Key takeaways
- On October 1, 2026, Get Cyber Safe (the CSE-led national campaign) launched Cyber Security Awareness Month 2026 under the theme “Your best defence is you”, with AI-driven scams named explicitly as the threat driving the message.
- The campaign’s four weekly themes (recognize threats, strengthen defences, protect information, build community) are a ready-made internal awareness calendar that privacy and security teams can run instead of inventing their own.
- Training and awareness count as organizational safeguards under PIPEDA’s Principle 4.7: investigators ask for evidence of them, so a documented October program doubles as compliance material, not just culture.
The launch, and why this year reads differently
Cyber Security Awareness Month 2026 started October 1 with a theme that is unusually direct for a government campaign: “Your best defence is you.” The announcement puts artificial intelligence in the first paragraph, saying AI is changing how cybercriminals operate and making some scams and online threats “more convincing than ever.”
That framing matters. Rajiv Gupta, head of the Canadian Centre for Cyber Security, said the quiet part out loud: “AI is making some online threats and scams more convincing than ever, but the fundamentals of cyber security have not changed.” His list of what still works is deliberately boring: verify a suspicious message before acting, use strong and unique passwords, enable multi-factor authentication.
I read this as the federal government conceding that the threat conversation has shifted. We spent 2026 watching AI agents probe government websites (including Library and Archives Canada), and the campaign’s answer is not a new technology. It is the human clicking the mouse.
The four weeks are a free program calendar
Most organizations treat Cyber Month as a comms exercise: a poster in October, a phishing simulation nobody remembers. The four weekly themes are actually structured well enough to run as a month-long internal program. Here is the mapping I would use:
| Week | Campaign theme | What your team runs that week |
|---|---|---|
| 1 | Recognize cyber threats | Phishing and deepfake-scam simulation, with a “pause before you click” briefing for every department |
| 2 | Strengthen your defences | MFA enrollment push and password-manager rollout for holdouts; measure enrollment weekly |
| 3 | Protect your information | Data-hygiene sprint: where is personal information stored, who can access it, what leaves with departing staff |
| 4 | Build your cyber security community | Publish your internal scam-reporting channel and run one tabletop exercise on a phishing-led incident |
The week 3 theme is the one privacy teams should own outright. “Make safer choices when banking, shopping or using government services online” is consumer language, but the internal version is a mini data inventory. You already need that map for access requests and breach response. October gives you a business reason to refresh it.
Awareness is a safeguard, not a poster
Here is the compliance angle most teams miss. PIPEDA’s safeguard principle expects protection appropriate to the information’s sensitivity, including organizational measures. When the OPC investigates a breach, one of the standard questions is what training and awareness existed. “We ran Cyber Month once” is not the answer they want. A documented four-week program with attendance, phishing-simulation results, and MFA enrollment numbers is evidence.
Quebec organizations get the same logic through Law 25’s security obligations. And the quote from Defence Minister McGuinty in the launch release (“Cyber security is a shared responsibility”) is a useful sentence to paste into a board update when you need budget: the federal government just told your directors that each of us contributes to collective resilience.
What to do on Monday
- Claim the calendar. Send the four themes to IT and HR before the week ends. One owner per week.
- Run the baseline. Phishing-simulation click rate and MFA enrollment as of today. You cannot show improvement in week 4 without week 1 numbers.
- Write the reporting channel down. Week 4’s theme only works if staff know where to report a suspected scam. If that channel is an email alias nobody checks, fix it now.
- Tie it to the AI scams, not the generic ones. The launch release names AI explicitly. Your week 1 briefing should show one real example of an AI-polished scam, a cloned-voice call or a personalized spear-phish, so staff calibrate to the current threat.
Actionable takeaway: Cyber Month 2026 hands you a government-blessed awareness calendar, an AI-angle framing that matches the actual threat, and compliance cover for the effort. Run the four weeks as a program with metrics, and October stops being a poster and starts being evidence.