This piece first appeared in The Hill Times on April 14, 2026.
In modern warfare, defence capability is digital capability.
A submarine is only as effective as the networks that connect it. A drone is only as useful as the data link that guides it. A fighter jet is only as lethal as its software.
Today, every soldier carries computers with them into battle. Every military platform — from sea-floor sensors to orbiting spy satellites — is connected.
This hyper-connectivity creates hyper-exposure. Battlespace networks are essential, complex, and vulnerable. In combat, effective cybersecurity can be life or death.
Effective battlefield cybersecurity starts far from the front lines: it starts in the defence supply chain.
Every organization in the defence supply chain must be secure from infiltration, corruption, and espionage, and every product developed and manufactured in that supply chain must stay cybersecure under relentless attack.
This means that security requirements must be stringent, even for the very smallest of companies competing hard to sell into the growing Canadian defence market.
We have seen adversaries target the weakest link, often a smaller subcontractor, to gain access to sensitive data or disrupt operations. Trusted supplier status now hinges on digital resilience. This is a major challenge.
As the Government of Canada’s new Defence Industrial Strategy moves from policy to action, thousands of Canadian SMEs (manufacturers, software developers, tech startups, advanced materials firms) will encounter increasingly stringent cybersecurity requirements from prime contractors and government buyers. They will be asked to demonstrate compliance with rigorous standards. They will risk exclusion from major contracts not because their products are inadequate, but because either their organizational or product cybersecurity is lacking.
Overseas, our allies are also tightening procurement rules. A single compromised supplier can jeopardize an entire program.
Innovate brilliantly, sure, but fail a cybersecurity audit, and you’re out.
This is not a reason to lower the bar. In defence, sacrificing security for speed is a false choice. Equal investments must go toward ensuring that new capabilities are secure, resilient, and trusted.
To make matters worse, Canada’s defence procurement ecosystem is notoriously complex. Multiple departments and agencies are involved, making the process profoundly different from other government operations. It involves security clearances, controlled goods regulations, industrial security programs, and more.
Many innovative Canadian companies have never operated in this space before. They will need strategic patience. Major capabilities for the Canadian Armed Forces and the intelligence community will not be rolled out in 12 months. This is a long-term investment that will take years, even decades.
If we want SMEs to make that commitment — and we need them to, if we want our Defence Industrial Strategy to succeed — we must meet them halfway.
First, cybersecurity must be embedded at the forefront of innovation.
SMEs must design secure-by-default products and systems, not bolt-on protection after the fact. As defence technologies evolve, SMEs must anticipate future compliance and threat requirements. Only future-oriented SMEs will thrive.
Second, Canadian governments must invest in people.
Tech without talent doesn’t work (and it’s been tried). SMEs need access to well-trained cyber operators and cyber professionals, and Canada’s workforce strategy must align with its defence ambitions.
If we fail to supply skilled cyber practitioners to Canada’s SME defence suppliers, we will not have a sovereign defence sector.
Third, SMEs must remain resilient with the same focus they bring to innovating.
SMEs that build adaptive governance, continuous cyber monitoring, and rapid breach response capabilities into their operations will be best positioned to grow alongside Canada’s defence investments.
Finally, governments must recognize that compliance is a necessary investment.
For an SME, implementing robust cybersecurity controls, undergoing audits, and maintaining certifications can be a significant financial burden. Targeted government support (through training programs, advisory services, or streamlined guidance) can ensure that capable Canadian SMEs are not shut out simply because they lack resources to navigate a complex landscape of cyber requirements.
Building up cybersecurity within Canadian SMEs and their products will be a key determinant of success for the Defence Industrial Strategy, and will drive success where it counts most — in the networked battlespace where Canadian soldiers will fight.
Charles Finlay is the Founding Executive Director of Rogers Cybersecure Catalyst at Toronto Metropolitan University.
Daniel Blanc is a Senior Advisor to the Catalyst and the former Director of National Security and Chief of Staff Operations at CAF Cyber Command.