October 23, 2026 Insights 7 min read

National Cyber Threat Assessment 2025-2026: What Canadian Small Businesses Need to Know

By Omer Segoly, CISM | Published October 23, 2026

The National Cyber Threat Assessment 2025-2026, released October 30, 2024 by the Canadian Centre for Cyber Security, names ransomware as the top cybercrime threat facing Canada's critical infrastructure. It identifies the People's Republic of China as the most sophisticated and active state cyber threat. Canadian ransomware incidents known to the Cyber Centre have grown by an average of 26% a year since 2021, and the global ransomware economy hit $1 billion USD in ransom payments in 2023 alone.

The NCTA is a national-level intelligence report. It is not a self-assessment of your business. What it does is describe the threats your business is up against. Understanding it is the first step toward knowing what defences matter most.

What Is the National Cyber Threat Assessment?

The National Cyber Threat Assessment is a flagship report from the Canadian Centre for Cyber Security, a branch of the Communications Security Establishment (CSE). It is published every two years and combines classified intelligence with public reporting to describe the cyber threats affecting Canada. The NCTA 2025-2026 is the fourth edition; previous editions were published in 2018, 2020, and 2023-2024.

The NCTA 2025-2026 covers three main areas:

1. State-sponsored threats: cyber programs from the People's Republic of China, Russia, Iran, North Korea, and emerging state actors
2. Cybercrime: the Cybercrime-as-a-Service ecosystem, fraud, scams, and ransomware
3. Trends: five developments expected to shape the threat landscape through 2026, including AI, geopolitically inspired hacktivists, and vendor concentration

The report does not tell individual businesses what to do. It describes what is happening and forecasts what will happen. The CCCS publishes separate guidance documents, like the Baseline Cyber Security Controls, that translate this threat intelligence into practical defences.

What Does the NCTA 2025-2026 Say About Ransomware?

Ransomware is the top cybercrime threat facing Canada's critical infrastructure, according to the NCTA 2025-2026. The report states that Canadian ransomware incidents have grown by an average of 26% year over year since 2021, based on incidents known to the Cyber Centre. By some estimates cited in the NCTA, global ransomware incidents rose 74% in 2023 compared to 2022, and ransom payments worldwide reached a record $1 billion USD that year.

By one estimate cited in the NCTA, the average ransom paid in Canada reached $1.13 million CAD in 2023, an increase of almost 150% in two years. The NCTA notes that the actual number of incidents is almost certainly higher than reported, because many victims do not disclose attacks.

Ransomware actors are opportunistic. The NCTA assesses that ransomware actors are almost certainly opportunistic and do not target specific industries, and that no entity is immune. The report also notes that threat actors are constantly scanning for publicly known vulnerabilities and exploiting unpatched systems. Business size and revenue do not protect you from automated scans. This is why even the smallest Canadian business can find itself encrypted on a Monday morning.

For more on the ransomware threat and what to do before, during, and after an attack, see our ransomware guide for Canadian businesses.

What Are the Main State-Sponsored Threats?

The NCTA 2025-2026 identifies the People's Republic of China (PRC) as the most sophisticated and active state cyber threat to Canada. The report states that the PRC's cyber program "surpasses other hostile states in both the scope and resources dedicated to cyber threat activity against Canada." Over the past four years, at least 20 Government of Canada networks have been compromised by PRC cyber threat actors, according to the NCTA.

The report also highlights:

• Russia: Russian state-sponsored actors are targeting Canadian government, military, private sector, and critical infrastructure networks. Pro-Russia non-state actors, some with likely links to the Russian government, have conducted disruptive attacks on Canada.
• Iran: Iran's cyber program is increasingly willing to conduct disruptive attacks beyond the Middle East and tracks regime opponents living abroad.
• North Korea: The DPRK's cyber program focuses on revenue generation through cybercrime, including ransomware and cryptocurrency theft, to fund the regime.

