Canadian businesses focusing cybersecurity efforts on AI management

Twenty-five per cent of Canadian executives surveyed in RSM’s 2026 cybersecurity report said their companies experienced a data breach in the previous year, reflecting the growing complexity of business risks amid the proliferation of artificial intelligence.

Commensurately, 93 per cent of Canadian respondents expect to increase cybersecurity spending in the coming year.

The data breach findings stand in contrast to responses from U.S. executives, 18 per cent of whom said their businesses experienced a data breach in the previous year.

However, a roughly equal share of respondents from the two countries reported that their organizations experienced a ransomware attack or demand in the last 12 months—25 per cent of Canadian respondents and 24 per cent of U.S. respondents.

RSM’s cybersecurity survey, fielded in the first quarter of 2026, aggregated the responses of 101 Canadian and 501 U.S. middle market executives across a variety of industries—with AI usage and AI-enhanced threats emerging as key influences on cybersecurity strategies.

The report shows that Canadian companies are primarily focusing their resources on AI security and governance (39 per cent). Strategy and risk management (37 per cent) and securing the cloud (32 per cent) are among the other initiatives being prioritized.

Conversely, U.S. respondents emphasized detection and response (39 per cent) as a stronger area of focus compared to AI security and governance (30 per cent).

As for how organizations approach identifying and managing cyber risks, 53 per cent of Canadian respondents said they use a formal risk management framework, in comparison to 40 per cent of U.S. respondents. While 20 per cent of U.S. executives surveyed said they rely on third-party providers or consultants to manage these risks, only nine per cent of Canadian respondents gave the same answer.

Digital identity remains an area where companies in both Canada and the U.S. could sharpen their focus on emerging threats.

“Nonhuman identity is not a new concept,” says Omer Arshed, a partner at RSM Canada. “This is something we’ve been managing for clients for over a decade. But AI has changed and added further complexity to the equation.”

RSM risk professionals caution companies about a new level of cyberthreats—mainly attributed to expanding AI use—but respondents in Canada and the U.S. almost universally felt confident in their current measures to safeguard data.