AI is changing the speed and scale of cyberattacks. It is lowering the technical expertise needed to find and exploit vulnerabilities, while making attacks easier to automate and repeat at scale.
On the flip side, AI can also help researchers uncover serious vulnerabilities that have gone undetected for years. Recent research identified vulnerabilities in PHP that prompted precautionary shutdowns of some government websites.
For the Government of Canada, the challenge is to identify and address vulnerabilities quickly, understand how weaknesses in shared systems affect others, and coordinate responses across a highly federated environment. This is particularly difficult when organizations rely on legacy systems, shared infrastructure and third-party software that can take years to replace or modernize.
CSE, SSC and departments all have a role to play in protecting critical systems. With Digital Transformation Canada bringing together more of government’s digital delivery capabilities, there’s an opportunity to strengthen security across shared services as well.
Here are four areas that I feel deserve particular attention:
1. Detect threats before the damage spreads
AI is increasing the volume, speed and variation of cyber threats. Security teams need to distinguish genuine threats from the growing volume of activity, connect suspicious signals across systems and recognize when an attack is unfolding. Having more security tools and generating more alerts won’t help if teams can’t make sense of what they’re seeing.
2. Contain breaches quickly
AI gives attackers more ways to automate parts of an attack and move quickly between compromised systems. Government needs to be able to limit that movement before an incident spreads. This is particularly difficult in a shared environment, where isolating one system could affect services or dependencies managed by another organization. Containment plans need to account for those dependencies before an incident occurs.
3. Test against evolving threats
AI makes it easier for attackers to vary their methods, automate attempts and adapt when one approach fails. Periodic assessments and checks for known vulnerabilities aren’t enough on their own. The GC needs to test whether its systems and response teams can withstand and respond to these kinds of adaptive attacks. Exercises should expose where handoffs, unclear ownership or approval requirements slow down the response—not just whether the technical controls work.
4. Find vulnerabilities before attackers do
AI can also give defenders and independent security researchers more ways to uncover weaknesses before they are exploited. The GC should make greater use of external expertise through structured vulnerability disclosure and bug bounty programs, while working with technology vendors to proactively test systems and applications.
The U.S. Department of Homeland Security has used these programs to bring external researchers into the process and track reported vulnerabilities through to remediation. There is an opportunity for the GC to build on its own vulnerability disclosure work and expand this approach across more government systems.
The goal should be to find weaknesses earlier, give researchers a safe way to report them and get fixes in place before those weaknesses become an entry point for attackers.
Turning direction into action
The GC recently issued new direction on cybersecurity readiness in the frontier AI era. Now it needs to convert that direction into coordinated action across the systems and organizations delivering public services.
GC organizations often operate with limited time, budgets and control over many of the systems they depend on. Their attackers don’t face nearly the same constraints. Closing that gap will require faster detection and response, stronger coordination and better use of expertise across government and the private sector.