{"id":1600635,"date":"2025-11-14T16:00:54","date_gmt":"2025-11-14T21:00:54","guid":{"rendered":"https:\/\/observer.com\/?p=1600635"},"modified":"2025-11-14T15:56:21","modified_gmt":"2025-11-14T20:56:21","slug":"canada-cybersecurity-digital-sovereignty","status":"publish","type":"post","link":"https:\/\/observer.com\/2025\/11\/canada-cybersecurity-digital-sovereignty\/","title":{"rendered":"Cyber Sovereignty at Risk: How Geopolitics Are Shaping Canada\u2019s Digital Security"},"content":{"rendered":"
\"An
From ransomware to quantum disruption, Canada must take urgent steps to defend its institutions and build long-term cyber capacity. Observer Labs<\/span><\/figcaption><\/figure>\n

This Q&A is part of Observer\u2019s Expert Insights<\/span><\/a>\u00a0series, where industry leaders, innovators and strategists distill years of experience into direct, practical takeaways and deliver clarity on the issues shaping their industries. At a moment when cyber threats are escalating alongside geopolitical tensions, Canada finds itself at a crossroads: how to defend its digital infrastructure, protect its economy and maintain global competitiveness while preserving the values of an open, democratic society.<\/p>\n

Judith Borts, senior director of the Rogers Cybersecure Catalyst at Toronto Metropolitan University, <\/b>sits at the intersection of policy, security and economic strategy. With a career spanning provincial economic development, national innovation policy and cross-sector collaboration, Borts has become one of Canada\u2019s most vocal advocates for treating cybersecurity not as a niche technical specialty but as a shared societal responsibility\u2014one that will determine the country\u2019s digital sovereignty in the years ahead.<\/p>\n

Her work at the Catalyst focuses on building the talent, partnerships and operational capacity Canada needs to withstand increasingly sophisticated attacks. But it\u2019s her policy background that gives her a panoramic view of what\u2019s at stake. Canada, she argues, can no longer afford a reactive approach to cyber risk. Nation-state adversaries, criminal networks and A.I.-accelerated threats are moving faster than traditional governance models can respond, and the downstream costs to Canadians are already enormous.<\/p>\n

Borts outlines where Canada is falling behind global peers, what a truly unified national cyber strategy would require and why talent development may ultimately matter more than any single technological breakthrough. She also offers a candid look at the sectors most vulnerable today, the policies needed to strengthen resilience and how emerging technologies like A.I. and quantum computing will reshape the country\u2019s digital future. Canada\u2019s prosperity increasingly depends on something once viewed as purely defensive: a secure and trusted digital ecosystem.<\/p>\n

With global alliances shifting and the U.S. pulling back from international cooperation, how are these geopolitical tensions directly reshaping Canada\u2019s cybersecurity priorities and its role in intelligence-sharing networks?<\/b><\/h3>\n

Even as global alliances shift, intelligence sharing through networks like the Five Eyes, G7 and NATO remains strong. That\u2019s not really where Canada\u2019s biggest challenge is. What we really need to zero in on is building our own sovereign defence and resilience\u2014including in the cyber and digital domains\u2014so we can protect ourselves, respond quickly when threats come up and recover safely and securely.<\/span><\/p>\n

Cyberattacks today can come from anywhere (foreign governments, organized groups or even individuals), and they pose real risks to Canadian institutions, businesses and citizens. Our national security and defence strategies need to reflect that reality. We need to invest more in homegrown talent and innovation, from cybersecurity research to advances in A.I. and quantum technologies, so that Canada can stay ahead of the curve. <\/span>It\u2019s not about losing trust in our allies; it\u2019s about maintaining our strong relationships while also making sure we have the strength and resilience to stand on our own when it matters most.<\/span><\/p>\n

Which Canadian sectors are most exposed to cyber risk, and how prepared are they to defend against the sophisticated attacks we\u2019re seeing today?<\/b><\/h3>\n

Every sector in Canada, as well as around the world, is exposed to cyber risk. Healthcare continues to face some of the most visible and alarming threats. Ransomware attacks have forced hospitals to cancel surgeries and even shut down emergency systems, putting patient safety directly at risk. The energy sector is another major target. And what used to be mainly about stealing data has now shifted to attempts to interfere with the systems that keep our power grid running. As our digital and physical infrastructure becomes more connected, those risks multiply and even a single successful attack can throw essential services across the country into chaos.<\/span><\/p>\n

