Cisco Canada CTO: Cybersecurity’s biggest problem isn’t a lack of technology

Robert Dutt: Hello, and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last sixteen years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show.

Canadian businesses are spending more money on cybersecurity. They’re investing in new tools, new capabilities, and increasingly, new technologies powered by artificial intelligence.

But are they actually getting any better at defending themselves?

New research from Cisco suggests the answer is complicated.

The company’s Relentless Defense report found that 92 per cent of Canadian organizations experienced a business-disrupting cybersecurity event over the past year. Just 13 per cent say they’re able to update their security controls in real time or near real time as new threats emerge, and nearly half say they’ve increased their cybersecurity spending over the last two years, only to see the number of incidents remain the same.

But perhaps the most interesting finding is that the biggest obstacle to better cybersecurity may not be technology at all. It may just be the organizations themselves.

Cherif Gress, vice president and chief technology officer for Cisco Canada, joins us to discuss why organizational friction is preventing companies from getting the most out of their cybersecurity investments, and why simply buying more technology isn’t necessarily the answer.

We also explore what this means for managed service providers, from helping customers understand cybersecurity in business terms to establishing clear responsibilities and response procedures before an incident occurs.

And we look at how AI and automation are changing the equation, potentially accelerating security operations while introducing entirely new questions about governance and control.

Let’s get right into it, my chat with Cherif Gress.

Robert Dutt: Cherif, thanks for taking the time. I appreciate it.

Cherif Gress: My pleasure, Robert. Thank you for having me.

Robert Dutt: The Relentless Defense report paints a fairly concerning picture of cybersecurity preparedness, especially at this point in the game, including here in Canada.

Before we get into the individual findings of the report, what was Cisco trying to understand with this research, and what surprised you most about the Canadian results?

Cherif Gress: Excellent question. Thanks, Rob.

I think fundamentally the research was trying to assess our security posture. It’s an international research study to assess 3,000 professionals. So we’re trying to get a feel for what security represents for them and how they’re positioned toward security, especially in the post-LLM era that we talk about, with these frontier LLMs.

And the findings are quite interesting. I think what stands out in terms of the pertinence to the Canadian market itself is the fact that it’s not a lack of technology that’s causing the slowdown.

The friction comes from internal structure, organizationally, in terms of the groups not working as a single unit to face these frontier attacks.

So I think that’s the main resonating point that comes out of the study at this point.

Robert Dutt: One of the more striking Canadian findings was that nine in ten, 92 per cent, I think it was, of organizations experienced a business-disrupting cyber event in the past year.

That’s huge. That’s massive.

What does that tell you about the state of cybersecurity in the Canadian business scene?

Cherif Gress: I think what that tells us is attacks are moving fast, and faster than before. So the need to defend has to match that ability.

And then we see it, and the Relentless Defenders are the ones that come out on top.

Basically, they’re the organizations that have the ability to see all their assets, first of all, because it starts with visibility. The ability to see all your assets in one single pane of glass, and then having the structure and the governance in place to be able to operate as one unit when you’re facing these attacks.

There are multiple different things that can be done from a security standpoint to be able to isolate, segment, and make sure your network does not completely fall out of shape in case of an intrusion.

And this is the type of work that we do a lot with our customers.

Robert Dutt: Something that caught my attention was the finding that just 13 per cent of Canadian organizations can update security controls in real time, or close enough to real time to make it count, when a new risk emerges.

More than half take longer than a day.

What’s slowing organizations down at this point?

Cherif Gress: I think it’s the integration of tools.

Buying all the different elements of security does not give you the speed required. It gives you tools. However, stitching them into a strategy, into a playbook, is important.

Playbooks are huge when it comes to security, because when things go sideways, this is not the time to try to figure out a plan of how do we address this.

This has to be already a page in your book that you execute.

And I think that’s the major element. This is no longer if it happens, it’s when it happens and how you’re going to react to it.

Organizations that are well-oiled from a structural perspective and can operate as one team, where the governance is preset and every team knows exactly what they need to do and when to do it in case an incident occurs, I think that’s what makes a difference.

And this is where we see the numbers go down in terms of preparedness, because we’re stuck on the friction element and we’re trying to solve it with technology, when really additional technology is not going to help you there.

