Cybersecurity spending is up but confidence is down

Canadian organizations are spending more on cybersecurity and hiring more people to manage it. 

They’re also still wondering whether this is enough to keep up.

A new survey from the Canadian Internet Registration Authority (CIRA) found that 76% of organizations increased spending on IT systems management and cybersecurity over the past year. Three-quarters also added staff in those areas.

Yet only 67% of cybersecurity decision-makers believe their budgets are sufficient to protect their organizations against attacks, down from 74% in 2025.

CIRA surveyed 503 cybersecurity decision-makers across Canada in June and July, including respondents from private businesses and public institutions such as municipalities, schools, and hospitals. The goal was to understand how organizations are responding to threats that, these days, are evolving fast.

Budgets vary considerably. Nearly one-quarter of respondents reported annual IT budgets below $50,000, more than double the 11% who said the same last year.

“The survey reflects what we hear from organizations every day: cybersecurity challenges are increasing while resources are becoming harder to secure,” says Jon Ferguson, CIRA’s vice-president of cyber and DNS.

Organizations are also taking more of the work into their own hands.

Two-thirds (67%) now manage cybersecurity internally or on-site, up from 61% last year. Among those using security monitoring and response technologies such as SIEM, XDR, or SOAR, 63% have built those capabilities in-house, compared with 40% in 2025.

That gives organizations a more proactive role in detecting attacks and responding if something goes wrong.

CIRA found that 39% of organizations experienced an attempted or successful cyber incident over the past year, down from 43% in 2025. They also found that 21% had experienced a successful ransomware attack in the past year, down from 28% in 2024.

Among organizations that suffered a successful ransomware attack, 76% said attackers took data from their network or cloud service, and 75% said they paid the ransom.

While 62% of respondents that experienced a cyber incident turned to outside help, 87% of organizations do have an incident response plan.

Ninety-two percent said a checklist for choosing a qualified incident response provider would be valuable. As CIRA says in their survey report, “the worst time to decide on a provider is after systems have gone offline.”

Bringing cybersecurity in-house means taking responsibility for what happens when an attack gets past your defences. The budget needs to cover the people who respond, including outside experts when the problem gets bigger than your own team can handle.

Final shots

• Security spending is rising, but confidence in budget adequacy fell seven percentage points in a year.
• More organizations are building security capabilities in-house, increasing their responsibility for operating and maintaining them.
• Incident response plans are widespread, yet organizations that experience attacks often still need outside expertise.