CIRA survey reveals Canadian organizations are spending more on cybersecurity, but fewer believe it’s enough

CIRA’s 2026 survey found that 76% of Canadian organizations increased cybersecurity budgets over the past year, but only 67% consider spending sufficient, down from 74% in 2025; the share with annual IT budgets below $50,000 rose from 11% to 23%. More than 80% of decision-makers are concerned about AI-enabled threats, while 91% say Canadian data residency matters and nearly 7 in 10 prioritize data sovereignty over price when choosing vendors. The findings point to rising security needs and constrained resources, alongside greater emphasis on Canadian-based operations and in-house capabilities.

Analysis

The investable signal is procurement friction, not proof of a cybersecurity spending boom. Sovereignty requirements could redirect Canadian public-sector and regulated-industry contracts toward providers able to document local data handling and operations. That is a relative advantage for Canadian-based service providers such as TELUS and CGI, but not an automatic exclusion of Microsoft, Palo Alto Networks or CrowdStrike: global vendors can compete if their deployment and data-governance models satisfy buyers. The key evidence will be contract wins and disclosed bookings, not survey sentiment.

A second-order effect is a split market. Organizations building tools in-house may reduce demand for some outsourced platforms, while increasing demand for implementation, integration and scarce security talent. Meanwhile, cyber insurers’ control requirements can pull forward compliance and incident-response work, but tighter underwriting may also make coverage more costly or harder to obtain. The rising AI-threat narrative is not yet evidence of incremental vendor revenue; cautious budgets and internal build-outs constrain monetization.

Near term, the survey is unlikely to justify a broad sector trade. Over 1–3 months, watch Canadian public-sector tenders, vendor disclosures on Canadian data residency and managed-security bookings, and insurer control requirements. Over 6–18 months, sustained localization clauses could support a durable domestic-services premium. Contrarian risk: procurement preference may be aspirational and yield to price, existing contracts, or technical capability. A thesis failure would be no measurable rise in Canadian-provider awards or bookings, or major buyers accepting non-Canadian vendors under equivalent controls.

Key Decisions for Investors

• No immediate directional trade on the survey alone: treat it as a procurement signal, not verified demand or earnings guidance.
• Set an alert for Canadian public-sector and healthcare cybersecurity awards; if localization language translates into disclosed wins, evaluate relative exposure in TELUS and CGI against global platform vendors rather than assuming all Canadian providers benefit equally.
• Monitor whether in-house SIEM/XDR builds lead to services and integration revenue or instead displace external software contracts; vendor commentary on Canadian bookings and renewal rates is the key missing confirmation.
• Avoid buying AI-cybersecurity exposure solely on threat concerns. Reassess if budgets, contract awards, or guidance show conversion into paid products; weaker procurement or continued price-led vendor selection would falsify the bullish localization thesis.