And you’ve seen it, right? Some companies report that despite spending more on technology, the number of attacks and threats has not reduced.

And it’s because they haven’t addressed the elements from an organizational standpoint as well.

So they go hand in hand.

Robert Dutt: Are we at a point where simply spending more money on cybersecurity, especially to your last point there, isn’t necessarily making organizations more secure?

Cherif Gress: Absolutely. I think that’s one of the findings in the study.

It’s organizing your existing assets in terms of security. What do your defences look like? What does the architecture look like?

And not saying that you might not need additional things, but at least doing that already and aligning the organization behind these tools for those almost near-real-time changes, I think that’s the first step.

And then you start building on top of that. If you do need additional controls and governance, you build up on that.

But I think the alignment of the organization alongside the investment from a security standpoint, those are the fundamental elements that the study seems to indicate.

Robert Dutt: That’s been something that a lot of channel partners, be they resellers or MSPs, especially in the MSP space, have been focused on for a long time, integrating those tools and creating a solution out of that which hopefully addresses problems.

But I think you bring up a good point on the culture side of things, and making sure the customer is fully bought in, is fully invested, and is on board with the direction that you’re going.

Cherif Gress: And I think this is where the MSPs can play an outstanding role, in the sense that they have the customer intimacy.

So they need to allow themselves the permission to ask the right questions beyond the technology that they’re selling.

How is that going to be operated? How is the playbook? Can they be an assistant?

Some of these MSPs have extremely mature cybersecurity practices, where they can do best-practice sharing.

But also, from a CX perspective at Cisco, this is some of the services we offer in terms of aligning organizational elements to the security platform that’s put in place.

Robert Dutt: To that cultural point, with only about 35 per cent of Canadian respondents saying that security, IT and business teams are all on the same page, rowing in the same direction around security, first of all, what does an organization that gets this right actually look like?

And secondly, what can I, as an MSP or partner on the outside looking in, trying to help my customers, do to help them get to that state?

Cherif Gress: One of the things that I read in the report that struck me is the fact that some of these technical teams, security teams, are not able to verbalize or summarize the impact of what a security incident could mean to the business.

So how does that translate into business value?

There’s a disconnect between the business leaders and those teams. So I think some work needs to be done to be able to translate each one of those downtime minutes, what it means to the business, in a clear way.

And downtime could mean partial downtime or complete downtime, depending on how major the incident is.

But I think it starts there.

And I think from a channel perspective or MSP perspective, the ability to work with the security teams to help them distill the value of what they’ve invested in, if properly operated, and what does that mean? And if it’s not, what does that mean as well in terms of impact and value to the business?

So I think this is the additional piece where there has to be some hand-holding.

It’s not just buying a firewall and operating it. It’s like, what else are you going to do with this?

And then getting into the nitty-gritty, uncomfortable conversations as well, where basically you have an intruder.

Now, how do we isolate them? How do we make sure that they don’t move east-west in your network and start compromising more systems?

This is all part of the playbook that I referred to earlier, because all these things have to take place before the incident happens, so the teams are well positioned to do that.

And again, I don’t think there’s a lack of investment, but I think there has to be more communication around the potential threats in more business language.

We love geek language when it comes to security. I think it needs to go back to more of a business conversation than just the threat itself.

Robert Dutt: So you’ve got the problem with the different languages being spoken between business and IT, and heaven knows we see enough of that.

Cherif Gress: I mean, you’ve been in the industry, right? This is age-old. It’s not unique to security.

Robert Dutt: Absolutely. And at the same time, maybe there’s the challenge of business leaders not understanding the security side of things deeply enough that the thought is, okay, I’ve thrown money at this, ergo problem solved. Woo-hoo.

Cherif Gress: Yeah, absolutely.

And I think this is the other element. I’m trying to share this study with as many of my customers as I can because it raises the element of there’s an additional layer beyond the technology itself, in terms of how you operate and how you work with the technology across the organization, and not just the team that’s responsible for that technology.

Robert Dutt: So if I’m an MSP working with the CEO or business owner of a customer, what should I be telling them about how to think differently to make their organization more resilient at large?

Cherif Gress: This is a very, very good question because it goes to the core of the topic itself.

And I think, yes, there’s a lot of fearmongering going on right now.

