AI is accelerating cyberattacks: Why Canada needs to prepare for a new era of digital risk

Artificial intelligence (AI) is changing the economics of cybercrime. Tasks that once demanded specialist expertise, substantial preparation and significant human effort can increasingly be assisted or automated by generative AI. The warning signs are becoming difficult to ignore. The UK’s National Cyber Security Centre (NCSC) has warned that AI is likely to increase the scale and efficiency of cyberattacks, including ransomware, social engineering and vulnerability exploitation. While the assessment concerns the UK, its implications extend well beyond British networks.

For Canada, where government, healthcare, financial services, energy and other critical sectors have become deeply dependent upon interconnected digital infrastructure, the same question arises: can cyber defence evolve as rapidly as cyber offence?

Canada already has reasons for concern. Communications Security Establishment Canada (CSE), which incorporates the Canadian Centre for Cyber Security, reported responding to more than 3,200 cybersecurity incidents affecting federal institutions and critical infrastructure during 2025-26 . Its National Cyber Threat Notification System sent more than 97,000 notifications to participating organisations. The figures provide an indication of the scale of the challenge confronting Canadian defenders. [digitaljournal.com]

AI does not necessarily need to produce entirely new forms of cyberattack to change the threat landscape. Its more immediate significance is its capacity to improve existing techniques. Generative systems can assist criminals in constructing convincing phishing messages, researching targets and generating content in multiple languages. AI can also support malware development and vulnerability research, potentially reducing the amount of time and expertise required to mount an attack.

This is already a prominent concern in Canada. The latest Canadian threat discussions have highlighted how AI can be used to identify vulnerabilities, produce more convincing phishing messages, research potential victims and automate processes used by threat actors . Canadian cybersecurity officials have described this as an increasing feature of the threat environment.

The consequence is important. An individual phishing email does not need to become dramatically more sophisticated for the threat level to rise. If AI allows criminals to create thousands of reasonably convincing personalised messages in the time previously required to develop dozens, the economics favour the attacker.

Deepfakes add another dimension. Voice and video generation technologies can undermine one of the oldest security mechanisms in business: recognising another human being. Recent attacks involving AI-generated voices have demonstrated how criminals can impersonate executives and trusted colleagues. This presents a particular problem for helpdesks, finance personnel and employees authorised to reset credentials, change payment details or move money.

As previously examined by Digital Journal , this means companies may need to reconsider processes which rely upon an employee simply recognising a familiar voice.

The financial impact is becoming clearer

Canadian companies are also receiving a costly lesson in why cyber resilience matters. An average Canadian data breach reached $7.11 million in 2026 , according to IBM’s Cost of a Data Breach research. The Canadian data also indicated that organisations required an average of 205 days to identify and contain a breach . Energy businesses recorded particularly high average breach costs of $9.21 million. Supply-chain compromises, security skills shortages and problems prioritising threats were among the factors increasing costs.

AI is appearing on both sides of this equation. More than a quarter of Canadian organisations covered by the research reported an AI-generated attack. At the same time, extensive use of AI and automation in security operations was associated internationally with substantially lower breach costs and faster detection and containment. This creates something resembling a technological arms race.

Attackers can use AI to increase speed and scale. Defenders can use similar technologies to examine network behaviour, triage alerts and identify anomalies. The difficulty is ensuring the defensive organisation can respond effectively when automated systems identify something requiring human judgement. This is particularly significant given evidence that security teams are already struggling with the volume of intelligence. Research reported by Digital Journal found that 65 percent of respondents regarded alert noise and false positives as a leading threat-intelligence challenge , while 55 percent cited insufficient analyst capacity. AI therefore risks accelerating attacks at precisely the point where defenders are already struggling to process information.

Businesses appear to recognise the problem. The Canadian Internet Registration Authority (CIRA) reported in its 2026 cybersecurity survey that 76 percent of Canadian organisations increased cybersecurity expenditure during the year . Yet only 67 percent felt their investment was sufficient to keep pace with emerging threats, down from 74 percent in 2025. More than eight in ten IT professionals surveyed expressed concern AI-enabled threats. CIRA surveyed more than 500 Canadian cybersecurity decision-makers across public and private organisations.

There are encouraging indications of preparedness. Some 87 percent of responding organisations had incident response plans and 82 percent carried cybersecurity insurance. Yet having documentation is different from demonstrating that an organisation can recover when systems actually become unavailable. That distinction becomes increasingly important as AI compresses the time available to defenders.

Moving from prevention to resilience

For Cynthia Overby, director of strategic security solutions, ZCOE, at Rocket Software, the response requires organisations to reconsider what effective cybersecurity looks like. “Building resilience in today’s threat landscape requires an entire ecosystem of defence,” she says.

The crucial question, according to Overby, should no longer simply be: “Are we protected?” Rather, organisations need to establish whether they understand their risks, whether defensive controls demonstrably work and whether operations can continue when something goes wrong.

That approach fits closely with Canada’s broader cybersecurity direction. The federal National Cyber Security Strategy emphasises partnership and resilience and is structured around protecting Canadians and Canadian businesses, strengthening Canada’s cybersecurity industry, and detecting and disrupting cyber-threat actors . The strategy also seeks greater cooperation between governments, business, Indigenous communities, academia and international partners. The issue is increasingly one of operational resilience rather than theoretical protection.

Organisations need to test backups rather than merely confirm that backups exist. Incident response exercises should test decision-making, communications and recovery under realistic conditions. High-risk activities, such as privileged-account changes and financial transfers, increasingly require verification mechanisms that do not depend solely upon email, voice or video identity. As Overby puts it, organisations should assume that incidents will occur and practise their response accordingly.

Most importantly, she argues, cybersecurity needs to make “a transition from perfect prevention to designing for resilience”. For Canadian organisations, that may be the most important lesson from the latest wave of AI-enabled threats. The organisations best positioned for the coming years may not necessarily be those that promise that attackers will never get through. They will be the ones capable of detecting an intrusion quickly, limiting its reach, maintaining essential operations and recovering before a cyber incident becomes a business crisis.