Many SMB owners believe their business is too small to interest hackers. The opposite is true: cybercriminals target organizations with the weakest defences, and those are often small ones. In its National Cyber Threat Assessment 2025-2026, the Canadian Centre for Cyber Security reminds us that "no entity is immune" to ransomware.
Two Threats to Watch in 2026
Ransomware
Ransomware encrypts your files and locks your systems until a ransom is paid. Increasingly, attackers also steal your data and threaten to publish it. The Canadian Centre for Cyber Security considers ransomware the top cybercrime threat in the country. For an SMB, a few days of downtime are enough to jeopardize orders, payroll and customer relationships.
AI-Enhanced Phishing
Fraudulent emails riddled with mistakes are becoming rare. The Canadian Centre for Cyber Security notes that AI-powered chatbots make it possible to write convincing phishing emails, putting these attacks within reach of low-skilled criminals. A fake supplier email asking you to change banking details, written in flawless French, is very believable today.
What Quebec's Law 25 Requires in the Event of an Incident
In Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, sets out what you must do if personal information is lost, stolen or accessed without authorization:
- take measures to reduce the risk of harm and prevent a similar incident from happening again;
- notify the Commission d'accès à l'information and the individuals concerned when the incident presents a risk of serious harm;
- keep a register of all confidentiality incidents, even those that are not reported.
Administrative monetary penalties can reach $10 million or 2% of worldwide turnover. The data of your employees, candidates and customers is all covered.
Seven Priority Measures for an SMB
- Enable multi-factor authentication on email, remote access and administrator accounts. It is the most cost-effective measure against password theft.
- Make tested, isolated backups. A backup that is accessible from your network can be encrypted along with your files. Keep an offline copy and test restoration regularly.
- Apply updates quickly on workstations, servers, firewalls and Internet-facing software.
- Train your employees to recognize phishing, using realistic examples and simulations. Set a simple rule: any request to change banking details must be confirmed by phone.
- Limit access to what is strictly necessary. An employee does not need administrator rights to do their job.
- Prepare an incident response plan: who to call, how to isolate an infected workstation, how to communicate with customers and the Commission d'accès à l'information.
- Set rules for the AI tools your teams use. Customer data copied into a consumer tool can constitute a confidentiality incident.
To go further, the ISO/IEC 27001 standard offers a recognized framework for managing information security in a structured way. Not every SMB needs certification, but drawing on the standard helps prioritize efforts.
How 2AF Can Help
- 2AF Neurotech audits your systems and gives you a prioritized action plan. We also support you in implementing an approach inspired by the ISO/IEC 27001 standard and in responding to incidents.
- 2AF Solutions RH and Recru2af.com help you recruit the IT and cybersecurity profiles your team is missing, in Quebec and abroad.
- Yenilik designs AI agents with access and rules defined from the start: automation should not open new vulnerabilities.
Sources: Canadian Centre for Cyber Security, National Cyber Threat Assessment 2025-2026; Commission d'accès à l'information du Québec. This article does not constitute legal advice.