It’s like, the agents are going to go rogue, we’re going to lose everything. There’s so much language going on in terms of fearmongering.

But the reality is, I think instead of using those sensational headlines, if we can bring it down to real metrics in terms of what an incident could represent to the business, this is where you’ll get the attention of a CEO.

It’s almost like the headlines are so persistent and so unanimous that we’ve become a little bit immune to these massive, large, bold headlines.

We need this to be applicable to our own scenario to be able to absorb the real impact of this.

And I think this is where the MSP, sitting with the CEO, can verbalize this in a more intimate setting, understanding what the amplitude of this could mean to their business.

Robert Dutt: Is the impetus on IT, and I’m broadly including partners more on the IT side than the business side for the purpose of this conversation, since solution providers tend to come at things from a technical lens, even if they do have a business focus.

But is the impetus more on the IT side to bring the conversation to the business level, to bring the C-suite level of knowledge up, or is there an opportunity to meet in the middle somewhere?

Cherif Gress: I think it’s meeting in the middle, and I think it’s beyond IT.

I think it’s security folks as well. I think the MSP has to be involved in that conversation as well.

The OEM, to a certain point, can also be pulled into that conversation.

But I think it is a roundtable conversation because this is where the impact can be communicated and translated in a way that many of the participants can understand.

And instead of trying to elevate one group or dumb the message down and lose something in the translation, I think everybody needs to be able to sit around the table and have that unique conversation in terms of the impact.

Robert Dutt: Many Canadian SMBs that MSPs are serving don’t have dedicated security teams, much less a CISO or a SOC or any of that fancy stuff.

They’re depending on MSPs to provide all of those capabilities.

How does that figure into the organizational friction that you’ve identified here?

Is it a solution to it, or does it sometimes create another layer of complexity, in that now you’ve got to take the IT culture, the business culture internally, and match it up with the solution provider’s own processes, culture, et cetera?

Cherif Gress: I think a lot of what you’ve just said has to be in place, but I think it’s also about asking the right questions to your MSP.

What does the current service render for me? Where are the potential risks?

Because there has to be some risk analysis ahead of it as you engage in any service, and understanding where their responsibilities stop and where yours come in as well.

So in terms of an SMB organization, just because you’re buying a turnkey service doesn’t mean you’re completely exonerated from any responsibility.

You have to understand where you might have to have certain people double up as security ambassadors within your organization to make sure that there’s a consistent adoption across the service.

So not just relying on the MSP service, but also having some secondary mechanisms within the SMB to react.

It cannot be ignored.

And I understand the conundrum when it comes to affordability, but this is something that needs to be absolutely looked at.

Robert Dutt: Along those lines of division of responsibility, if I’m an MSP and I detect an active threat against a customer’s environment, there’s a tension between the need to act immediately on that and the customer’s expectation that they get to sign off on what I’m about to do to their systems.

How should an MSP and their customers be thinking about that division of responsibility, especially as they’re, as you say, hopefully thinking about these things before they’re in the trenches with incoming fire?

Cherif Gress: In my opinion, whether the security element sits within the organization or is outsourced to an MSP, I think the composition remains the same.

That playbook discussion has to be in place before, and scenarios must be understood.

So we’re not having to seek approval during the attack, but the playbook indicates that in case of this event, these are the mechanisms we will use ahead of time.

So the preapproval is already obtained. There’s an alignment in terms of trying to remove the friction as much as possible.

When the attack does happen or the systems are compromised, then it’s just execution of the plan rather than figuring out what are we going to do and getting approval.

Not saying that you’re going to be able to cover all scenarios in all cases, but I think a large number of those scenarios can be addressed ahead of time, meaning that you leave the outlier cases for maybe some quick approval-seeking if it’s needed.

Robert Dutt: Yeah. And I know this is a 101-level concept, but make sure that is tested with the customer so you know where the pain points are.

Maybe you don’t discover all of those outlier situations, but you’re going to find some.

Cherif Gress: Yeah, absolutely.

And also, having this conversation ahead of time, the MSP can get a better sense of the customer’s level of education in terms of, are all systems equal in terms of the impact?

And so adding some gradation in terms of the remediation solutions can also be added there as well, depending on the understanding of the customer’s assets.

Robert Dutt: It feels to me like there’s a business opportunity here for MSPs.

