https://cyberphore.com/blog/ Expert analysis and daily briefings on cybersecurity for Canadian businesses. en-ca https://cyberphore.com/logo.pnghttps://cyberphore.com/blog/ Sat, 14 Nov 2026 12:00:00 GMT https://cyberphore.com/blog/ai-phishing-deepfake-payment-fraud-canada/ https://cyberphore.com/blog/ai-phishing-deepfake-payment-fraud-canada/ Sat, 14 Nov 2026 12:00:00 GMT Generative AI lets fraudsters write flawless, personalized phishing at scale, clone an executive's voice and even stage live deepfake video calls. Canadian Anti-Fraud Centre data show spear phishing losses rising sharply in 2026. Because people cannot reliably spot synthetic voices or faces, finance teams should rely on process: call-backs to known numbers, dual approval and strict rules for banking changes. Cyberphore Security Team AI and emerging threats deepfake fraud voice cloning business email compromise phishing payment fraud https://cyberphore.com/blog/bill-c-8-critical-cyber-systems-suppliers/ https://cyberphore.com/blog/bill-c-8-critical-cyber-systems-suppliers/ Sat, 14 Nov 2026 12:00:00 GMT Bill C-8 received royal assent on June 15, 2026. Its telecommunications amendments are in force, but the Critical Cyber Systems Protection Act is not yet in force and no operators are designated. Once they are, banks, telecoms, energy and transport operators must manage supply chain risk and report incidents within 72 hours, so their suppliers should expect tighter contracts, questionnaires and notice clauses. Cyberphore Security Team Compliance and certification bill c-8 ccspa critical infrastructure third-party risk incident reporting https://cyberphore.com/blog/canada-cyber-threats-small-business-2026/ https://cyberphore.com/blog/canada-cyber-threats-small-business-2026/ Sat, 14 Nov 2026 12:00:00 GMT For most Canadian small and mid-sized businesses, the threats that matter in 2026 are financially motivated: ransomware and data extortion, payment fraud through spoofed or compromised email, and AI-assisted impersonation, often entering through suppliers or unpatched edge devices. State actors matter mainly to firms in research, defence and government supply chains. The response starts with MFA, patching, tested backups and payment verification. Cyberphore Security Team Threat landscape cyber threats ransomware business email compromise ai fraud supply chain small business https://cyberphore.com/blog/mdr-provider-canada-how-to-choose/ https://cyberphore.com/blog/mdr-provider-canada-how-to-choose/ Sat, 14 Nov 2026 12:00:00 GMT Choose an MDR provider on five things: what it is allowed to contain without waiting for you, how it defines and reports response time, who staffs nights and weekends, where your logs and telemetry are stored, and how cleanly you can exit. Under PIPEDA you stay accountable for data a provider processes, and Quebec requires a privacy impact assessment before personal information leaves the province. Cyberphore Security Team Choosing security services mdr managed security data residency vendor selection privacy law https://cyberphore.com/blog/cpcsc-defence-suppliers-levels-timeline/ https://cyberphore.com/blog/cpcsc-defence-suppliers-levels-timeline/ Sat, 14 Nov 2026 12:00:00 GMT The Canadian Program for Cyber Security Certification (CPCSC) sets cyber security requirements for suppliers handling specified information on Canadian defence contracts. Level 1, an annual self-assessment of 13 controls from ITSP.10.171, has been available since April 1, 2026 and appears in select contracts. Levels 2 and 3 are still under development, with phased introduction signalled from spring 2027. Cyberphore Security Team Government and defence suppliers cpcsc defence itsp.10.171 cmmc certification https://cyberphore.com/blog/cyber-insurance-renewal-canada-2026/ https://cyberphore.com/blog/cyber-insurance-renewal-canada-2026/ Sat, 14 Nov 2026 12:00:00 GMT Canadian cyber insurance is a buyer's market heading into 2027: rates kept falling through 2026 and capacity is ample. Insurers still price on controls. Underwriters expect multi-factor authentication, endpoint detection, secure and tested backups, patching and an incident response plan, plus staff training and third-party risk management. The best terms go to organizations that can show evidence, not just tick boxes. Cyberphore Security Team Cyber insurance cyber insurance renewal mfa edr backup incident response https://cyberphore.com/blog/microsoft-365-account-takeover-controls/ https://cyberphore.com/blog/microsoft-365-account-takeover-controls/ Sat, 14 Nov 2026 12:00:00 GMT Most Microsoft 365 account takeovers now get around multifactor authentication rather than break it: attackers steal session tokens through adversary-in-the-middle phishing, abuse device code sign-in, wear users down with push prompts or trick them into approving malicious apps. Phishing-resistant MFA enforced by conditional access, blocked device code flow, restricted app consent and monitoring for inbox rules close most of those paths. Cyberphore Security Team Email, identity and Microsoft 365 microsoft 365 account takeover mfa conditional access business email compromise https://cyberphore.com/blog/quebec-law-25-enforcement-guidance-2026/ https://cyberphore.com/blog/quebec-law-25-enforcement-guidance-2026/ Sat, 14 Nov 2026 12:00:00 GMT All of Quebec Law 25 has been in force since September 22, 2024. The Commission d'accès à l'information reported no administrative monetary penalties and no penal fines for its 2025 to 2026 fiscal year, but confidentiality incident notices and complaints keep rising, and its recent published decisions have ended in binding orders. The CAI says the law covers any business handling Quebecers' personal information. Cyberphore Security Team Privacy law and breach response quebec law 25 privacy law cai breach reporting compliance https://cyberphore.com/blog/ransomware-canada-attacks-recovery-paying/ https://cyberphore.com/blog/ransomware-canada-attacks-recovery-paying/ Sat, 14 Nov 2026 12:00:00 GMT Ransomware remains one of the most disruptive cyber threats facing Canadian organizations. Most attacks start with phishing, stolen credentials or unpatched edge devices, and encryption usually lands outside business hours. Many organizations recover within weeks, but some take months. The Cyber Centre leaves payment to the victim, warns it guarantees nothing and notes it may breach sanctions or other laws. Preparation decides the outcome. Cyberphore Security Team Ransomware and extortion ransomware incident response backup sanctions privacy breach https://cyberphore.com/blog/small-business-security-baseline-12-controls/ https://cyberphore.com/blog/small-business-security-baseline-12-controls/ Sat, 14 Nov 2026 12:00:00 GMT A practical security baseline for a Canadian small business is 12 controls drawn from the Canadian Centre for Cyber Security's baseline for small and medium organizations, the same control areas behind CyberSecure Canada certification. Start with MFA, automatic patching, tested offline backups and an incident response plan, then add access control, email, network, supplier and device controls. Verify each with evidence, not assurances. Cyberphore Security Team Small business security small business baseline controls cybersecure canada mfa backup compliance