Canadian organizations are spending more on cybersecurity, and they are not getting more secure. According to CIRA’s 2026 annual survey, released during Cybersecurity Awareness Month, 76 per cent of Canadian organizations increased their cybersecurity budgets over the past year. Yet only 67 per cent believe that investment is sufficient, a drop from 74 per cent in 2025. The gap between what organizations spend and what they measure is exactly where that confidence is leaking, and it points directly to a weakness in how most Canadian organizations track security awareness metrics.
What the 2026 CIRA Data Shows
CIRA’s survey, conducted between June and July 2026, documents the disconnect in sharp terms. Four in ten Canadian organizations experienced a cyberattack in the past year. Of those, 24 per cent were hit by ransomware, and 74 per cent of ransomware victims paid the demand. Meanwhile, the share of organizations operating on annual IT budgets below $50,000 more than doubled, rising from 11 per cent to 23 per cent. More spending at the top and a widening resource gap at the base of the market: the two trends are not reinforcing each other.
The survey also found that 87 per cent of organizations have a cybersecurity incident response plan. A plan is fine. But a plan and a trained, tested workforce are different things, and the CIRA data captures organizations that have one but have not built the other. The way to know the difference is to measure continuously, not annually.
The Metrics That Actually Close the Gap
KnowBe4’s 2026 Phishing by Industry Benchmarking Report offers a precise illustration of what continuous measurement looks like. The report analysed 42 million phishing simulations across 64,000 organisations worldwide. Before any security awareness training, the global average Phish-prone Percentage sits at 33.2 per cent: one in three employees would engage with a simulated phishing message. After 90 days of continuous training and testing, that figure drops 40 per cent to 20.1 per cent. After a full year, it falls to 4.2 per cent globally and 4.0 per cent in North America.
These are not awareness statistics; they are behaviour change metrics. The difference matters. An awareness statistic tells you whether employees received a training module. A behaviour metric tells you whether they change what they do when a real phishing message arrives. The CIRA findings suggest that most Canadian organizations are measuring the former and hoping it produces the latter.
Managing human risk effectively requires tracking metrics that follow people’s behaviour over time, not just documenting that training occurred. Phish-prone percentages, reporting rates, and time-to-report are the numbers that tell you whether your program is actually working.
Why Awareness Month Is Not the Measurement You Think It Is
Mandiant’s M-Trends 2026 report adds a useful dimension: voice phishing has overtaken email as the primary social engineering vector, rising to 11 per cent of confirmed initial access events and reaching 23 per cent in cloud-focused intrusions. CISA’s Cybersecurity Awareness Month highlights phishing training, strong passwords, multi-factor authentication, and software updates as core essentials. These are sound fundamentals. But they are also the same four items organizations have heard every October for a decade.
The value of Cybersecurity Awareness Month is not the campaign itself. It is the forcing function it creates to review whether your program is current. If the last phishing simulation your organization ran used the same templates as last year, the metric it produces tells you nothing about readiness against current attacks.
Smaller organizations and nonprofits face a particular version of this problem. With more than one in five Canadian organizations now running on IT budgets below $50,000, the most practical entry point into continuous measurement is a managed service that handles testing and reporting. POPP3R’s Security101 program for Canadian nonprofits is designed for exactly this constraint: structured simulations, updated templates, and reporting that shows whether training is producing behaviour change rather than just completion rates.
The Measurement You Can Start This Week
In our work running phishing simulations across Canadian organizations, we consistently see click rates that drop fast in the first quarter of a program and then plateau. The plateau is where most programs fail, because the easy gains are gone and the hard work of behaviour change begins.
If your organization has not run a phishing simulation in the last 90 days, you have already lost the continuity that makes the KnowBe4 data work. The practical first step is not a new training program; it is a baseline measurement. Starting with a cybersecurity posture assessment gives you a structured starting point: your current phish-prone rate, the gaps in your existing program, and a roadmap for the training that will actually move the number before the next attack establishes a baseline for you instead.
Sources
- CIRA, “CIRA survey reveals Canadian organizations are spending more on cybersecurity, but fewer believe it’s enough,” GlobeNewswire, October 6, 2026
- KnowBe4, “KnowBe4 Research Finds Global Phishing Susceptibility Drops 79% After One Year of Security Awareness Training,” BusinessWire, July 7, 2026
- SecurityWeek, “Cyber Insights 2026: Social Engineering,” SecurityWeek, 2026 (citing Mandiant M-Trends 2026)
