Statistics Canada released its findings on the impact of cybercrime on Canadian businesses this week: 16 per cent of businesses were impacted by a cyber security incident in 2025. Among the businesses hit, scams and fraud were the leading method at 55 per cent — up from 50 per cent in 2023 — while ransomware fell to 8 per cent.
Read that again. The typical incident in 2025 did not begin with sophisticated malware. It began with a message: an invoice that looked right, a login page that looked familiar, a request that sounded like it came from the boss. Attackers aimed at people because people are the fastest way in.
October is Cyber Security Awareness Month in Canada, and this year's federal Get Cyber Safe theme is “Your best defence is you.” The StatCan data makes the same point from the other direction: a company's biggest exposure is also its people — an untrained inbox, a reused password, an account with no second factor standing behind it.
Most incidents are not a technology failure with a people problem attached. They are a people failure that basic technology would have caught.
The fixes are unglamorous, and they compound: multi-factor authentication on every account that matters, updates applied on schedule, backups that are tested rather than assumed, and staff who have seen a realistic scam before a real one arrives. None of it requires an enterprise budget. All of it requires someone to own it — which is where smaller firms stall, because security lands on whoever is already busiest, and stays there until an IT services partner or a named internal owner picks it up properly.
Start with the four basics — MFA, updates, tested backups, staff awareness — and finish them before shopping for anything advanced. That is where Canadian businesses actually got hurt in 2025, and it is where the next incident gets stopped.