The digital infrastructure that powers our daily lives, from banking to healthcare to local government, is under constant pressure from an increasingly complex and coordinated web of cyber threats. These risks no longer concern only major corporations or national agencies; they affect every organization, big or small. From hospitals and municipalities to small-town retailers and construction firms, all organizations are now potential targets.

But what if, instead of merely reacting after a breach, we focused on sharing the right information early enough to prevent one?

This was the theme that emerged in my recent conversation with Robert (Bob) Gordon, Strategic Advisor to the Canadian Cyber Threat Exchange (CCTX). Drawing on decades of experience across government and industry, Gordon supports a trust-based approach to cyber threat sharing. One that focuses on enabling prevention and resilience across all sectors and business sizes.

In this article, we explore why a made-in-Canada cyber threat sharing network is not just desirable, but essential. We look at how such a network must go beyond traditional post-incident reporting to foster a culture of proactively exchanging insights, signals, and experiences.

Why Today's Threats Demand a New Kind of Collaboration

Bob Gordon begins by outlining the shifting landscape of cyber threats. "Cyber attackers are no longer lone individuals," Gordon notes. "They're organized groups, often operating like businesses themselves." These groups, whether state-sponsored or financially motivated, are now leveraging sophisticated tools, including AI, to launch increasingly realistic and targeted attacks.

Simultaneously, attackers are leveraging AI and automation to scale their operations. Phishing emails have become more sophisticated, blending seamlessly into the daily flow of workplace communication. This growing realism increases the likelihood of successful compromise.

"All companies are now vulnerable," Gordon explains. "It's not just about protecting secrets; it's about preserving access to your own data, your operations, your business continuity."

And it's not just the threat actors who have evolved. Technology has made it easier for attackers to weaponize everyday tools. AI can now generate near-perfect phishing emails. Automation enables rapid scaling of attacks. Social engineering is more convincing than ever.

"Gone are the days when a phishing email was riddled with grammatical errors. Now it looks like an internal memo," Gordon warns. 

Rethinking Threat Sharing: From Reaction to Prevention

Traditional models of threat sharing have largely focused on what happens after a breach. While post-incident reporting plays a role, its utility is limited to retrospective analysis. In contrast, a prevention-focused model aims to stop incidents before they start... or at least reduce their impact.

A prevention-first approach to cyber threat sharing includes:

• Sharing early warning signals and threat indicators
  
  
• Exchanging lessons learned from internal implementations
  
  
• Collaborating on awareness strategies for employees and customers
  
  

The goal isn’t just to contain damage. The ultimate goal is to prevent it entirely or to minimize its operational and reputational cost.

Aligning Objectives Across Diverse Sectors

While it may seem like healthcare, finance, and telecommunications operate in silos, Gordon emphasizes that the prevention mindset cuts across all industries. The core cybersecurity goals remain consistent: keep adversaries out, detect breaches early, and recover operations quickly. These universal objectives apply equally to financial institutions, healthcare systems, telecommunications networks, and beyond.

"Every organization wants the same three things: keep the attackers out, detect when they get in, and recover quickly," he says.

That includes being aware of the broader digital ecosystem. Your supply chain, your customers, even your cloud service providers—any one of them can be a weak link.

Supply chain and customer relationships introduce additional risk. Even if an organization maintains strong internal controls, a compromised vendor or poorly informed user can become an entry point for attackers. That’s why cross-sector information sharing is essential. Not just within an industry, but between them.

CCTX supports this by facilitating working groups where members discuss best practices, threat communication strategies, and lessons learned. By doing so, organizations can align their outreach efforts and reinforce their collective defences.

Motivation Through Value, Not Mandates

The introduction of Bill C-8 (2025) has generated discussion about whether regulatory compliance alone is enough to build a resilient cybersecurity culture. While mandates can compel action, they often result in a checklist mentality doing the minimum to avoid penalties.

Instead, the CCTX model emphasizes value-driven participation. When organizations see measurable returns, whether in reduced downtime, quicker threat detection, or strategic benchmarking, then they’re more likely to contribute meaningfully.  

Demonstrating how shared intelligence has prevented attacks, improved communication, or saved implementation time fosters a deeper commitment. Creating a space where professionals can validate their approaches or learn from peers reinforces that participation is a strategic asset, not a burden.

