Loading story…
NAV Canada, responsible for managing Canada's civil air navigation system, is prioritizing cyber resilience to protect both IT and OT systems amid increasingly complex cyberthreats. CISO Tom Bornais emphasizes that achieving perfect security is unrealistic; instead, the organization focuses on strong cyber hygiene, comprehensive understanding of operational systems, and robust incident response capabilities to minimize the impact of potential attacks. Collaboration across departments and executive alignment are highlighted as essential, with simulation exercises used to improve coordination and build trust between operational and security teams.
Vendor and supply chain risk management is identified as a critical attack vector, prompting NAV Canada to implement rigorous oversight and due diligence processes. The organization’s approach is guided by resilience rather than perfection, leveraging tabletop exercises to enhance security operations and ensure the continued safe operation of Canada’s aviation infrastructure. These efforts are discussed in the context of the upcoming OTsec Canada Summit, where Bornais will share further insights on building cyber resilience in critical infrastructure sectors.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations worldwide are facing an evolving threat landscape, with cyber adversaries leveraging artificial intelligence and automation to increase the speed and scale of attacks. Large enterprises have made significant investments in cybersecurity, deploying advanced solutions and dedicated personnel, while small and medium-sized businesses (SMBs) often struggle to keep pace due to limited resources. This disparity has led to a widening gap in cyber-resilience, making SMBs particularly vulnerable to cyber threats. Security hardening has emerged as a critical strategy for organizations, especially those with constrained budgets, to reduce their attack surface by properly configuring systems and networks. Essential measures include enforcing strong authentication and authorization policies, implementing strict password requirements, and minimizing unnecessary services and open ports. Meanwhile, the concept of cyber resilience has shifted from merely withstanding attacks to ensuring rapid recovery and continuity of operations amid persistent, disruptive threats. Boardrooms are increasingly focused on questions of recovery and service resumption, driven by new regulations such as NIS2 and the UK Cybersecurity and Resilience Bill. Research indicates that 86% of recent cyber incidents involve deliberate attempts to disrupt core operations, with attackers able to exfiltrate data in under an hour in many cases. The proliferation of nearly 9 million new threats daily has compressed defenders’ response windows from days to minutes, challenging traditional security postures. To address these challenges, organizations are urged to adopt a new defensive playbook that leverages AI for both detection and resilience, while also fostering collaboration across IT and OT teams. International standards like IEC 62443 and ISO/IEC 27001 provide frameworks for aligning security practices and managing third-party risks. Comprehensive asset inventories and software bills of materials are recommended to maintain an accurate view of operational technology (OT) environments, enabling more effective risk assessments and prioritization of critical systems. Joint guidance from agencies such as CISA and the UK NCSC emphasizes the importance of architectural controls and cross-team coordination to secure OT systems. Ultimately, a combination of security hardening, regulatory compliance, and adaptive resilience strategies is essential for organizations to withstand and recover from the relentless pace of modern cyber threats.
Jun 29, 2026
Organizations are facing a rapidly evolving cyber risk landscape as the boundaries between IT, operational technology (OT), Internet of Things (IoT), and supply chain systems blur. The proliferation of connected devices, such as cameras, badge readers, HVAC systems, and factory controllers, has significantly increased the attack surface for enterprises. Business demands have driven the integration of IT, OT, and IoT, enabling telemetry to inform analytics and automation, but also concentrating dependencies on critical control planes like cloud consoles and APIs. This interconnectedness means that a single compromised identity provider, software updater, or remote management tool can serve as a single point of failure, potentially impacting thousands of endpoints and critical business processes. Security leaders emphasize the importance of maintaining a living inventory of assets, applying least privilege principles, and segmenting networks by function and criticality to mitigate these risks. Unknown or unmanaged devices should be treated as unsafe until proven otherwise, and where devices lack robust security features, organizations are advised to broker connections through secure gateways. The challenge is compounded by resource constraints and the long lifecycles of many IoT and OT devices, which often cannot be easily updated or replaced. The expansion of cyber risk also extends to the supply chain, where third-party vendors, contractors, and service providers can become entry points for attackers. Recent high-profile breaches have demonstrated that adversaries exploit trusted relationships to infiltrate organizations, with the fallout often affecting the victim company regardless of where the breach originated. This complexity is frequently invisible to the public and regulators, leading to reputational damage and loss of narrative control for affected organizations. Effective cyber readiness now requires extensive preparation, including scenario exercises, communication planning, and training to operate under pressure. The shift from endpoint-centric to control plane-centric risk management reflects the need to address the realities of modern, interconnected business environments. Organizations must adopt an "assume breach" mindset and focus on resilience and recovery planning, not just prevention. The evolving threat landscape demands that security strategies account for the full spectrum of connected assets and the intricate web of dependencies that define today's enterprises. As the definition of cyber risk continues to expand, so too must the approaches to visibility, segmentation, and incident response. Ultimately, the ability to manage and recover from cyber incidents hinges on preparation, visibility, and the recognition that every connected asset and relationship represents a potential risk vector.
Jul 12, 2026
Operational technology (OT) environments, such as manufacturing lines, refineries, pipelines, and rail control systems, are increasingly adopting advanced cyber defense strategies to address the unique challenges posed by modern cyber threats. Traditional perimeter-focused security models are being replaced by breach-ready cyber defense approaches that assume compromise is inevitable and prioritize rapid containment and resilience. This shift is driven by the recognition that OT systems often involve long-lived equipment, complex dependencies, and components that cannot be easily patched, making them particularly vulnerable to sophisticated attacks. At the CS4CA Europe conference, industry experts highlighted the growing need for virtual segmentation in OT environments as a practical means to implement zero trust principles and contain threats before they can propagate. Virtual segmentation allows organizations to enforce security boundaries within heterogeneous OT networks, even when physical segmentation is impractical or impossible. The approach emphasizes mapping attack paths, reducing the attack surface, and controlling lateral movement to prevent breaches from escalating. Regulatory bodies like CISA have updated their guidance to encourage dynamic, risk-based segmentation strategies tailored to the operational realities of OT. In these environments, safety and operational continuity are paramount, often taking precedence over traditional IT priorities such as data integrity and comprehensive patching. As OT systems increasingly connect to the cloud and integrate artificial intelligence, the attack surface expands, necessitating more agile and resilient defense mechanisms. Breach-ready strategies also include rapid response measures such as quarantining affected zones, isolating unaffected systems, and ensuring robust recovery and failover capabilities. The ultimate goal is to prevent cyber incidents from resulting in catastrophic outcomes, such as loss of life, environmental disasters, or disruption of critical national infrastructure. Industry practitioners are urged to assess their breach readiness, identify hidden lateral attack risks, and develop visual roadmaps for remediation. The convergence of IT and OT security teams is seen as essential for operationalizing zero trust and maintaining production while managing cyber risk. These evolving practices underscore the critical importance of proactive, layered defenses in safeguarding the foundational systems that underpin modern society.
Jun 29, 2026