If the problem isn’t just that there’s insufficient security technology, if the technology is plentiful, but the inability to coordinate and respond effectively is the challenge, it suggests that maybe MSPs should position themselves less as the provider of product, transactionally, and more outcome-based, delivering cyber resilience, hopefully in a measurable way.

Cherif Gress: Absolutely.

And we’ve seen this in other types of technologies where there’s a collapse of responsibilities, where you join two groups.

Let’s talk about routed optical networks, right?

Typically in any organization, optical networks are operated by a team, IP networks are another team. Routed optical requires that merge of these two groups together.

And the best adoption of these technologies is when the companies have acknowledged that organizationally they need to make changes to be able to align these teams together to get better adoption of technology.

Same thing when it comes to security.

I think there has to be that melding of the different groups together to be able to have that common language across.

And MSPs, again, because of their intimacy and because of their ability to access these customers, need to be able to have this conversation and drive these conversations beyond technology, but more about the adoption and the use of the technology.

Robert Dutt: Any thoughts on how an MSP can best demonstrate that value to a customer?

What metrics should they be measuring and reporting, especially early in the relationship when they can’t say definitively? It’s hard to sell, or it’s hard to show what you’ve protected someone from if they haven’t seen that attack.

Cherif Gress: Yeah, it’s an interesting one.

Fundamentally, I think it goes down to a different type of conversation. And I know it’s been mentioned many times, it’s the consultative approach rather than pushing products and pushing solutions.

I think you need to have that holistic conversation in terms of understanding what’s motivating that investment ahead of time.

And my best sales experiences on a personal level are when I’ve met salespeople who ask me questions before they even propose any kind of solution.

So qualify the environment, ask the tough questions ahead of the conversation to make sure that you’re positioning not only the solution itself, but also how it needs to be operated and how it needs to live within the organization.

And then have the practice that will be able to hold the customer’s hand as they move through the stages of the lifecycle of the solution, from day zero all the way to day two.

Robert Dutt: AI is clearly, as this report shows, changing a lot of cybersecurity, period, on both sides. The pace at which it goes, the sophistication of the attacks, et cetera.

How much of the gap between speed of attack and speed of response can realistically be closed through automation, through better AI on the defence side, especially when the attack side is obviously going to still be ramping and pushing boundaries too?

Cherif Gress: Yeah, so it’s a must. And this is something Cisco is leaning into tremendously.

We’ve actually upped our ability to churn out patches and address CVEs, so the ability to have patches available on a more regular basis, twice a month.

But we’re also providing in-between solutions, solutions like Live Protect, which are essentially workarounds in the configuration that will address specific threats that are out in the wild, to be able to give the customer time to react and update whenever they can.

Because updating systems is something else that we rarely talk about.

Operationally, what used to take months now has to be done in days.

And the last figure I’ve seen in one of the reports, from the time of a declared exploit to the reaction that needs to happen, it’s about eight hours.

So we’re not talking in days anymore. We’re talking eight hours.

Things like Live Protect will provide some buffer for customers so they can get their systems updated accordingly.

But it’s no longer what it used to be. The world has changed now.

These updates need to move a lot faster, and customers will need to adapt to that new speed because they have no choice.

Robert Dutt: Is there a danger that we might automate the detection of these attacks but still leave the response phase stuck behind organizational approval and more legacy mindsets and approaches?

Cherif Gress: That’s a very, very good point and absolutely relevant.

And I think this is where the real threat comes in. The front end has been updated, but the back end still operates manually.

Today, I was just having a conversation with one of our development teams internally where, yes, AI is helping us churn a lot more code than we used to, but the human in the middle who has to validate these elements still has the same workload.

And we have to make sure that these human-in-the-loop elements are not becoming a detriment to the speed, but rather an enhancement of the quality that’s provided by AI.

Robert Dutt: And the next wrinkle that’s certainly arriving this year, that we’ve been talking about for a couple of years but now certainly arriving at scale this year, is the agentic side of things.

As AI agents are more capable of taking action rather than just identifying threats, how do you manage that?

And how do you think about that when you’ve got business or customer culture, process and organization, MSP process and organization, customers’ AI agents, MSPs’ AI agents?

Somehow you have to make a coherent strategy, approach and defence out of that.

