Knowledge base
Straight Answers ToReal Security Questions.
Practical answers for Canadian business owners and IT leads. Short answer first, detail after.
- Straight answers
- 45
- No sign-up needed
- Free
- Law and context
- Canadian
Do I have to report a data breach in Canada?
Short answer
Under PIPEDA, yes, if the breach creates a real risk of significant harm. Report to the Privacy Commissioner, notify affected people, and keep a record for 24 months.
- What is Quebec Law 25?→
- Should we pay the ransom?→
- Is SMS MFA good enough?→
Certified partner of
Find an answer
45 Questions, Answered in Plain Language
Each answer opens with a short answer you can act on, then the detail. Search, or jump to a topic.
Incident Response
7 answers
- How long does it take to recover from a ransomware attack?Recovery from ransomware usually takes days to weeks to restore core operations, and often months to finish rebuilding, investigating and hardening. The biggest factors are whether clean, immutable backups exist, how far the attackers spread, whether the insurer and incident responders are engaged quickly, and whether there is a tested incident response plan. Paying a ransom rarely makes recovery much faster, since decryption is slow and unreliable.
- Should we pay the ransom after a ransomware attack?Canadian authorities, including the Canadian Centre for Cyber Security and the RCMP, recommend against paying ransoms. Payment does not guarantee working decryption or deletion of stolen data, it funds further crime and it can mark you for repeat attacks. Paying is not generally illegal in Canada, but sanctions laws may prohibit payments to certain groups. Any decision should involve counsel, your insurer and experienced incident responders.
- What is a tabletop exercise in cybersecurity?A cybersecurity tabletop exercise is a facilitated discussion in which leaders and key staff walk through a realistic attack scenario, such as ransomware or a fraudulent wire transfer, to test their incident response plan. Participants talk through decisions step by step without touching live systems. A typical session runs two to three hours, reveals gaps in roles, contacts and procedures, and produces a short list of improvements.
- What is an incident response plan and what should it include?An incident response plan is a written, tested set of procedures that tells your organization how to detect, contain, investigate, recover from and report a cybersecurity incident. A small business plan should name the response team and decision-makers, list external contacts such as the insurer, IT provider, lawyer and incident responders, define severity levels, include playbooks for common incidents and cover breach notification duties. Keep a copy offline.
- What should I do if a Microsoft 365 email account has been hacked?If a Microsoft 365 account is hacked, reset the password, revoke all sessions and refresh tokens, remove any MFA methods and devices the attacker added, delete malicious inbox rules and forwarding, review and remove suspicious app consents, then search the audit log to see what was accessed and sent. Warn contacts who may have received fraudulent emails, and assess whether personal information was exposed and must be reported.
- What should I do if I clicked a phishing link?If you clicked a phishing link, report it to IT or your security provider immediately. If you entered a password, change it from a trusted device, revoke active sessions and check for new MFA methods and inbox rules. If you downloaded or opened a file, disconnect the device from the network but do not turn it off. Speed matters most: reporting within minutes can stop an account takeover.
- Who do I call after a cyber attack in Canada?After a cyber attack in Canada, call your cyber insurer's breach hotline first if you have coverage, then your incident response provider and IT provider to contain the attack, and a privacy lawyer to guide reporting. Call your bank immediately if money was sent. Report the incident to local police, the Canadian Anti-Fraud Centre and the Canadian Centre for Cyber Security, and to privacy regulators if required.
Threats and Attacks
8 answers
- How are criminals using AI deepfakes to scam businesses?Criminals use AI deepfakes to impersonate executives, suppliers or job candidates with cloned voices, fake video calls and synthetic documents. The usual goal is an urgent payment, a change of banking details or access to systems. Seconds of public audio can be enough to clone a voice. The defence is process: verify any money or access request through a separate, pre-agreed channel, regardless of how real the caller seems.
