Un sondage de CIRA révèle que les organisations canadiennes dépensent davantage en cybersécurité, mais qu’elles sont moins nombreuses à juger ces dépenses suffisantes

CIRA’s 2026 survey of more than 500 Canadian cybersecurity decision-makers found that 76% of organizations increased cybersecurity budgets over the past year, but only 67% consider investment sufficient, down from 74% in 2025. More than 80% are concerned about AI-related threats, while 91% consider Canadian data storage and processing important. The findings also show rising cyber-insurance adoption (82%, versus 59% in 2021) and continued reliance on external expertise for incident response.

Analysis

The investable signal is a procurement shift, not proof of a near-term spending boom. Canadian data-residency and ownership preferences may improve win rates for providers able to document local operations, but the survey measures stated priorities—not contract awards, pricing power, or incremental budgets. That distinction matters as confidence in budget adequacy falls and the share of very small IT budgets rises: demand may concentrate in larger institutions while smaller buyers defer upgrades or choose bundled, lower-cost services.

The vendor mix could bifurcate. Building SIEM/XDR/SOAR internally can displace some outsourced platform spend, while continued reliance on external incident responders supports specialist services when attacks occur. Domestic managed-security and response providers are potential relative winners; global platforms are not automatically losers if they can meet residency requirements through Canadian operations. Insurers’ control requirements create a compliance floor, but could also make coverage harder or costlier for under-resourced organizations.

Near term, this is a weak standalone catalyst: CIRA is a nonprofit survey source, and no spend totals or procurement data establish revenue upside. Over 1–3 months, watch Canadian public-sector tenders, vendor bookings, and cyber-insurance renewal terms for evidence that preferences convert into dollars. Over 6–18 months, persistent localization requirements could favor domestic delivery capacity, though local talent scarcity may constrain margins. Contrarian risk: the sovereignty signal is already more visible than the actual budget capacity behind it.

Key Decisions for Investors

• No broad cybersecurity trade on this survey alone. Track Canadian cyber-services and managed-security providers as potential beneficiaries, but require contract wins, bookings, or guidance revisions before adding exposure.
• Favor incident-response and managed-security exposure over a blanket bet on security software: more in-house tooling may cap outsourced platform demand, while organizations’ reliance on external help during incidents supports specialist response demand.
• Set a 1–3 month confirmation watch: look for Canadian procurement awards specifying data residency, cyber-provider revenue commentary, and insurer control requirements at renewal. Treat stated survey preferences without spend conversion as non-confirmation.
• Falsify the localization thesis if tenders continue to prioritize price over Canadian operations, or if providers report no improvement in bookings. Reassess the budget-pressure risk if organizations disclose sustained security-budget cuts or delayed project starts.