QueryTel Inc.

In 2024, a Canadian tribunal ruled against Air Canada after its chatbot gave a customer incorrect information about a bereavement fare refund.

Air Canada argued its chatbot was a separate legal entity that it could not be held responsible for.

The tribunal disagreed. The organization is responsible for what its AI does.

65% of AI tools currently operating inside Canadian organizations are doing so without IT approval. Shadow AI already accounts for 20% of all breaches in 2025, with organizations facing costs averaging $670,000 more than standard incidents. And 60% of organizations cannot terminate a misbehaving AI agent once a governance failure is detected.

Canada's federal AI legislation is still being developed. The liability is not waiting for it to arrive.

The latest edition of Canadian Cyber Risk Insights breaks down the regulatory vacuum Canadian organizations are navigating, the shadow AI crisis building inside most organizations right now, and what a practical AI governance framework looks like for Canadian organizations that cannot wait for federal legislation to tell them what to do.

AI Without Governance: The Liability Is Already Landing. Canada's Artificial Intelligence and Data Act died on the order paper in January 2025. A new Minister of Artificial Intelligence and Digital Innovation was appointed in May 2025.

🚨 What if the CAPTCHA asking you to prove you’re human is actually testing whether you’ll follow instructions?

Attackers are increasingly using social engineering instead of sophisticated exploits — convincing users to open a terminal, paste a command, and execute it themselves.

The TerminalFix campaign is a strong reminder that one seemingly harmless action can become the starting point for a much bigger security incident.

The rule is simple:
If a website asks you to open PowerShell, paste a command, or execute something to “verify” yourself — STOP.

Your employees are often the first line of defense against threats like these.

🔐 Is your organization prepared to defend against attacks that target both your technology and your people?

Talk to QueryTel at +1 844 447 8379 about Managed IT Services and cybersecurity solutions designed to help keep your business secure.

👉 Stay aware. Stay protected. Stay ahead.

Labour Day | September 7, 2026

Today, we recognize the dedication, hard work, and contributions of workers who continue to drive progress and strengthen our communities.

A moment to appreciate the people behind every achievement and every step forward.

🚨 22,000+ Microsoft Exchange servers are exposed. Is yours one of them?

A high-severity vulnerability, CVE-2026-62911, is putting unpatched Exchange environments at serious risk.

Attackers could potentially take over user mailboxes, read emails, send messages, and download attachments.

With 21,899 Exchange IPs reportedly still exposed and unpatched, this is a security issue businesses cannot afford to overlook.

Now is the time to ask:

🔹 Is your Exchange server fully patched?
🔹 Is it exposed to the internet?
🔹 Are your mailboxes properly protected?

Don’t wait for a security incident to find out.

🔐 Secure your Exchange environment. Protect your business.

👉 Talk to QueryTel today at +1-844-447-8379 about your IT security needs.

Your privacy team is reviewing breach notification obligations.

Your security team is managing an active alert.

Neither team knows what the other is doing.

By the time the alert is confirmed as a breach affecting personal information, the 72-hour PIPEDA reporting window has been running for 48 hours, and no one on the privacy side knows it started.

This is not a hypothetical scenario. It is the most common compliance failure pattern the OPC is seeing across Canadian organizations in 2026 as complaint volumes grow 20% year over year and multi-regulator joint investigations become the new normal.

The latest edition of Canadian Cyber Risk Insights breaks down why the structural separation of privacy and security has become a regulatory liability, the three convergence points where that separation creates the highest risk, and what integrated privacy and security governance looks like for Canadian organizations navigating overlapping federal and provincial obligations.

Canadian Organizations Have a Privacy Team and a Security Team. In 2026, That Structural Separation Is a Regulatory Liability. The convergence of privacy law and cybersecurity governance in Canada has accelerated faster than most organizational structures have adapted. Privacy compliance and security governance were once treated as distinct functions with different owners, different budgets, and different reporting lines.