- How do I spot a phishing email?Spot a phishing email by checking for an unexpected request, pressure to act quickly, a sender address or link domain that does not match the real organization, a login page reached from an email link, or requests to change payment details. Modern phishing is often well written and may come from a real but hacked account, so verify unusual requests through a separate channel before acting.
- How does ransomware get into a business network?Ransomware usually gets into a business through stolen or guessed passwords on remote access, unpatched internet-facing systems such as VPNs and firewalls, phishing emails that install malware, or a compromised IT supplier. Attackers then spend days or weeks moving through the network, stealing data and disabling backups before encrypting files. Closing those entry points and detecting the activity in between is what prevents most attacks.
- What is a Microsoft 365 account takeover and how does it happen?A Microsoft 365 account takeover is when an attacker gains control of a user's Microsoft 365 account, usually by stealing the password and session through a phishing page, password spraying or infostealer malware. Once in, they read email, create hidden inbox rules, send fraud from the real mailbox and access OneDrive and SharePoint. Phishing-resistant MFA, conditional access and sign-in monitoring are the main defences.
- What is a supply chain attack in cybersecurity?A supply chain attack is a cyberattack that reaches its targets through a trusted third party, such as a software vendor, managed IT provider, cloud service or supplier, rather than attacking them directly. Examples include malicious software updates, compromised remote management tools and hacked supplier email accounts. For small businesses, the most common version is an attacker abusing an IT provider's access or a vendor's hacked mailbox.
- What is business email compromise?Business email compromise (BEC) is a fraud in which a criminal uses a hacked or impersonated email account to trick staff into sending money or sensitive data. Typical versions are fake supplier invoices, changed banking details and urgent payment requests from a spoofed executive. BEC usually involves no malware, so antivirus rarely catches it. Payment verification by phone and phishing-resistant MFA are the strongest defences.
- What is shadow AI and is it a risk for my business?Shadow AI is employees using AI tools such as chatbots, browser extensions, meeting transcribers or coding assistants without IT approval or oversight. The risk is that confidential client data, personal information or source code ends up in services your business has not vetted, which can breach privacy laws like PIPEDA and Quebec Law 25. Approving safe tools and setting a clear usage policy works better than outright bans.
- Why do hackers target small businesses?Hackers target small businesses because most attacks are automated and opportunistic, and SMBs often have weaker defences, no overnight monitoring and limited IT staff. Small firms still hold money, payroll, client data and access to larger partners. Criminals use stolen passwords, phishing and unpatched systems at scale, then pick whoever is easiest. Being small does not make you invisible, it makes you easier.
Defence and Operations
8 answers
- What is the difference between EDR, XDR and MDR?EDR (endpoint detection and response) monitors laptops and servers for suspicious behaviour and allows remote response. XDR (extended detection and response) applies the same idea across endpoints, email, identity, cloud and network, correlating signals in one place. MDR (managed detection and response) is a service in which a provider's analysts run these tools for you 24/7 and respond to threats. EDR and XDR are tools; MDR is people.
- How do I secure Microsoft 365?To secure Microsoft 365, enforce MFA for every account, use phishing-resistant MFA for administrators, block legacy authentication, apply conditional access policies, separate admin accounts from daily accounts, enable Defender for Office 365 email protections, publish SPF, DKIM and DMARC, restrict third-party app consent, confirm audit logging is on, and have someone monitor sign-in and mailbox alerts. Business Premium licensing includes most of these controls.
- How should a small business back up data to survive ransomware?A small business should follow the 3-2-1 rule: keep three copies of important data, on two different types of storage, with one copy offsite. To survive ransomware, at least one copy must be immutable or offline so attackers cannot delete it, backup systems need separate credentials with MFA, Microsoft 365 data should be backed up separately, and restores must be tested regularly against agreed recovery time and recovery point objectives.
