Canada's Security Strategy Faces a Cyber Spending Audit

The event

Canada's announcement of a new national security strategy on October 29 carries a quiet but costly proposition: cyber resilience and economic security have become inseparable from territorial defence. Prime Minister Mark Carney's office calls the Plan for a Stronger Canada the country's first such strategy in more than two decades. It describes cyberattacks, financial crime, espionage, pressure through trade and disruption of critical systems as connected risks to sovereignty. A broader definition helps coordinate government, but it can also put more spending proposals under a security rationale. Public accountability has to keep pace with that change.

Context

The immediate instrument is a government strategy, not a signed purchase order. A strategy can establish priorities and direct departments to prepare plans, but Parliament still controls public funding and officials still have to comply with procurement, privacy and administrative law. It would be inaccurate to label a vendor as having received a contract merely because it works in a favored sector. The next documents that matter are appropriations, tender notices, implementation timetables and statutory amendments. Each creates a different form of commitment and a different opportunity for independent scrutiny.

How the policy works

The strategy explicitly combines economic security, defence, foreign policy, public safety and intelligence. The logic is that a vulnerability in one system can disable another. A targeted communications outage can affect banking and emergency dispatch, while disruption of ports can leave otherwise healthy manufacturers unable to obtain components. An attacker does not need to defeat an army to impose expensive social costs. Yet the strategy's breadth creates a selection problem: many public investments could be described as resilience. Decision makers must rank threats by probability, impact and the practicality of alternatives.

Economic transmission

Cybersecurity presents a particularly difficult measurement challenge because successful prevention is often invisible. Governments can report the number of agencies receiving a tool, the money contracted to suppliers or the quantity of staff trained. Those are inputs, not proof of protection. Outcomes include time required to detect and contain attacks, verified recovery time, repeat incidents, exposure of sensitive data and the continuity of essential services. A department that buys sophisticated software but cannot maintain basic access controls may spend more while remaining vulnerable. Procurement value must be assessed against operational reliability, not branding.

Prices and households

An emphasis on domestic capacity can strengthen Canada's ability to operate independently during a crisis. Local security firms could benefit from new demand and from opportunities to scale specialized work. Existing foreign suppliers might face a higher bar if procurement shifts toward trusted or domestic partners. But the economic incidence is more complex than an industrial policy slogan. Local sourcing can improve support and security while sometimes increasing immediate costs or reducing competition. Government should compare lifecycle maintenance costs, portability, interoperability and whether a supplier can be replaced if performance falls short.

Money and institutions

Taxpayers finance much of the public response, including staff, training, contracts and infrastructure. Businesses may carry compliance expenses when stronger security requirements are imposed. Consumers can experience higher prices if service providers pass those expenses through, though stronger protection may reduce outages and fraud losses. Citizens also have a stake in privacy and due process: intelligence modernization cannot be evaluated only by how much technical capacity an agency gains. Oversight must ask whether new powers are proportionate, subject to review and demonstrably effective against the threats offered to justify them.

Trade-offs

Security agencies face a further challenge from the overlap between cyber activity and ordinary criminal investigation. A ransomware operation, a sanctions-evasion network and foreign intelligence interference may be linked, but the evidentiary rules and relevant decision makers differ. Broad rhetoric about hostile actors is not proof that any named individual committed a crime. Financial institutions and software firms often hold information essential to attribution, but government cannot treat suspicion as a substitute for lawful process. A credible strategy should clarify mandates, information-sharing safeguards and mechanisms for independent challenge.

Competing interpretations

Defence suppliers and infrastructure providers may be among the economic winners if the strategy results in funded orders. They may also face a larger burden of security testing and reporting. Provinces and municipalities retain powers over important infrastructure, meaning federal intent does not automatically translate into local construction or operational rules. Carney and cabinet can set national priorities, but an electricity project, health network or transport corridor may have several institutional veto points. Announcements should identify who signs, who regulates, who pays and who can stop an unsafe or uneconomic project.

What it moves

What it moves: The measurable indicators should be mean time to detect a major cyber intrusion, time to restore essential services, and the percentage of critical suppliers satisfying audited security requirements. The desired direction for detection and recovery time is downward. Verified continuity and supplier coverage should rise. Government spending on security may rise before any improvements appear, so dollars committed and dollars disbursed must be separate indicators. The strategy announcement does not yet establish a numerical improvement in those outcomes; any claim to that effect would require subsequent operational evidence.

Accountability test

The strongest case for the new framework is that concentrated supply chains and outdated technology can impose losses far larger than the cost of preparing for disruption. A low bid is not necessarily the least costly purchase once failure, recovery and dependency are considered. The strongest counterargument is that vague security exceptions can protect incumbents, create expensive sole-source contracts and weaken democratic scrutiny. Both concerns are valid. A published cost-benefit method, competitive tenders when possible, independent evaluation and clear safeguards can reduce the tension without pretending that every risk can be disclosed in public.

Risks

Watch Canada's next budget tables, parliamentary review of intelligence powers, the publication of procurement standards and whether agencies report recovery performance in comparable formats. Ask whether cyber incident statistics reflect more attacks or simply better detection. Examine whether privately owned infrastructure operators are reimbursed for compliance and whether their contracts include enforceable service-level requirements. Follow real project delivery rather than the number of announcements. Security language should earn legitimacy through measurable protection and careful protection of rights, not merely by appearing in a ministerial statement.

The accountability context also connects to Mark Carney (opens in a new tab), energy security (opens in a new tab), NATO (opens in a new tab). These connections provide a way to trace responsible institutions and measurable consequences rather than treating the announcement as an isolated statement.

Sources

• Prime Minister of Canada — Launch of the Plan for a Stronger Canada (opens in a new tab)
• Privy Council Office — National Security Strategy October 2026 (opens in a new tab)
• Canadian Cyber Centre — National Cyber Threat Assessment 2025–2026 (opens in a new tab)
• Defence Investment Agency — Delivering Canada's Defence Industrial Strategy (opens in a new tab)
• Canadian Centre for Cyber Security — Threat Assessment Guidance (opens in a new tab)
• Public Safety Canada — New National Cyber Security Strategy (opens in a new tab)
• Public Services and Procurement Canada — Defence Supplier Cyber Certification Requirements (opens in a new tab)