Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Canada’s critical infrastructure cybersecurity rules are becoming more explicit — and more enforceable. Historically, these organizations have navigated a patchwork of sector-specific requirements, privacy breach reporting rules, regulator guidance, and voluntary frameworks. Bill C-8 raises the stakes by creating statutory cybersecurity obligations for designated operators of critical cyber systems.

In March 2026, attackers from the TeamPCP group compromised Trivy (CVE-2026-33634) — a widely-deployed open-source vulnerability scanner running in thousands of CI/CD pipelines — and turned it into a credential harvester. SSH keys, Kubernetes secrets, cloud tokens — secrets accessible to any pipeline that ran a compromised version — were exposed. The attacker retained access long enough to exfiltrate newly rotated secrets before the window closed.

The CLOUD Act compels US-incorporated vendors to hand over data on request, regardless of where it's hosted. Here's why vendor jurisdiction matters for CTI.

On June 2, 2026, President Trump signed Executive Order 14409, "Promoting Advanced Artificial Intelligence Innovation and Security." The framing is innovation first. But for federal network and security teams, the practical reality is a short, specific timeline to harden government systems, with AI now active on both sides of the cybersecurity equation. The deadlines are not aspirational.

The CSRB has cleared the House of Commons and Royal Assent is expected before the end of 2026. CYJAX breaks down scope, reporting timelines, penalties, and how threat intelligence underpins compliance.

The notification of the Digital Personal Data Protection (DPDP) Rules, 2025, marks a major turning point in how businesses in India collect, use, and safeguard personal data in the digital ecosystem. Together with the Digital Personal Data Protection (DPDP) Act, 2023, these Rules create a rights-based, consent-driven framework that places citizens at the centre of data processing while still enabling responsible innovation and growth in the digital economy.

As Canada strengthens privacy protections and enforcement, organizations must find a way to accelerate AI innovation while maintaining continuous visibility into how customer data is collected, shared, and protected. Canada’s proposed Bill C-36 is about more than privacy regulation. It reflects a broader challenge facing governments, regulators, and businesses around the world.

The UK’s Cyber Security and Resilience Bill is moving through Parliament and is expected to receive Royal Assent in the 2026–27 session. If you work in IT or security, you’ve likely already heard about it. If your organisation isn’t a hospital, utility, or bank, you may assume it doesn’t apply to you. However, no matter what field you are in, its worth taking a second look and closely evaluating how the legislation may affect you.

In 2023, India’s Parliament approved and published The Digital Personal Data Protection Act (DPDPA). In many ways, the DPDPA is similar to other regulations, like the General Data Protection Regulation (GDPR). It establishes a similar data subject, or in this case Data Principal, rights of notice, consents, access, correction, and erasure. In other ways, the DPDPA creates unique definitions of and requirements for organizations that collect, process, and share personal information.

An EU AI Act compliance checklist is a structured framework that helps organisations systematically identify, classify, and govern all AI systems within scope of Regulation (EU) 2024/1689. It covers AI system inventory, risk classification (unacceptable, high-risk, limited, and minimal), conformity assessment requirements, technical documentation (Annex IV), human oversight obligations, GPAI model obligations, and post-market monitoring.