Cybersecurity conversations tend to focus on ransomware and malware — but the numbers tell a different story.

In Canada, Business Email Compromise (BEC) — scams where someone impersonates a trusted contact to trick you into a fraudulent payment — accounted for $530 million CAD in reported losses last year. No malicious code, no breach of your systems, just a well-crafted email exploiting trust and urgency.

It's a reminder that strong technical defenses only go as far as the awareness of the people using them. A few habits go a long way:
Verifying payment changes by phone, questioning urgency, and double-checking sender domains before acting.

We put together the common red flags below — worth sharing with your finance and operations teams.

👉 querytel.com

AI-powered phishing is changing the way cyberattacks reach businesses.

Even when traditional email filters do their job, sophisticated phishing attacks can still make it into an inbox. The real danger begins when a user clicks, credentials are compromised, and suspicious activity goes undetected.

At QueryTel, we believe effective cybersecurity goes beyond the inbox. By combining identity protection, threat detection, continuous monitoring, and rapid incident response, businesses can detect threats earlier and respond before they become costly breaches.

Don’t just filter the threat. Detect what happens next.

🔹 Protect your users
🔹 Monitor suspicious activity
🔹 Detect threats across your environment
🔹 Respond before damage spreads

Ready to strengthen your cybersecurity?
Talk to QueryTel +1-844-447-8379 today for a security assessment.

MFA is enabled. So why are attackers still getting in?

MFA is one of the strongest layers of account protection—but it only works when it’s enforced across every authentication path.

Password-spraying attacks are evolving, targeting authentication gaps, legacy protocols, and overlooked access points to bypass the protection businesses rely on.

The takeaway is simple:
🔹 Enforce MFA everywhere
🔹 Disable legacy authentication
🔹 Monitor every sign-in and authentication attempt
🔹 Identify and secure gaps before attackers do

At QueryTel, we help businesses strengthen their identity security, protect Microsoft 365 environments, and continuously monitor for threats.

Don’t just enable MFA. Secure every path to your business.

📩 Talk to QueryTel +1 844 447 8379 about strengthening your organization’s cybersecurity.

Canadian organizations are managing vendor risk with a form they fill out once a year.

Third-party involvement in breaches doubled from 15% to 30% in a single year. The average vendor breach takes 117 days to be publicly disclosed after discovery. And 26,000 organizations were downstream victims of vendor breaches in 2025 without ever being publicly named.

A completed questionnaire tells you what a vendor was willing to say about their security posture on one specific day. It tells you nothing about what changed the following week.

The latest edition of Canadian Cyber Risk Insights breaks down why the annual questionnaire model has structurally failed, what a mature third-party risk program looks like across the full vendor lifecycle, and what Canadian organizations need to build before Bill C-8 supply chain obligations start flowing through their client contracts.



https://www.linkedin.com/pulse/canadian-organizations-managing-vendor-risk-form-fill-afshan-anwar-ki45

Canadian Organizations Are Managing Vendor Risk With a Form They Fill Out Once a Year. Third-party risk management has become the defining governance gap in Canadian organizational security. Annual questionnaires, checkbox compliance, and contract clauses are the tools most organizations are using to manage a threat that has doubled in a single year and now takes an average of 117 day

Attackers don’t always use the same tools, techniques, or paths.

They adapt.

A security control may successfully block a known attack pattern — but what happens when the attacker changes their approach while pursuing the same objective?

That’s why cybersecurity can’t rely on prevention alone. Businesses need to understand how threats behave, how they evolve, and what happens after an attacker gets inside.

At QueryTel, we help businesses strengthen their security posture through:

• Managed IT Services
• Cybersecurity Protection
• 24/7 SOC & Monitoring
• Threat Detection & Response
• Cloud & Network Security
• IT Consulting & Technology Strategy

The goal isn’t simply to block yesterday’s attacks.

It’s to be prepared for what attackers do next.

Stronger security. Smarter monitoring. Proactive protection.