Back to Blog
Cybersecurity8 min read

Your Employees Are Your Biggest Security Gap: A Practical Guide to Security Awareness Training for Canadian SMBs

By Anton Kuznetsov

The 2026 Verizon Data Breach Investigations Report analyzed more than 31,000 security incidents and arrived at the same conclusion it has reached every year for nearly two decades: 62% of confirmed breaches involved the human element — employees clicking phishing links, disclosing credentials, or being manipulated by impersonators. That figure has not meaningfully declined despite a decade of investment in awareness training, phishing simulation platforms, and cyber hygiene campaigns. It has actually risen, up from 60% in 2025.

The implication is not that training does not work. It is that most Canadian organizations are not running training programs designed to work.

The Canadian Numbers

The human element in breaches is not a global trend that leaves Canada untouched. The evidence from Canadian sources is consistent and specific.

Statistics Canada's 2023 Canadian Survey of Cyber Security and Cybercrime (published October 2024) found that 16% of Canadian businesses were impacted by a cybersecurity incident in 2023. Among the attack methods reported, scams and fraud were the most common approach, accounting for 50% of all incidents — a category that encompasses phishing, business email compromise, and social engineering. Canadian businesses spent $1.2 billion recovering from cyber incidents in 2023, double the $600 million spent in 2021.

CIRA's 2025 Cybersecurity Survey found that 43% of Canadian organizations experienced a cyber attack in the past 12 months, and 42% experienced a breach of customer or employee data — up sharply from 29% in 2022. The ESET SMB Cyber Readiness Index 2026 found that phishing and social engineering/impersonation combined are the leading cause of cyber incidents among SMBs, accounting for 43% of all reported cases.

The Office of the Privacy Commissioner of Canada's Annual Report 2024-2025 provides the clearest window into how breaches actually reach Canadian privacy regulators. 46% of private-sector breach reports cited cyberattacks resulting from malware, compromised credentials, hacking, or phishing. An additional 15% of all reported breaches were caused by employee errors — misdirected correspondence, mishandled personal information, accidental disclosures. That is approximately 60% of all breach reports to Canada's federal privacy regulator attributable, directly or indirectly, to the human element.

What the 2026 Verizon DBIR Shows About the Evolving Attack Surface

The DBIR adds critical context to these numbers. Social engineering was the third most common attack pattern in 2026, accounting for 16% of confirmed breaches and more than 5,300 incidents globally. But the threat surface has expanded well beyond the email inbox.

41% of social engineering breaches in 2026 involved non-email vectors — phone calls, text messages, and social media platforms. Voice phishing (vishing) and SMS phishing (smishing) simulations in the DBIR dataset showed a median engagement rate of approximately 2%, compared to 1.4% for email phishing — roughly 40% more effective when attackers shift from inbox to phone.

This matters for training program design. A program built exclusively around email phishing simulations trains employees to recognize one attack channel while leaving the others untested. Employees who have never encountered a simulated phone-based impersonation or a fraudulent text in a training context encounter it for the first time in a live attack.

The DBIR also highlights the growth of pretexting — social engineering built around sustained impersonation and manufactured trust rather than an obvious malicious link. Attackers now impersonate IT support staff, vendors, or executives over multiple exchanges, building enough familiarity to lower a target's guard before requesting credentials or a fraudulent payment. Training programs designed around obvious phishing examples do not prepare employees for this pattern.

The Training Frequency Problem

The single CIRA 2025 data point that most directly explains why 62% of breaches still involve humans is this: only 14% of Canadian organizations conduct security awareness training monthly. Twenty-nine percent do so annually or less — virtually unchanged since 2022. CIRA research shows that a security awareness program running monthly — with regular phishing simulations and updated threat content — reduces an organization's phish-prone rate by an average of 86% within 12 months. An annual training session produces marginal sustained impact: retention of training content drops significantly within 90 days without reinforcement.

The gap between common practice and effective practice is not narrow. Annual training and monthly training are not the same activity performed at different intervals — they produce fundamentally different outcomes against an attack surface that evolves continuously.

The financial math is equally clear. A Canadian SMB with 30 employees paying $30 per user per year for a structured security awareness platform spends $900 annually on training. IBM's 2025 Cost of a Data Breach Report found the average Canadian breach now costs CA$6.98 million — a 10.4% increase over the prior year. At 30 employees, the annual training investment is less than 0.02% of the average breach cost it is designed to reduce.

What the CCCS Requires

The Canadian Centre for Cyber Security has published two directly applicable guidance documents on employee security training.

ITSM.10.089 — Baseline Cyber Security Controls for Small and Medium Organizations (v1.2, January 2026) identifies security awareness training as one of its 13 core control areas. The baseline standard requires that all employees receive regular security awareness training covering the most common attack vectors they are likely to encounter, with emphasis on phishing, social engineering, and acceptable use of organizational systems.

ITSAP.10.093 — Offer Tailored Cyber Security Training to Your Employees (September 2024) provides implementation guidance. The CCCS recommends that organizations:

  • Provide role-based training that addresses the specific risks associated with each employee's access level and job function. An employee with administrative system privileges faces different social engineering risk than a front-desk staff member; training content should reflect that distinction.
  • Deliver training before new employees are granted system access, rather than deferring it to a later onboarding step.
  • Update training content following security incidents — internal events or sector-wide attacks — so that real events become learning inputs rather than missed opportunities.
  • Foster a reporting culture over a blame culture. Employees who fear consequences for clicking a test phishing link will not report real phishing attempts; employees who feel supported will.

