If a factory burns down, you call 911. If a ransomware attack locks every machine in that same factory, you call the Ghostbusters your IT department and hope they’re awake.

Hardly a reassuring response given the ensuing headaches and repair expenses, so it’s no wonder this gap between physical and digital response is top of mind for Canadian executives.

According to new research from KPMG in Canada, 89% of 501 surveyed Canadian business owners or executive level C-suite decision makers want governments to create “cyber firefighting teams” to help organizations contain and recover from the next major digital blaze.

“As Canada becomes more reliant on digital infrastructure, the risks posed by cyberattacks are now just as serious as natural disasters like wildfires, floods, and tornados,” said Hartaj Nijjar, national leader of risk services and cybersecurity at KPMG in Canada. “It only takes one major cyber incident to destabilize essential services, disrupt the economy, and erode public trust.”

Nijjar’s point lands with new urgency. Cyberattacks are now systemic threats that erode public confidence. According to this survey released today, most Canadian business leaders now see that risk as both a national and corporate vulnerability that demands a coordinated response.

With cybersecurity a shared public risk, not a private IT problem, leadership is calling for government backup. 

Budgets under pressure

Executives are sounding the alarm but tightening the purse strings. 

KPMG’s survey found that 86% of leaders see cyberattacks as the greatest threat to their company’s three-year growth plans, yet 74% say they’ve been forced to trim cybersecurity investments due to rising costs related to recent tariffs.

The contradiction is striking. 

The report notes that 91% of organizations are investing more in resilience and recovery capabilities, but nearly the same number admit they still aren’t confident they can withstand the next generation of attacks.

“The call for cyber first responders isn’t just theoretical,” says Imraan Bashir, partner and national public sector cyber leader at KPMG in Canada. “Business leaders see cyber risk as the biggest barrier to growth, and many worry about their ability to withstand the next wave of attacks.”

AI has become both the threat and the tool. While attackers are using it to scale and automate assaults, 91% of organizations now use AI as a cybersecurity tool, and 89% say it’s been a “game changer” for how they defend themselves.

The weakest link is still human

If you think your employees would never click a suspicious link, think again. 

KPMG’s report shows that 84% of executives say cybersecurity training remains a “tick-the-box exercise,” up sharply from 71% in 2024. Meanwhile, 88% say their organizations are highly worried about cybercrime and data breaches caused by human error.

“Good cyber hygiene is the first line of defence against any type of breach or attack,” says Nijjar. “With attacks becoming more sophisticated, leaders need to embed cyber awareness into everyday culture, not just annual compliance.”

With digital risks expanding faster than budgets, many leaders are juggling multiple crises at once. Cybersecurity becomes one more item on the to-do list, until it becomes the only item that matters.

Preparing for the quantum era

The next frontier is already forming on the horizon.

The report shows that 88% of the executives surveyed fear that nation-state hackers are stockpiling encrypted data now to decrypt later once quantum computers become powerful enough, a tactic dubbed, uncleverly, “harvest now, decrypt later.”

Some Canadian firms are experimenting with quantum-resistant encryption keys and running annual simulation exercises, but they don’t believe they can do it alone.

When it comes to cybersecurity, business leaders are looking to government for guidance. In fact, 94% of business leaders expect the federal government to establish cybersecurity standards and call for all levels of government to make cybersecurity a top priority, although the call is coming from inside the house.

Leading before the sirens sound

The call for “cyber firefighters” is really a call for collaboration. As digital infrastructure becomes national infrastructure, leaders are realizing they can’t defend it alone.

The companies best prepared for what’s next will be those that integrate security into daily decision-making, link it to business continuity, and treat people as part of the defence system.

Because when the next digital fire breaks out, it won’t matter who started it. It’ll matter who’s ready to put it out.

Final shots:

• Cyber risk is now a leadership test, not just an IT issue. Security decisions are business decisions. How leaders allocate budgets, train people, and plan for disruption will define competitiveness in an AI-driven economy.
• Culture remains the weakest firewall. Cybersecurity, in many organizations, still feels like a “tick-the-box” exercise. Real resilience depends on turning awareness into behaviour, embedding security into everyday routines, not annual checklists.
• Collaboration is the new competitive advantage. Canada’s next leap in innovation might come not from a new technology, but from how its public and private sectors learn to share intelligence, resources, and response capacity.
• The next wave of risk won’t wait for the budget cycle. The leaders who act now, by building resilience before crisis strikes, will be the ones shaping how Canada competes in a quantum-powered future.