Canada\u2019s economy is powered by small and medium-sized businesses, which make up about <\/span>99 percent of all companies<\/span><\/a>\u00a0in the country and account for more than half of the country\u2019s GDP. These companies are increasingly being targeted but often lack the specialized staff, training and resources to respond effectively. Plus, the impacts of a ransomware attack on an SMB’s bottom line can be massive.\u00a0<\/span><\/p>\n

We\u2019re seeing progress in some areas, but these are still isolated efforts. Real national cybersecurity and resilience mean a coordinated approach, one that brings strong security standards together with real investment in education, innovation and long-term capacity building. That\u2019s how we keep Canada\u2019s economy secure and competitive in the years ahead.<\/span><\/p>\n

What specific policy mechanisms are needed to create a unified national cyber strategy that also respects Canada\u2019s diverse regional priorities?<\/b><\/h3>\n

A top-down approach alone won\u2019t keep up with how fast threats evolve or be able to address the practical needs of all regions. Real resilience comes from bringing federal, provincial and local efforts together so we can build safe and secure communities, share information faster, respond in real time and build trust across sectors.<\/span><\/p>\n

We also need to make it easier for Canadian businesses to operate securely, both at home and abroad. That means creating a more harmonized and less fragmented set of cyber standards and compliance requirements, so companies aren\u2019t forced to navigate a maze of conflicting rules across jurisdictions. Taking a more unified approach that integrates leading global approaches and consistent standards would help Canada stay internationally competitive while keeping our digital ecosystem strong and secure.<\/span><\/p>\n

In a nutshell, the federal government should set the national vision and provide the framework and tools while empowering local governments, organizations and innovators to adapt that framework to their realities. When everyone works from the same playbook, security can become part of how we do business\u2014not a barrier to it.<\/span><\/p>\n

As cyber threats evolve, is Canada keeping pace with peers like the U.S. and the E.U. in building defensive capabilities, or are governance gaps holding it back?<\/b><\/h3>\n

It\u2019s an exciting time for cybersecurity in Canada, but the truth is we\u2019re not yet keeping pace with our peers. The United States invests close to <\/span>$800 billion or 3.5 percent of GDP<\/a> annually in research and development, while Canada spends less than <\/span>2 percent of ours<\/span><\/a>, and only a fraction of that goes toward cyber and defense innovation. <\/span>That gap matters. The European Union, meanwhile, approaches cybersecurity not just as a security issue but as a pillar of economic resilience, seeing digital protection and competitiveness as two sides of the same coin.\u00a0<\/span><\/p>\n

Canada has world-leading talent in cybersecurity, A.I. and quantum. We are also building a strong foundation with proposed legislation like the Critical Cyber Systems Protection Act (Bill C-8) and a growing base of innovation, but we need to move faster\u2014connecting our federal, provincial and municipal strategies, strengthening our talent pipeline and investing in homegrown technology. If we treat cybersecurity as both national defence and economic opportunity, we can close the gap and position Canada as a real leader in the digital future.<\/span><\/p>\n

What are the most critical lessons from recent high-profile cyberattacks, and how should they guide efforts to build systemic resilience?<\/b><\/h3>\n

If there\u2019s one thing recent cyberattacks have taught us, it\u2019s that we need to wake up. No one is really paying attention to how serious this has become. We\u2019re seeing massive fraud and data theft happening quietly, every day, and too often the response is weak at best. The impacts are not only felt at the victim\u2019s level; the burden of the costs to Canadians is enormous, and we\u2019re all paying for this.\u00a0<\/span><\/p>\n

And still, people aren\u2019t changing their passwords, companies still skip basic protections like multi-factor authentication, and we\u2019ve normalized the idea that our data will be stolen eventually. That has to change.<\/span><\/p>\n

There\u2019s a common mantra in the cyber community that when it comes to cyber threats: \u2018it\u2019s not if, but when.\u2019 But the lesson isn\u2019t that attacks are inevitable. It\u2019s that we need to take preventative action and prepare for potential threats. Complacency is our biggest weakness.\u00a0<\/span><\/p>\n

