The following article first appeared on December 11, 2025, in the Hamilton Spectator.
Canada stands at the center of not one, but three once-in-a-generation transformations.
First, the 2025 Federal Budget promises the largest nation-building investments in decades — new housing, trade corridors, clean power, and municipal infrastructure built at a speed and scale. Second, the National Infrastructure Assessment is resetting the rules for how we plan and finance those systems for the next half-century.
Finally, new technology is making our physical infrastructure, like roads and buildings, more connected to the internet, making digital systems just as crucial as traditional ones like pipes and pavement.
Yet, these generational investments in infrastructure have one serious blind spot: cybersecurity. As Canada invests billions of dollars in national infrastructure projects, we also need to build security in from the start so that these projects are far less likely to be hacked or disrupted.
Canada must treat cybersecurity as core infrastructure — every bit as essential as engineering or climate-resilience work — or we risk spending billions on systems that are fast and modern, but dangerously vulnerable and pose serious threats to public safety.
The Canadian Infrastructure Council’s NIA recent report, What We Heard, sends a clear foundational message: infrastructure planning in Canada is too complex, data gaps limit effective decision-making, and we urgently need more climate-ready, coordinated approaches to investment. While true, those efforts rest on fragile foundations without proper cybersecurity.
Right now, cybersecurity is treated as an afterthought — and that is a dangerous mistake.
Without integrating cybersecurity into the NIA, we risk designing fundamentally vulnerable infrastructure, creating significant risk to public safety, and incurring more costs in the long run.
It’s like building homes without fire codes or bridges without safety inspections — unthinkable in the physical world, yet without checks, probable in the digital one.
Focusing on municipalities, they own nearly three-quarters of Canada’s transportation and water infrastructure, representing a $2.6-trillion. Beyond this investment, the Build Communities Strong Fund will expedite housing construction for municipalities, and that growth will depend on new infrastructure. Physical infrastructure includes digital water and wastewater monitoring, automated building systems, district energy systems with sensors, and other digital tools that support transportation and communication.
Without considering cybersecurity and integrating resilient infrastructure, much of this could be at risk.
Just think: a ransomware attack that shuts down a city’s water system, or perhaps malicious interference with traffic signals, doesn’t just disrupt the service but undermines public safety and erodes trust in government. The municipal infrastructure we have now needs to be retrofitted for cybersecurity. And the new infrastructure to support our new housing requires it too.
In short, more housing requires more cyber investment for municipalities – The recent federal budget addresses municipal growth, but does not address increasing cyber capacity. Most municipalities in Canada struggle to find a budget, expertise, or resources to support their current cyber efforts, let alone significantly more cyber-physical systems that will come with new housing developments.
If we ignore this gap in infrastructure planning and investment now, we hardwire vulnerability into our infrastructure for decades — just like how past decisions that ignored climate impacts have left us with expensive problems to fix today.
Updating the NIA and making a small security investment of 2.5%, for example, can strengthen, smarten, and make our infrastructure projects more cost-effective.
We cannot afford to repeat that mistake.
The NIA is meant to align infrastructure delivery with population growth, climate realities, and economic opportunity. But in a digital society, resilience must also mean digital security.
And resilience without cybersecurity is an illusion.
This is our generational chance to reset how Canada plans for its future. If cybersecurity is sidelined, the work will be incomplete and the risks significant. If we embrace cyber-physical planning, Canada can lead the world in designing infrastructure that is climate-ready and cyber-resilient — ensuring safety, prosperity, and trust for generations to come.
Randy Purse is a Senior Cybersecurity Advisor at Rogers Cybersecure Catalyst, Toronto Metropolitan University’s national centre for training, innovation and collaboration in cybersecurity. Pamela Robinson FCIP RPP, is a Professor at TMUs School of Urban and Regional Planning and a former research fellow at the Catalyst.