include 24/7 human investigation and pre-approved containment, but full incident response, recovery and breach notification work are often extra.\n- A response time promise means little until the contract defines when the clock starts, what counts as a response and what happens when it is missed.\n- Attackers move fast and often after hours, so verify who actually staffs the night shift and what they are authorized to do.\n- Under PIPEDA you remain accountable for personal information a provider processes, wherever it is stored, and Quebec requires a privacy impact assessment before sending it outside the province.\n- Check residency at every layer: the provider's platform, the underlying detection tools and any subcontractors.", "image": "https://cyberphore.com/blog/og/mdr-provider-canada-how-to-choose.png", "banner_image": "https://cyberphore.com/blog/covers/mdr-provider-canada-how-to-choose.png", "date_published": "2026-11-14T12:00:00Z", "date_modified": "2026-11-14T12:00:00Z", "authors": [ { "name": "Cyberphore Security Team", "url": "https://cyberphore.com/blog/authors/cyberphore-team/" } ], "tags": [ "Choosing security services", "mdr", "managed security", "data residency", "vendor selection", "privacy law" ], "language": "en-CA" }, { "id": "https://cyberphore.com/blog/cpcsc-defence-suppliers-levels-timeline/", "url": "https://cyberphore.com/blog/cpcsc-defence-suppliers-levels-timeline/", "title": "CPCSC for Defence Suppliers: Levels, Timeline, Preparation", "summary": "CPCSC explained for Canadian defence suppliers: the three levels, the 13 Level 1 controls, the latest timeline, the CMMC link and a preparation plan.", "content_text": "The Canadian Program for Cyber Security Certification (CPCSC) sets cyber security requirements for suppliers handling specified information on Canadian defence contracts. Level 1, an annual self-assessment of 13 controls from ITSP.10.171, has been available since April 1, 2026 and appears in select contracts. Levels 2 and 3 are still under development, with phased introduction signalled from spring 2027.\n\nKey takeaways:\n- CPCSC Level 1 has been live since April 1, 2026: an annual self-assessment of 13 controls drawn from the Cyber Centre's ITSP.10.171 standard.\n- Where a contract requires Level 1, proof of the self-assessment is needed at contract award, so starting after the bid is too late.\n- Level 2 will require an external assessment by a certification body accredited by the Standards Council of Canada; as of November 14, 2026, no firm date is confirmed.\n- CPCSC and U.S. CMMC share a NIST SP 800-171 lineage, but there is no automatic reciprocity, and Canada works from Revision 3 while CMMC still uses Revision 2.\n- Scoping where specified information lives is the single biggest lever on cost and effort.", "image": "https://cyberphore.com/blog/og/cpcsc-defence-suppliers-levels-timeline.png", "banner_image": "https://cyberphore.com/blog/covers/cpcsc-defence-suppliers-levels-timeline.png", "date_published": "2026-11-14T12:00:00Z", "date_modified": "2026-11-14T12:00:00Z", "authors": [ { "name": "Cyberphore Security Team", "url": "https://cyberphore.com/blog/authors/cyberphore-team/" } ], "tags": [ "Government and defence suppliers", "cpcsc", "defence", "itsp.10.171", "cmmc", "certification" ], "language": "en-CA" }, { "id": "https://cyberphore.com/blog/cyber-insurance-renewal-canada-2026/", "url": "https://cyberphore.com/blog/cyber-insurance-renewal-canada-2026/", "title": "Cyber Insurance Renewals in 2026: What Insurers Now Ask For", "summary": "Cyber insurance renewal in Canada for 2026: falling rates, the controls underwriters weigh (MFA, EDR, backups, IR plans, training) and the evidence to bring.", "content_text": "Canadian cyber insurance is a buyer's market heading into 2027: rates kept falling through 2026 and capacity is ample. Insurers still price on controls. Underwriters expect multi-factor authentication, endpoint detection, secure and tested backups, patching and an incident response plan, plus staff training and third-party risk management. The best terms go to organizations that can show evidence, not just tick boxes.\n\nKey takeaways:\n- Marsh reported global cyber rates down 4% in Q3 2026, the 13th consecutive quarterly decline, with reductions in every region except the United States.\n- IBC says Canadian insurers place significant weight on MFA, endpoint detection, backups, incident response planning, governance and third-party risk management.\n- Statistics Canada found 34% of businesses with 10 or more employees had cyber risk insurance in 2025, up from 22% in 2023.