We can\u2019t treat cybersecurity as background noise while we rush to adopt new technologies like A.I. A.I. can make systems smarter, but it also makes cyber threats faster, more targeted and harder to detect. At the same time, many organizations are adopting A.I. without fully addressing the very real risks that come with it. Every organization embracing A.I. should be asking: Are we doing this in a way that keeps us secure and our clients\/customers safe?<\/span><\/p>\n

True resilience isn\u2019t about specific actions by a cyber team; it\u2019s about how fast and effectively we respond and how seriously we take the responsibility to protect ourselves in the first place.<\/span><\/p>\n

What role should partnerships between universities, public institutions, government, private industry and Canadian tech companies play in building national cyber resilience?<\/b><\/h3>\n

No single group can solve Canada\u2019s cybersecurity challenges on its own\u2014the threats are too complex, the digital infrastructure is too vast and diverse and the stakes are too high. True resilience depends on everyone working together: universities driving research and developing talent, government providing intelligence, guidance and coordination, industry building secure systems and helping to generate specialized talent and Canadian tech companies pushing innovation forward.<\/span><\/p>\n

But collaboration can\u2019t just happen in boardrooms or policy papers: we also have to meet Canadians where they are. <\/span>Digital resilience and cyber awareness are no longer specialized skills; they are now basic workplace essentials. Everyone, regardless of their role, needs to understand how to protect information, manage digital tools responsibly, and remain vigilant to evolving threats. If we\u2019re going to reach everyone, it<\/span> means finding more creative and practical ways to weave cyber awareness and digital resilience into everyday life, whether that\u2019s through local community programs, small business training or more accessible education.\u00a0<\/span><\/p>\n

When universities, public institutions, government, and industry connect directly with Canadians, cybersecurity stops being an abstract concept and becomes something everyone can take part in.<\/span><\/p>\n

That whole-of-society approach is no longer optional. It\u2019s literally the foundation of our national resilience.<\/span><\/p>\n

How does developing a skilled and diverse cybersecurity workforce contribute to Canada\u2019s digital sovereignty and long-term competitiveness?<\/b><\/h3>\n

When we talk about securing Canada\u2019s digital future, the real advantage isn\u2019t just in technology; it\u2019s in people. We need Canadians to protect what matters to Canada and build a robust digital infrastructure that we can rely on to keep our economy and country growing in the face of mounting threats.\u00a0 <\/span>This requires a trustworthy and capable workforce. At the Catalyst, we have no delusions about the impacts of A.I. on cybersecurity work. The key question is: what does a skilled cybersecurity workforce look like in the age of A.I.?<\/span><\/p>\n

We are hyper-focused on creating not only skilled cybersecurity professionals, but also helping those in other organizational roles across different sectors to better understand the cybersecurity challenges they are facing while maintaining a keen eye on emerging technologies such as A.I. and quantum computing. Through our programs, we\u2019re building job-ready professionals who can address the human, organizational and technical issues of cybersecurity.\u00a0<\/span><\/p>\n

But in an era where A.I. can automate certain technical functions, the real challenge\u2014and opportunity\u2014is in ensuring that we have an agile workforce and that we educate and support individuals in exercising judgment, creativity, critical thinking, contextual understanding and ethical reasoning that machines can\u2019t replicate.\u00a0<\/span><\/p>\n

It\u2019s like asking how you maintain a community of great writers when A.I. can draft a paragraph for you: the value shifts to insight, empathy, strategy and human perspective.<\/span><\/p>\n

How can Canada\u2019s cyber strategy link security, innovation and economic growth?<\/b><\/h3>\n

For too long, we’ve talked about cybersecurity as a purely defensive measure. Many still view it as just the cost of doing business. The truth is, in the modern economy, cybersecurity is an investment, and resilience is one of our biggest competitive advantages. It’s the bedrock of national prosperity and our ticket to maintaining our position as a serious player on the global stage.<\/span><\/p>\n

Think about it: when we create an environment built on digital trust, with infrastructure that is both robust and secure, everything else follows. It\u2019s what gives international partners the confidence to invest here, and it\u2019s what gives our own innovators in critical sectors like finance, healthcare and technology the secure launchpad they need to bring their best ideas to life.\u00a0<\/span><\/p>\n