- Is antivirus enough for a small business?No, antivirus alone is not enough for a small business. Traditional antivirus blocks known malicious files, but most modern attacks use stolen passwords, phishing for Microsoft 365 sessions and legitimate admin tools that antivirus ignores. A small business needs at least MFA, endpoint detection and response (EDR) with someone monitoring it, email security, timely patching and tested backups. Antivirus is still useful as one layer.
- Is SMS MFA good enough, or do we need phishing-resistant MFA?SMS multi-factor authentication is much better than a password alone, but it is the weakest MFA method. Text codes can be phished, intercepted or redirected through SIM swapping. Authenticator apps with number matching are stronger for most staff. Administrators, finance staff and executives should use phishing-resistant MFA, such as FIDO2 security keys, passkeys or Windows Hello for Business, which cannot be captured by fake login pages.
- What is a security operations centre (SOC)?A security operations centre (SOC) is the team, processes and technology that monitor an organization's systems for cyber threats, investigate alerts and respond to incidents, usually 24 hours a day. A SOC typically uses a SIEM, EDR and threat intelligence, with analysts triaging alerts, hunting for threats and containing attacks. Most small and mid-sized businesses use an outsourced SOC rather than building their own.
- What is MDR?Managed detection and response (MDR) is an outsourced security service in which a provider's analysts monitor your endpoints, cloud accounts and network around the clock, investigate suspicious activity and take action to contain threats, such as isolating a device or disabling a compromised account. MDR combines detection technology, usually EDR, with a 24/7 human team, so small businesses get round-the-clock response without hiring their own security staff.
- What is zero trust?Zero trust is a security approach that assumes no user, device or network is trustworthy by default, even inside the office. Every access request is verified based on identity, device health and context, users get only the access they need, and activity is monitored continuously. For a small business, zero trust mostly means strong MFA, conditional access, managed devices, least privilege and replacing broad VPN access.
Compliance and Privacy
8 answers
- Do I have to report a data breach in Canada?Yes, in many cases. Under PIPEDA, private-sector organizations must report a breach of security safeguards involving personal information to the Office of the Privacy Commissioner of Canada and notify affected individuals when it creates a real risk of significant harm, and must keep records of all breaches for 24 months. Quebec (Law 25) and Alberta (PIPA) have their own mandatory reporting rules, and sector rules may add more.
- What is a SOC 2 report and do Canadian companies need one?A SOC 2 report is an independent CPA firm's report on a service organization's security controls, based on the AICPA Trust Services Criteria. A Type I report covers control design at a point in time; a Type II tests whether controls operated over a period, usually 3 to 12 months. No Canadian law requires SOC 2, but clients, especially American ones, often demand it from SaaS and service providers.
- What is Bill C-8 (the Critical Cyber Systems Protection Act) and does it apply to my business?Bill C-8 is federal legislation that amended the Telecommunications Act and enacted the Critical Cyber Systems Protection Act (CCSPA). It received royal assent in June 2026. The CCSPA applies to designated operators in federally regulated critical sectors, such as telecommunications, banking, pipelines, power lines, nuclear and transportation, requiring cyber security programs and incident reporting. Most SMBs are not directly covered, but suppliers to those operators will feel contractual pressure.
- What is CPCSC certification for Canadian defence suppliers?The Canadian Program for Cyber Security Certification (CPCSC) is a federal program requiring suppliers on certain Department of National Defence contracts to prove they protect sensitive unclassified information. It has three levels: Level 1 is an annual self-assessment, Level 2 an external assessment by an accredited certification body, and Level 3 the highest. Requirements are based on ITSP.10.171, the Cyber Centre's adaptation of NIST SP 800-171.
- What is CyberSecure Canada certification?CyberSecure Canada is a voluntary federal cybersecurity certification program for small and medium-sized organizations, run by Innovation, Science and Economic Development Canada (ISED). Certification shows that a business has implemented baseline security controls derived from the Canadian Centre for Cyber Security's guidance for SMBs, such as MFA, patching, backups, secure configuration and incident planning. Audits are carried out by certification bodies accredited by the Standards Council of Canada.