\n- Aon says business interruption losses are developing unfavourably and privacy claims are getting more expensive, so a soft market is the time to fix sublimits and retentions.\n- Bring dated evidence to renewal: MFA coverage reports, EDR deployment counts, a recent restore test and a tested incident response plan.", "image": "https://cyberphore.com/blog/og/cyber-insurance-renewal-canada-2026.png", "banner_image": "https://cyberphore.com/blog/covers/cyber-insurance-renewal-canada-2026.png", "date_published": "2026-11-14T12:00:00Z", "date_modified": "2026-11-14T12:00:00Z", "authors": [ { "name": "Cyberphore Security Team", "url": "https://cyberphore.com/blog/authors/cyberphore-team/" } ], "tags": [ "Cyber insurance", "cyber insurance", "renewal", "mfa", "edr", "backup", "incident response" ], "language": "en-CA" }, { "id": "https://cyberphore.com/blog/microsoft-365-account-takeover-controls/", "url": "https://cyberphore.com/blog/microsoft-365-account-takeover-controls/", "title": "Microsoft 365 Account Takeover: Attack Chain and Defences", "summary": "Microsoft 365 account takeover now bypasses basic MFA. The current attack chain, Microsoft's recommended controls, detection signals and a recovery checklist.", "content_text": "Most Microsoft 365 account takeovers now get around multifactor authentication rather than break it: attackers steal session tokens through adversary-in-the-middle phishing, abuse device code sign-in, wear users down with push prompts or trick them into approving malicious apps. Phishing-resistant MFA enforced by conditional access, blocked device code flow, restricted app consent and monitoring for inbox rules close most of those paths.\n\nKey takeaways:\n- Adversary-in-the-middle phishing captures session tokens in real time, so push, SMS and code-based MFA do not stop it.\n- Phishing-resistant methods (passkeys and FIDO2 keys, Windows Hello for Business, certificate-based authentication) are the control Microsoft points to for token phishing.\n- Block device code flow and legacy authentication unless a documented business need exists.\n- Limit user consent to verified publishers so a phishing link cannot hand a malicious app access to mailboxes.\n- A password reset alone does not end an attacker's session: revoke sessions, remove rules, apps and added MFA methods.", "image": "https://cyberphore.com/blog/og/microsoft-365-account-takeover-controls.png", "banner_image": "https://cyberphore.com/blog/covers/microsoft-365-account-takeover-controls.png", "date_published": "2026-11-14T12:00:00Z", "date_modified": "2026-11-14T12:00:00Z", "authors": [ { "name": "Cyberphore Security Team", "url": "https://cyberphore.com/blog/authors/cyberphore-team/" } ], "tags": [ "Email, identity and Microsoft 365", "microsoft 365", "account takeover", "mfa", "conditional access", "business email compromise" ], "language": "en-CA" }, { "id": "https://cyberphore.com/blog/quebec-law-25-enforcement-guidance-2026/", "url": "https://cyberphore.com/blog/quebec-law-25-enforcement-guidance-2026/", "title": "Quebec Law 25 in 2026: What the CAI's Enforcement Shows", "summary": "Quebec Law 25 enforcement so far: the CAI's penalty record, incident data, new guidance and what businesses outside Quebec with Quebec customers must do.", "content_text": "All of Quebec Law 25 has been in force since September 22, 2024. The Commission d'accès à l'information reported no administrative monetary penalties and no penal fines for its 2025 to 2026 fiscal year, but confidentiality incident notices and complaints keep rising, and its recent published decisions have ended in binding orders. The CAI says the law covers any business handling Quebecers' personal information.\n\nKey takeaways:\n- Every phase of Law 25 is in force: September 2022, September 2023 and September 2024.\n- The CAI reported no administrative monetary penalties or penal fines for April 2025 to March 2026.\n- The CAI received 526 confidentiality incident notices from April 1, 2025 to February 28, 2026; cyberattacks were the top declared cause.\n- Recent published CAI decisions ended in orders to stop collecting data, destroy records, adopt governance policies or report back, not in fines.\n- The CAI says the law applies to any business that collects, uses or communicates Quebecers' personal information.