So, the critical question is, how do you intentionally build that kind of environment? It doesn’t happen by accident, and it can\u2019t rest solely on a policy or a plan. It only comes about through action.<\/span><\/p>\n

By combining smart government policies and strong intellectual property and patent protections with real incentives for our businesses, we stop treating cybersecurity as a problem to be solved and start seeing it for what it is: a massive opportunity to build our next generation of tech leaders and secure Canada’s role as an innovator.<\/span><\/p>\n

How will emerging technologies such as A.I. and quantum computing reshape Canada\u2019s cybersecurity landscape, and what must be done now to ensure a secure, sovereign, and competitive digital ecosystem by 2030?<\/b><\/h3>\n

A.I. is rewriting the cybersecurity landscape, and quantum computing won\u2019t be far behind. Each one presents both huge opportunities and serious threats. As these technologies start to converge, we will see incredible new possibilities and potential, but also significant power to cause real damage if we\u2019re not prepared.<\/span><\/p>\n

A.I. is now an arms race. For every advanced risk detection model we create, our adversaries are using A.I. to launch attacks. And quantum computing is the horizon. This will threaten most of the common encryption used today.\u00a0<\/span><\/p>\n

This new reality demands a strategic change, including what the industry calls the \u201cshift-left approach.\u201d Traditionally, security testing happened at the end of a project, just before the software was released. Shift-left flips that model by pushing security earlier in the development cycle\u2014essentially \u201cshifting\u201d it to the left on the project timeline.\u00a0<\/span><\/p>\n

For example, instead of waiting until a new system is fully built to check for vulnerabilities, developers should build security into the design on day one, and then test for risks at each step. This approach comes from modern software engineering, but it\u2019s now essential for cybersecurity: if emerging technologies like A.I. aren\u2019t built with security-by-design, we\u2019re already behind.\u00a0<\/span><\/p>\n

Ultimately, by investing in talent, targeting the best in R&D, and investing in an innovative ecosystem, Canada can make sure we\u2019re not just reacting to technological change but we are leading the change.\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Drawing on a background in law, public policy and cybersecurity program leadership, Judith Borts brings a wide-angle view to Canada\u2019s escalating digital risks. In this Expert Insights Q&A, she explores how talent pipelines, modern governance frameworks and innovation in fields like A.I. and quantum will shape Canada\u2019s ability to defend itself and compete on the global cyber stage.<\/p>\n Read More<\/a>","protected":false},"author":177935337,"featured_media":1600663,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"apple_news_api_created_at":"","apple_news_api_id":"","apple_news_api_modified_at":"","apple_news_api_revision":"","apple_news_api_share_url":"","apple_news_cover_media_provider":"image","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_cover_video_id":0,"apple_news_cover_video_url":"","apple_news_cover_embedwebvideo_url":"","apple_news_is_hidden":"","apple_news_is_paid":"","apple_news_is_preview":"","apple_news_is_sponsored":"","apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":[],"apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false},"post_tag":[423807055,423983108,423989104,423986742,79583],"company":[],"channel":[186,12374,423806427,423874676,423875639,423875666],"location":[],"nyo_column":[423982261],"person":[],"nyo_post_hidden":[],"coauthor":[424004583],"class_list":{"0":"post-1600635","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"tag-cybersecurity","8":"tag-economic-experts","9":"tag-observer-labs","10":"tag-policy-experts","11":"tag-quantum-computing","12":"channel-business","13":"channel-artificial-intelligence","14":"channel-finance","15":"channel-policy","16":"channel-economy","17":"channel-technology","18":"nyo_column-expert-insights","19":"style-expert-insights"},"acf":{"homepage_position":"","homepage_title":"","homepage_excerpt":"","alternative_og_image":"","headline":{"seo_headline":""},"subheadline":{"optimized_seo_description":"","optimized_social_excerpt":""}},"apple_news_notices":[],"parsely":{"version":"1.1.0","canonical_url":"https:\/\/observer.com\/2025\/11\/canada-cybersecurity-digital-sovereignty\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":[],"rendered":"","tracker_url":"https:\/\/cdn.parsely.com\/keys\/observer.com\/p.js"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/observer.com\/wp-content\/uploads\/sites\/2\/2025\/11\/Canadian-cybersecurity.jpg?quality=80","coauthors_byline":"By Judith Borts","display_channel":"","thumbnail":"\"An