Only 1 in 5 Canadian companies feel ready for a cyberattack. A checklist

Only 20 percent of Canadian organizations say they are completely ready to manage a cyberattack. That is from Kyndryl's 2026 Readiness Report, reported by ChannelBuzz on 11 November 2026. In 2025 it was 36 percent. Readiness is falling while attacks get better.

This is not a Canadian special case. It is the picture of a small business everywhere: AI is being adopted, threats grow faster than defences, and nobody has a plan that fits on one page. The good news: the basics that protect most cost time, not a big budget.

AI helps and hurts at the same time

The numbers in the report show both sides. 79 percent of Canadian respondents say AI helps their organization identify threats faster than traditional approaches. 78 percent consider AI essential to effective cybersecurity operations.

But 65 percent believe AI is increasing the sophistication and scale of cyber threats. And 52 percent say cybersecurity risks are growing faster than their ability to address them. The gap between detection and response is getting wider, not smaller.

There is a second problem too: 80 percent of Canadian organizations are deploying AI beyond pilot projects. But nearly half say their current AI strategy emerged without deliberate planning. AI is already inside the business before anyone decided how to use it safely.

The checklist: six points, one afternoon

First: multi-factor authentication everywhere. Email, accounting, cloud storage, customer records. No account without a second factor, not even the owner's. This is the cheapest measure with the biggest effect.

Second: backups that actually work. A backup that was never tested is not a backup. Once a quarter, restore a file and a folder from the backup and check that it works. Keep one copy separate from the main network, so an attack cannot take it with it.

Third: updates without delay. Most attacks use known holes in old software. Pick one fixed day a week for updates and keep it.

Fourth: one phishing test per quarter. Send your team a fake phishing email and see who clicks. Whoever clicks gets a short training session, not a punishment. The test shows where the gaps are before a real attacker finds them.

Fifth: an incident plan on one page. Who calls whom? Who switches what off? Who talks to customers? Write down names and phone numbers, print the page, and put it next to the router. A plan that lives only in a cloud document does not help when the network is down.

Sixth: review access. Who still has access to which systems? Former staff, old suppliers, forgotten test accounts. Once a quarter, go through the list and remove everything nobody needs any more.

What it costs

Most points on this list cost no money. They cost one afternoon to set up and one hour a month to maintain. The most expensive part of a cyberattack is not the technology afterwards. It is the week when nothing works, and the trust customers lose.

If you want help getting your systems and access in order, see our digital systems service or our workflow automation service.

The takeaway

Canadian businesses are adopting AI faster than they are building their defences. The report makes that plain: 20 percent feel ready, 80 percent are already deep into AI adoption. You do not close that gap with an expensive product. You close it with six simple points that take one afternoon, and with the habit of repeating them every month.

Source: ChannelBuzz, "The Buzz: Canadian cyber readiness declines, Netskope names channel chief, and Flashpoint launches agentic AI", 11 November 2026, https://channelbuzz.ca/2026/11/the-buzz-canadian-cyber-readiness-declines-netskope-names-channel-chief-and-flashpoint-launches-agentic-ai-48088/