The CCCS guidance is explicit about scope: employees, contractors, managers, and executives all require training calibrated to their access levels. This is not a staff-only obligation.

Beyond Annual Check-the-Box: What Effective Training Includes

Most Canadian SMBs that have "security awareness training" have either an annual online module that takes 20 minutes to complete, or a one-time phishing simulation run when a managed service provider first onboarded them. Neither approach produces the 86% phish-prone reduction that sustained monthly programs deliver.

Effective security awareness training in 2026 includes these components:

Multi-vector phishing simulations. Email simulations are table stakes. Add simulated voice phishing and text-based scenarios to address the 41% of the social engineering surface that email simulations do not cover. Rotate scenarios so employees encounter different pretexts, senders, and urgency patterns across each quarter.

Short, frequent training modules. Five-to-seven minute modules deployed monthly maintain awareness in a way that annual courses cannot. Content should reflect current threat patterns — AI-generated deepfake audio, executive impersonation, invoice fraud — not generic examples that feel disconnected from how attacks actually arrive in 2026.

Role-specific content for elevated-access staff. Employees with access to financial systems, HR records, payroll, or administrative IT access require targeted training on the attacks most likely to target their role. Business email compromise typically targets finance and accounts payable. Credential phishing targets IT administrators. Generic training treats all employees as equivalent targets when their risk profiles are materially different.

Clear reporting mechanisms. The effectiveness measure of a training program is not zero clicks — it is rapid reporting. An employee who clicks a phishing link and immediately reports it gives the organization a chance to contain the damage before it propagates. An employee who clicks and stays quiet extends the attacker's dwell time. Programs that simulate the reporting step — not just the click — produce better incident response outcomes.

Tracked metrics and baselines. A phishing simulation program without baseline measurement is not a program — it is an activity. Measure your organization's phish-prone rate at program start, set a quarterly reduction target, and track results. This data also satisfies documentation requirements from both the OPC and most Canadian cyber insurers.

PIPEDA and the Training Obligation

Under PIPEDA, organizations holding the personal information of Canadians are required to implement "appropriate security safeguards" proportionate to the sensitivity of the data held. The OPC's published guidance on security safeguards explicitly includes employee training as a required component of a defensible data security posture.

When a phishing-related breach is reported to the OPC, the regulator assesses whether the organization had reasonable safeguards in place at the time. An organization with no security awareness training program faces a materially weaker compliance argument than one that can demonstrate a documented, regularly updated program, phishing simulation results, and an employee reporting culture. The 46% of breach reports citing phishing-related cyberattacks are precisely the cases where training documentation matters most.

Organizations with Quebec operations face the same requirement under Law 25. The Commission d'accès à l'information applies equivalent scrutiny to organizational security safeguards following a reportable breach.

A Practical Starting Point for Canadian SMBs

For a small Canadian business without a dedicated security team, this sequence prioritizes highest impact at lowest operational cost:

Month 1 — Establish a baseline. Deploy a phishing simulation to your full employee base without advance notice. Measure your phish-prone rate. Whatever the number is, it is more useful to know it than not.

Month 1–2 — Implement a platform. Security awareness training platforms suited to Canadian SMBs typically cost between $15 and $60 per user per year, depending on team size, feature set, and whether phishing simulations are included. Pair the platform with CIRA's free Canadian Shield DNS protection for network-layer filtering that operates independently of employee behaviour.

Ongoing — Monthly cadence. Run one short training module and at least one phishing simulation per month. Rotate scenarios across email, SMS, and voice themes. Track your phish-prone rate each quarter and report it to management as a measurable security metric.

When ready — Role-based content. Prioritize elevated-access staff — finance, IT, HR, executive assistants — for targeted training covering business email compromise, credential phishing, and privileged access scenarios.

Annually — Review and update. Refresh training content following any internal incident, any sector-wide attack affecting Canadian organizations, and any new CCCS advisory or guidance. The free CCCS Alerts and Advisories feed provides current threat intelligence that translates directly into training scenario updates.

A consistent monthly training program does not require a dedicated security team, a sophisticated enterprise platform, or a large budget. It requires a decision to make it a routine rather than a one-time event.

Sources

Cloud Forces helps Canadian SMBs design and implement security awareness training programs aligned to CCCS ITSAP.10.093 guidance, ITSM.10.089 baseline requirements, and PIPEDA safeguard standards — including phishing simulation campaigns, role-based training modules, and phish-prone rate tracking. Explore our Cybersecurity services or contact us to schedule a complimentary phishing baseline assessment.

Anton Kuznetsov
Founder & Principal Engineer

Anton Kuznetsov is the founder and principal engineer of Cloud Forces, the Toronto firm he started in 2018 to make custom software and AI practical and affordable for Canadian SMEs. He works hands-on across application development, cloud architecture, and the production systems Cloud Forces runs for its clients.

Ready to bring AI to your business?

Book a free AI Readiness Consultation — no commitment required.

Book Free Consultation