- What is PIPEDA and does it apply to my business?PIPEDA, the Personal Information Protection and Electronic Documents Act, is Canada's federal privacy law for the private sector. It applies to organizations that collect, use or disclose personal information in commercial activity, except within provinces with substantially similar laws, and always to federally regulated businesses and cross-border transfers. It requires consent, appropriate security safeguards, breach reporting to the Privacy Commissioner and breach record-keeping.
- What is Quebec Law 25?Quebec Law 25, formerly Bill 64, is the law that modernized Quebec's private-sector privacy act. It requires businesses to designate a person in charge of protecting personal information, report confidentiality incidents that pose a risk of serious injury to the Commission d'accès à l'information, keep an incident register, conduct privacy impact assessments and obtain clearer consent. Its requirements phased in between 2022 and 2024, with significant penalties.
- Which cybersecurity framework should a small business use?Most Canadian small businesses should start with the Canadian Centre for Cyber Security's baseline controls or CIS Controls Implementation Group 1, which give a practical, prioritized list of safeguards. Use NIST CSF 2.0 to organize and communicate your program to leadership. Pursue CyberSecure Canada, SOC 2, ISO 27001 or CPCSC only when customers, contracts or regulators require a formal certification or attestation.
Cyber Insurance
6 answers
- Does my small business need cyber insurance in Canada?Most Canadian small businesses that rely on email, hold client or employee personal information, or move money electronically benefit from cyber insurance. It pays for incident response, legal advice, breach notification, business interruption and liability claims that general liability policies usually exclude. It does not replace security controls, and insurers increasingly require MFA, EDR and backups before offering coverage. Some contracts also require it.
- How do I fill out a cyber insurance application questionnaire accurately?Answer a cyber insurance questionnaire by verifying each control against your actual systems, not policies or assumptions. Read words like all, every and enforced literally, involve your IT provider, gather evidence such as MFA and EDR coverage reports, and disclose gaps with remediation dates rather than ticking yes. Inaccurate answers can lead to denied claims, so have someone with technical knowledge review the final application.
- How can I lower my cyber insurance premiums?To lower cyber insurance premiums, implement the controls underwriters weigh most: MFA everywhere, EDR with 24/7 monitoring, immutable or offline backups that are tested, fast patching, removal of unsupported systems, email security and privileged access controls. Document them with evidence, start renewal early, answer applications precisely and work with a broker who knows the cyber market. Adjusting deductibles and limits can also change price.
- What does cyber insurance cover for a small business in Canada?Cyber insurance typically covers first-party costs such as incident response, forensic investigation, legal advice, breach notification, data restoration, business interruption and sometimes ransom or extortion payments, plus third-party liability for claims from clients, regulators and others after a breach. Coverage for social engineering fraud, contingent business interruption and regulatory fines varies widely, and many policies apply sublimits, waiting periods and exclusions.
- What does cyber insurance require in Canada?Canadian cyber insurers commonly require multi-factor authentication on email, remote access and admin accounts, endpoint detection and response (EDR) on all devices, secure and tested backups with an offline or immutable copy, timely patching, email filtering, security awareness training and an incident response plan. Many also ask about 24/7 monitoring, privileged account controls and end-of-life systems. Missing controls can mean higher premiums, exclusions or a declined application.
- Why do cyber insurance claims get denied?Cyber insurance claims are most often denied or reduced because the application overstated security controls, such as claiming MFA was on all remote access when it was not, because the insurer was notified late, because the business hired vendors without insurer consent, or because the loss falls under an exclusion or sublimit, such as social engineering fraud, war exclusions or prior known incidents. Accurate applications prevent most disputes.