"People need to see the benefit at a human level. When they realize, 'This intel helped me make a better decision in front of my boss,' that's when the culture starts to shift," Gordon says.

Gordon believes the better path is to show value:

• Show how shared insights save time and money
• Highlight success stories where early warnings helped avoid major incidents
• Promote the idea that collaboration makes everyone stronger, not weaker

What Organizations Can (and Should) Share

Not all shared data must be complex or sensitive. Valuable contributions often include:

• Technical Indicators: Automated feeds of indicators of compromise (IOCs), including malware signatures or suspicious IP ranges, which others can use to bolster their defences.
  
  
• Operational Insights: Tips from rollout experiences, such as overlooked installation prerequisites or unexpected implementation delays.
  
  
• Campaign Strategies: Materials used for phishing prevention or customer security awareness.
  
  
• Product Evaluations: Member feedback on new technologies or detection tools.
  
  
• Threat Landscape Observations: Insights from aggregated data such as dark IP analysis to identify patterns in attacker reconnaissance efforts.

This range of input spanning both technical and experiential domains offers organizations multiple ways to contribute based on their capacity and comfort.

"The point is, not everything you share has to be deeply technical or sensitive," Gordon clarifies. "Even small contributions can have a big impact."

Inclusion of Small and Medium Businesses

Cybersecurity cannot be the domain of large institutions alone. Smaller companies, municipalities, schools, and service providers are all viable targets and essential parts of the national digital fabric.

CCTX recognizes this and structures participation accordingly. Nearly 75% of its members are small to medium-sized organizations, and  the CCTX has even reserved a seat on its board for a representative from this segment, ensuring their needs are heard and addressed.

Tailored products and simplified data formats allow organizations with limited resources to participate meaningfully. Importantly, their insights are no less valuable. In many cases, these companies face unique challenges that can yield crucial lessons for the broader community.

Reducing Barriers to Participation

Smaller organizations often cite reputational risk and resource constraints as reasons for not engaging in cyber threat sharing. "Reputational risk is a big fear," Gordon adds. "But with anonymization and strict confidentiality agreements, we remove that friction."

CCTX addresses these concerns in several ways:

• Anonymized Contributions: Default anonymity helps protect contributors’ identities unless they opt to disclose.
  
  
• Legal Protections: All participants sign service agreements that establish clear boundaries around how shared information is used.
  
  
• Discretionary Disclosure: Members determine what to share, when, and in what format.
  
  

These measures help build the trust necessary to enable open communication. When organizations know they’re operating in a protected, mutually respectful environment, they’re more likely to contribute consistently.

The Invisible Wins: When Sharing Prevents Harm

The success of proactive sharing is often difficult to quantify because its goal is to prevent visible consequences. An effective early warning or patch alert may stop a breach entirely. Organizations avoid public fallout, operational disruption, and regulatory scrutiny.

Community-driven intelligence can also save time and resources. Learning from a peer’s mistake may spare an organization weeks of troubleshooting. Gaining insight from a major bank or telco can help a startup scale securely without hiring a full-time security team.

In these ways, collective intelligence becomes a force multiplier. Organizations of all sizes benefit from shared visibility, shared strategy, and shared vigilance.

"When something gets blocked because you had the intel in time, that incident never makes the news. And that’s the point."

The beauty of proactive sharing, according to Gordon, is that its success is often invisible.

The Road Ahead: Cyber Resilience as a Canadian Imperative

Cyber resilience in Canada cannot be an isolated effort led by a handful of large players. It must be an integrated, inclusive strategy involving every sector, size, and region. As the digital threat landscape intensifies, so too must our commitment to sharing and collaboration.

A made-in-Canada cyber threat sharing network like CCTX represents not just a tactical response to today’s threats, but a strategic vision for national resilience. It promotes a culture where organizations support each other not out of obligation, but from an understanding that in cybersecurity, isolation is risk, and collaboration is strength. The CCTX isn’t just a repository of alerts; it's a living ecosystem of knowledge, collaboration, and mutual defence. And as threat actors grow smarter, faster, and more organized, our best response is to do the same.