The following article was written by the Globe Content Studio and was first published in the The Globe and Mail on February 27, 2023

On a Sunday night last December, Toronto’s Hospital for Sick Children (SickKids) declared a “code grey,” a term used to indicate an IT systems failure. The hospital had been hit by a cyberattack and the criminals responsible were demanding a ransom to restore access. The attack impacted a number of SickKids’ internal clinical and corporate systems, phone lines, and web pages.

While the incident caused delays for lab and imaging results, and affected patient wait times, SickKids later determined that patient care impacts were minimal. This wasn’t luck: Just like any hospital prepares for a healthcare emergency, Sick Kids said it had been preparing for cyberattacks and was able to mobilize quickly.

Still, the cyberattack brought to light a scary reality: No one – not even a hospital full of sick children and their families – is considered off limits by cyber criminals.

“A common refrain in the cybersecurity industry is, ‘It’s not a matter of if, it’s a matter of when,’” says Trish Dyl, director of corporate training and cyber range, Rogers Cybersecure Catalyst, Toronto Metropolitan University’s national centre for training, innovation, and collaboration in cybersecurity. “However, what many business leaders and executives still don’t understand is that no organization is safe from a cyberattack. So, it is absolutely critical for every organization to defend against and respond to emerging cybersecurity threats.”

The Catalyst Cyber Range is helping organizations do just that, with its unique cybersecurity training and testing platform that provides experiential learning opportunities that are both immersive and ultra-realistic, meaning users are immersed in cyberattack simulations to give them practical, up-to-date training. Catalyst Cyber Range is part of the centre’s comprehensive, experiential cybersecurity training offering designed to strengthen an organization’s cyber posture, or its overall cybersecurity strength and resilience.

“Our experiential training at the Catalyst Cyber Range is about keeping participants on the edge of their seats and helping them pay attention in a different way – not just passively,” Ms. Dyl says. “Our team can assess a company’s response to a cyberattack to find the gaps, with an aim to mitigate negative impacts and lessen the organization’s recovery time.”

Historically, cyber ranges have existed only within large organizations, such as financial institutions or Fortune 500 companies. But today, it’s important that small and medium-sized businesses have access to cyber ranges, because companies of every size can be a target. In fact, nearly half (45 per cent) of small businesses in Canada have experienced a random cyberattack in the past year, and 27 per cent have gone through a targeted attack, according to a 2022 study by the Canadian Federation of Independent Business (CFIB).

Given the ever-growing need for cybersecurity training, the Catalyst Cyber Range is designed to bring these once out-of-reach offerings to all organizations. The platform is highly customizable, reflecting the IT environments of the organizations receiving the training, with customized scenarios to reflect the sectors they operate in, whether it’s a ransomware attack at a large hospital or data breach at a small company.

Practice does make perfect when it comes to cybersecurity. According to IBM’s 2022 “Cost of a Data Breach” report, organizations with an incident response (IR) team that regularly tests their IR plan saved an average of US$2.66 million in breach costs compared to those without a plan.

“Practicing the ‘what ifs’ and understanding a cyberattack before it happens is a huge advantage in the learning journey and an important cost-saving exercise,” Ms. Dyl says. “We bring the cyber range concept out of the basement, so to speak, and into the light by offering it to all kinds of organizations. If you invest in the training on an ongoing basis – it’s not one-and-done – it will make a big difference when the time comes to respond.”

Ian McWilliam, an instructor at Georgian College in Barrie, Ont. and a client of the Catalyst Cyber Range, refers to the training as “holistic.” It brings together all the teachings he imparts on his students in one cyberattack simulation, depicting what happens during these events from start to finish.

“When I’m teaching particular areas of cybersecurity, we may focus on that specific silo,” Mr. McWilliam says. “The Catalyst Cyber Range puts it all together. Participants learn about everything that can potentially happen during the attack and defensive measures they can take, and they can monitor what’s happening throughout.”

Being prepared for the inevitable should be a priority, explains Ms. Dyl, and by seeking the right training, organizations can rest assured they have the tools to minimize damage and recover quickly from a cyberattack. “The Catalyst Cyber Range is uniquely designed to show organizations areas they need to improve on, give them the skills to make those changes, and help them be smart about cybersecurity.”

To learn more about the Catalyst Cyber Range and book a cybersecurity training session, visit: https://cybersecurecatalyst.ca/corporate-training/.