Buying Security Services
8 answers
- Does security awareness training work?Security awareness training works when it is short, frequent, relevant to people's actual jobs and paired with easy reporting of suspicious messages. It reduces risky behaviour and speeds up detection, but it will never get mistakes to zero, so it must be combined with technical controls such as MFA and email filtering. Measure success by how quickly staff report phishing, not just by simulation click rates.
- How much does a penetration test cost in Canada?Penetration test pricing in Canada depends on scope: the number of external IP addresses, internal network size, web applications and their complexity, cloud environments, testing type and whether a retest is included. Tests are usually quoted as fixed-fee projects based on estimated tester days. A narrow external test costs far less than a combined internal, external and application assessment. Always compare quotes on scope and methodology, not price alone.
- How much does cybersecurity cost for a small business in Canada?Cybersecurity costs for a Canadian small business depend mainly on headcount, number of devices and servers, cloud footprint, compliance requirements and whether you need 24/7 monitoring. Managed security services are usually priced per user or per device per month, while assessments like penetration tests are fixed-fee projects. Prioritize MFA, monitored EDR, email security and backups first, since they address the most common attacks.
- Should a mid-sized business build an in-house SOC or outsource to a SOC as a service provider?Most Canadian businesses under about 1,000 employees should outsource their security operations centre. Running a 24/7 in-house SOC requires several analysts to cover every shift, vacation and sick day, plus a SIEM, EDR, threat intelligence and management, which costs far more than SOC as a service. An in-house SOC makes sense for large or highly regulated organizations; many mid-sized firms use a hybrid with internal staff and outsourced 24/7 coverage.
- What is the difference between an MSP and an MSSP?A managed service provider (MSP) runs your day-to-day IT: devices, servers, Microsoft 365, networks, help desk and backups. A managed security service provider (MSSP) specializes in security: 24/7 threat monitoring, detection and response, vulnerability management and compliance support. Many SMBs use both. The MSP keeps systems running and patched, while the MSSP watches for attacks and responds, including attacks that abuse the MSP's own access.
- What questions should I ask before choosing an MDR provider?Before choosing an MDR provider, ask what they monitor beyond endpoints, whether analysts can take containment action or only alert you, how quickly they respond and how that is measured, who the analysts are and where they work, where your data is stored, whether incident response is included, how they work with your IT provider, what reports you receive, and how you exit the contract.
- What is the difference between a vulnerability scan and a penetration test?A vulnerability scan is an automated check that compares your systems against databases of known weaknesses, such as missing patches and misconfigurations, and should run continuously or at least monthly. A penetration test is a time-boxed exercise in which skilled testers manually try to exploit weaknesses, chain them together and show real business impact, usually done once a year or after major changes. Most businesses need both.
- What is a vCISO and does my business need one?A vCISO (virtual chief information security officer) is a part-time, outsourced security executive who sets an organization's security strategy, manages risk, oversees compliance and reports to leadership, without the cost of a full-time hire. A vCISO typically builds the security roadmap, writes policies, handles customer and insurer questionnaires, prepares for audits and guides incident decisions. It suits businesses of roughly 20 to 1,000 employees without a security leader.
No answer matches that search yet. Try a shorter word, browse the glossary, or ask a certified specialist.
Go deeper
In-Depth Guides
- Threats and attacksBusiness Email Compromise in Canada: Stop Payment FraudRead the guide
- Cyber insuranceCyber Insurance Requirements in Canada: What Insurers AskRead the guide
- Compliance and privacyCyberSecure Canada Certification: A Practical Guide for SMBsRead the guide
- Buying security servicesMDR vs MSSP vs SOC as a Service: Which Do You Need?Read the guide
- Buying security servicesPenetration Testing Cost in Canada: What Drives the PriceRead the guide
- Compliance and privacyPrivacy Breach Response in Canada: Who to Notify and WhenRead the guide
- Compliance and privacySOC 2 Readiness for Canadian SaaS: A Practical GuideRead the guide
- Buying security servicesvCISO Cost in Canada: How Virtual CISO Services Are PricedRead the guide