For most small businesses, state-sponsored espionage is not the primary threat. But state-sponsored tools, techniques, and exploits often filter down into the cybercrime ecosystem. The NCTA notes that some states use private contractors and commercial surveillance vendors who may sell capabilities more broadly.

What Is Cybercrime-as-a-Service?

Cybercrime-as-a-Service (CaaS) is a business model where specialized threat actors sell tools, access, and services to other criminals. The NCTA 2025-2026 states that the CaaS model is "almost certainly contributing to the continued resilience of cybercrime in Canada and around the world."

The CaaS ecosystem includes:

• Ransomware-as-a-Service (RaaS): criminals lease ransomware variants to affiliates who deploy attacks, sharing the profits
• Access-as-a-Service: specialized actors sell access to compromised systems
• Phishing-as-a-Service: ready-made templates and tools for phishing campaigns
• DDoS-as-a-Service: rented botnets for denial-of-service attacks

This model lowers the technical barrier to entry. Attackers no longer need to develop their own malware. They can rent sophisticated tools and focus on finding victims. The NCTA notes that this has almost certainly enabled a growing number of actors with varying capabilities to carry out attacks.

For small businesses, this means the threat is not limited to sophisticated criminal groups. Lower-skilled attackers with rented tools are scanning networks constantly, looking for the path of least resistance.

How Is AI Changing Cyber Threats?

The NCTA 2025-2026 identifies AI as a trend that will shape the cyber threat landscape through 2026. The report notes that cybercriminals are using AI to enhance their capabilities, from generating more convincing phishing emails to scaling attacks.

AI-powered phishing attacks are harder to detect because they lack the grammar and spelling errors that used to be obvious warning signs. AI can personalize messages at scale, making social engineering more effective. The NCTA assesses that AI is almost certainly lowering the barriers to entry and enhancing the quality, scale, and precision of malicious activity by both cybercriminals and state-sponsored actors.

The good news is that the defences remain the same. Multi-factor authentication, employee training, patch management, and tested backups address the attack vectors AI is amplifying. The threats are faster and more convincing, but the fundamentals have not changed.

How Does the NCTA Differ from a Cybersecurity Assessment of My Business?

This distinction matters because people searching for "national cyber threat assessment" sometimes land on our free cybersecurity assessment page. The two are different tools serving different purposes.

The NCTA tells you what is happening in the threat landscape. A business assessment tells you whether your organization is prepared. Knowing the threats is useful only if you act on that knowledge by checking your own defences.

What Should Canadian Small Businesses Do Next?

The NCTA 2025-2026 describes the problem. The CCCS Baseline Cyber Security Controls for Small and Medium Organizations describe the solution. The baseline controls are 13 security practices designed to protect against the cybercrime threats highlighted in the NCTA.

Here is the practical path:

1. Read the key judgements. The NCTA executive summary and its key judgements identify the main threats.
2. Assess your current posture. Use a structured self-assessment to see where you stand against the baseline controls.
3. Close the biggest gaps first. Multi-factor authentication, tested backups, and patch management address the ransomware threat directly.
4. Build security into operations. The NCTA forecasts threats through 2026. These are not one-time fixes.

Our free cybersecurity self-assessment evaluates your organization against all 13 CCCS Baseline Controls. It takes under 30 minutes, runs entirely in your browser, and does not collect your data. You receive a score, a letter grade, and prioritized recommendations.

The NCTA shows what is coming. The assessment shows where you stand. That is the order of operations: understand the threat, then measure your defences.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). National Cyber Threat Assessment 2025-2026: What Canadian Small Businesses Need to Know. Retrieved from https://cybersecuritycanada.ca/news/posts/national-cyber-threat-assessment-2025-2026-canadian-small-business-guide/

Permanent URL: https://cybersecuritycanada.ca/news/posts/national-cyber-threat-assessment-2025-2026-canadian-small-business-guide/ · Published October 23, 2026