\n- Outside Quebec, PIPEDA still applies as of November 14, 2026; Bill C-36, the proposed federal reform, has not passed second reading.", "image": "https://cyberphore.com/blog/og/quebec-law-25-enforcement-guidance-2026.png", "banner_image": "https://cyberphore.com/blog/covers/quebec-law-25-enforcement-guidance-2026.png", "date_published": "2026-11-14T12:00:00Z", "date_modified": "2026-11-14T12:00:00Z", "authors": [ { "name": "Cyberphore Security Team", "url": "https://cyberphore.com/blog/authors/cyberphore-team/" } ], "tags": [ "Privacy law and breach response", "quebec law 25", "privacy law", "cai", "breach reporting", "compliance" ], "language": "en-CA" }, { "id": "https://cyberphore.com/blog/ransomware-canada-attacks-recovery-paying/", "url": "https://cyberphore.com/blog/ransomware-canada-attacks-recovery-paying/", "title": "Ransomware in Canada: Attacks, Recovery and Whether to Pay", "summary": "Ransomware in Canada: how attacks unfold, how long recovery really takes, the Cyber Centre's view on paying, sanctions risk and a readiness plan for SMBs.", "content_text": "Ransomware remains one of the most disruptive cyber threats facing Canadian organizations. Most attacks start with phishing, stolen credentials or unpatched edge devices, and encryption usually lands outside business hours. Many organizations recover within weeks, but some take months. The Cyber Centre leaves payment to the victim, warns it guarantees nothing and notes it may breach sanctions or other laws. Preparation decides the outcome.\n\nKey takeaways:\n- The Cyber Centre counted more Canadian ransomware incidents in 2024 than in 2023, and says the true number is almost certainly higher because of underreporting.\n- Statistics Canada reports that over four in five (84%) impacted Canadian businesses did not make a ransom payment in 2025.\n- In a 2026 Sophos survey, 55% of victims fully recovered within a week, but recovery still cost an average of USD 1.7 million excluding any ransom.\n- Paying may be unlawful under Canadian sanctions, terrorism or money laundering laws, and it does not remove privacy breach reporting obligations.\n- Offline, tested backups, phishing-resistant MFA, fast patching of edge devices and 24/7 monitoring do the most to shorten an incident.", "image": "https://cyberphore.com/blog/og/ransomware-canada-attacks-recovery-paying.png", "banner_image": "https://cyberphore.com/blog/covers/ransomware-canada-attacks-recovery-paying.png", "date_published": "2026-11-14T12:00:00Z", "date_modified": "2026-11-14T12:00:00Z", "authors": [ { "name": "Cyberphore Security Team", "url": "https://cyberphore.com/blog/authors/cyberphore-team/" } ], "tags": [ "Ransomware and extortion", "ransomware", "incident response", "backup", "sanctions", "privacy breach" ], "language": "en-CA" }, { "id": "https://cyberphore.com/blog/small-business-security-baseline-12-controls/", "url": "https://cyberphore.com/blog/small-business-security-baseline-12-controls/", "title": "SMB Security Baseline: 12 Controls That Stop Most Attacks", "summary": "A small business security baseline of 12 controls mapped to the Cyber Centre's baseline and CyberSecure Canada, with a simple way to verify each one.", "content_text": "A practical security baseline for a Canadian small business is 12 controls drawn from the Canadian Centre for Cyber Security's baseline for small and medium organizations, the same control areas behind CyberSecure Canada certification. Start with MFA, automatic patching, tested offline backups and an incident response plan, then add access control, email, network, supplier and device controls. Verify each with evidence, not assurances.\n\nKey takeaways:\n- The Cyber Centre designed its baseline controls for organizations with fewer than 500 employees and built them around cybercrime, the threat most likely to affect them.\n- Its stated aim is the 80/20 rule: most of the benefit for a fraction of the effort of a full framework.\n- The Cyber Centre says to start with four controls: an incident response plan, patching, strong authentication, and backed-up, encrypted data.\n- Each control below includes a verification step that produces evidence you could show an insurer, a client or an auditor.\n- ISED says it stopped being the CyberSecure Canada program authority on March 31, 2023 and refers organizations to the Standards Council of Canada; confirm the current standard edition with your certification body.", "image": "https://cyberphore.com/blog/og/small-business-security-baseline-12-controls.png", "banner_image": "https://cyberphore.com/blog/covers/small-business-security-baseline-12-controls.png", "date_published": "2026-11-14T12:00:00Z", "date_modified": "2026-11-14T12:00:00Z", "authors": [ { "name": "Cyberphore Security Team", "url": "https://cyberphore.com/blog/authors/cyberphore-team/" } ], "tags": [ "Small business security", "small business", "baseline controls", "cybersecure canada", "mfa", "backup", "compliance" ], "language": "en-CA" } ] }