Basically, how should organizations and their MSP partners decide what they’re comfortable with letting these systems do on their own, with minimal interaction, to try to be ahead of the game as much as they can?

Cherif Gress: It feels like we just finished the initiative of role-based access and getting people authorized from a human perspective, and then zero trust.

Now we have to play it again and add the agents to the unit, right?

Agents have to be treated the same way, where they need to be trusted and authenticated, and that has to be part of the governance that comes into play.

Agents must be subjected to the same kind of rigor that we’ve implemented on humans, because they also can cause some damage if left unmanaged or unmonitored.

So from a Cisco perspective, we’re deploying a lot of effort in agent identity, the validation to make sure that the agents can perform their tasks as prescribed, but also to detect early when agents start behaving in an erratic or unpredictable way, so we can catch them before the damage is too large or even happens.

So that’s the idea: trust and authentication.

Robert Dutt: Let’s bring this back to the average Canadian MSP and its customers.

If an MSP recognizes these problems in its customer base, and I suspect a lot do, what are two or three practical first steps that they should be doing differently today to improve those customers’ ability to respond to an attack in the current environment?

Cherif Gress: I think governance. Understand the governance in place.

I think this is fundamental.

If there’s one thing that we confirm, it’s that there is no lack of technology. The technology is there, but it’s operating the technology, understanding the governance model that ties it together, and making sure that the teams that sit within that governance framework understand how they need to react and when to react.

I think these are the fundamental pieces that we’re asking people to get educated on.

And this is less about configurations. Yes, network security architecture matters, absolutely. I’m not going to downplay this.

But from what we’re seeing right here, this is not the weakness. I think the weakness is organizational, and it starts with governance.

Governance is not something that you set and forget. It’s something that you continuously go back and revisit, measure, monitor and report on.

And that has to be exposed to the business as well, because they need to feel comfortable that whatever is in place is working as prescribed.

Robert Dutt: And finally for me, if we’re having this conversation a year from now, I don’t actually know the cadence of this research or if it’s going to be something that’s repeated, but let’s say it is and we’re looking back at the state of Canadian organizations’ approach to cybersecurity a year from now.

What would you hope will have changed between October 2026 and October 2027?

Cherif Gress: I’d love to see less friction internally.

I think this is the biggest point.

I hate to see technology lose its luster because of an inefficiency from an organizational standpoint.

There’s a lot of R&D being done to make sure that all the technology that we’re putting out there is working to the best of its abilities, but ensuring that the friction is eliminated allows this technology to really function the way it’s designed.

I think fundamentally this is what I’d love to see for our next year’s report.

Robert Dutt: All right, brilliant. Some good insight into the numbers and some good advice.

Cherif, again, I appreciate you taking the time on this.

Cherif Gress: Thank you, Robert. It’s a pleasure to meet you. Thank you so much.

Robert Dutt: Thanks again to Cherif Gress, vice president and CTO of Cisco Canada, for joining us, and thank you for listening.

There are a few things for me that stood out from this conversation.

First, cybersecurity effectiveness isn’t necessarily a function of how much technology an organization has purchased.

As Cherif points out, many Canadian businesses have made significant investments in security tools, but they’re still struggling to respond quickly and effectively when incidents occur.

The missing piece is often organizational, making sure the right people, processes and technologies are working together with clear responsibilities and a plan that everyone understands.

Second, there’s a significant opportunity here for managed service providers.

MSPs have relationships with their customers that put them in a position to help bridge the gap between technology and business operations.

But that means going beyond simply deploying and managing security products.

It means understanding the customer’s business, helping them assess risk, and having potentially uncomfortable conversations about who’s responsible for what when something goes wrong.

And importantly, those conversations need to happen before an incident, not while an attack is underway.

Finally, AI and automation aren’t going to make those organizational challenges disappear.

In fact, as we increasingly rely on AI agents to identify threats and potentially take action against them, questions about authorization, identity and governance become even more important.

The technology may be moving faster than ever, but organizations and their service providers still need to figure out how to keep up.

If you’re enjoying the podcast, please do subscribe or follow the show wherever you get your podcasts: Apple Podcasts, YouTube, Spotify, and most of the major directories.

And if you have a moment, a rating or review helps other listeners discover us.

Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.