Tech pro explains how Canadian companies can use AI to strengthen cybersecurity

Is AI in cybersecurity an asset or a threat? While many IT professionals in Canada express concerns about incorporating AI into cybersecurity, AI technologist Amanda Johnstone views it as a formidable defence tool. Here, she shares her insights on leveraging AI to bolster your security measures.

In the world of cybersecurity, many people see Artificial Intelligence (AI) as a double-edged sword of risk and opportunity. A Capterra survey of 350 IT professionals in Canada found that 28% see AI-enhanced attacks as a top threat for their company over the next year.*

However, Amanda Johnstone [1], an AI technologist and TIME Next Gen Leader tells us AI can be just as powerful when used for defence instead of offence.

Johnstone says AI-powered features are increasingly common in IT management and security software, noting “what was once a Fortune 2000 privilege is now accessible to all."

The hard part now is choosing strategies and specific products that will maximize your company’s protection against rapidly evolving cyber threats—especially if you run a lean team with limited security expertise. To help you bolster your security, we’ve combined Johnstone’s recommendations with our takeaways from new Capterra surveys of IT pros in Canada. 

The full methodology that we’ve used for those two surveys is at the bottom of this article.

1. Evaluate your defences: prepared for AI-driven threats?

“AI advancements—including deepfakes and voice cloning—are sophisticated enough to fool even experienced IT professionals,” notes Johnstone.

Many companies are already adapting to meet this challenge. A Capterra survey found that 66% of IT and security professionals in Canada have developed specific measures to protect their companies against AI-generated deepfake attacks.**

“I am surprised that not everyone is defending against AI-generated deepfake attacks,” says Johnstone. “100% of companies should develop measures to defend against this; it should be something that we're all thinking about straight off the bat. Compliance and risk mitigation are paramount for businesses that store financial and health information, or data about people who are underage, like schools, for example. And when we consider industries like real estate, banking, education, health, defence, retail, and telecommunications, they're all really vulnerable to cyberattacks.” 

For many small and midsize businesses (SMBs), limited resources and outdated security practices increase their vulnerability—especially given the variety of ways cybercriminals are applying AI.

Your first step to increased protection is to audit what you’re currently doing and using. If your business relies on a basic IT management system without additional protective measures, more than that may be needed to fend off these threats. Johnstone advises that businesses should not assume default features in IT management software cover them.

“​​To fix cybersecurity vulnerabilities, remove the shame [of being unprepared or fooled] and ensure people have not only financial resources but also the right tools and decisions at their disposal,” says Johnstone. 

She emphasizes these critical strategies to strengthen your security posture:

• Don't make assumptions: Companies must not rely on default features in IT management systems to cover them. Policies, training, and tools that haven't been updated in years leave a gap. “Every business must be prepared for a cyberattack one day… It's not a matter of ‘if’ but ‘when’," Johnstone advises​.
• Review your policies regularly: Johnstone emphasizes, "Companies must regularly reassess IT vulnerabilities. Removing shame and ensuring people have not only financial resources but also the right tools and decisions are crucial"​. Regular updates to IT policies and tools are essential to staying ahead of evolving threats.
• Engage a cybersecurity professional or consultant: For businesses struggling to keep up with evolving threats, Johnstone recommends hiring external help. “Compliance guidelines vary by data type and industry, but every organization should hire an expert—whether a consultant or a CISO—when addressing or investing in cybersecurity," Johnstone advises. Engaging a professional ensures your business’s unique risks are thoroughly assessed and tailored solutions are implemented to close any security gaps.

By following these guidelines, small businesses can transform their IT management systems into a more comprehensive line of defence, minimizing risks and staying ahead of potential threats.

2. Enhance your security by upgrading to advanced AI solutions

“AI’s role in cybersecurity is evolving from reactive to proactive, identifying potential threats and even predicting attacks before they happen,” says Johnstone.

If you’ve determined your current tools and processes aren’t enough to deal with new cyber threats, look for software vendors that incorporate AI to detect and respond to threats in real-time. Advanced network monitoring systems with AI can identify unusual patterns, while generative AI can quickly pinpoint the root cause of network issues. According to Gartner’s Predicts 2024: AI & Cybersecurity—Turning Disruption Into an Opportunity [2], AI-enhanced tools provide continuous threat exposure management (CTEM), which not only helps businesses stay ahead of threats but also reduces the response burden by validating potential risks through simulations and predictive analytics​.

When vetting a platform, here are some questions to ask vendors:

• How does your product use AI to enhance security?
• Can your software detect and adapt to new threats autonomously?
• Are there predictive features in the solution that help anticipate attacks before they happen?

AI-driven cybersecurity solutions can help teams adapt to quickly evolving threats by analyzing vast amounts of data across the network in real time. These systems can automatically adjust security protocols based on threat intelligence, identify patterns of potential attacks, and anticipate vulnerabilities before they are exploited. This dynamic risk management includes features like automated threat prioritization, which evaluates the severity and business impact of each risk, and attack path mapping, which analyzes possible routes attackers could take through a network. AI’s ability to continuously learn and refine these assessments helps security professionals prioritize high-risk exposures and respond immediately, minimizing potential damage. ​[2]

As Johnstone notes, AI’s continuous learning ability means all day and night, improving the accuracy of threat detection, an essential feature for businesses that need round-the-clock security without employing a 24/7 team​.

3. Consider specialized agencies in enhanced security

“When reassessing IT operations, engage a professional to guide you. Develop a risk matrix that involves the entire senior leadership team, understand your client base, and reverse engineer from there. When vetting an agency, avoid consultants who can't simplify their explanations. They should be able to explain things clearly—like to a 10-year-old—and guide leaders at all levels without judgment," Johnstone says. 

The complexity of modern threats often requires specialized knowledge from an external expert. Of the most powerful services these agencies can provide is a vulnerability assessment to identify weak points. According to Gartner's 2024 Strategic Roadmap for Managing Threat Exposure [3], vulnerability management should evolve into a continuous threat exposure management practice, focusing on broader organizational risk rather than just individual technical vulnerabilities​.

In a recent Capterra survey of IT and cybersecurity professionals in Canada, who indicated that their companies have developed measures to defend against deepfake fraud, 71% have implemented regular training and awareness sessions, 69% attend cybersecurity conferences, 60% engaged with industry groups, and 47% implemented simulation exercises.*

If you don’t have the resources internally to take these kinds of steps, seek a managed security provider or consultant to help guide your cybersecurity strategy. Many can even arrange simulation exercises like the one shown below.

AI as an ally: ultimate steps for securing your business

AI is transforming the landscape of cybersecurity, both for attackers and defenders. For small businesses, understanding how to turn AI into an ally can mean the difference between becoming a victim and staying protected.

"Cyberattacks are a certainty, not a possibility. Founders and executives must prepare now, as the likelihood of facing a breach is nearly 100%," says Johnstone.

Johnstone’s insights remind us that while the threats are real, the tools to combat them are within reach. By reviewing your current defences, upgrading your software with advanced AI capabilities, and bringing in expert help when needed, your business can turn AI into a powerful asset.

Here’s how you can take action:

1. Reassess your defences: Regularly review IT policies and systems to stay updated against evolving threats.
2. Leverage AI: Upgrade your tools to include AI-enhanced capabilities to predict and respond to threats.
3. Consider expert help: When in doubt, hire a consultant or MSSP to guide your strategy and fill in the gaps.

With the right setup, AI can be one of your strongest allies in the fight against cybercrime.