Cybercrime has industrialized. On the latest episode of the CanadianSME Small Business Podcast, host SK Uddin sat down with Rafi Wanounou, Regional Vice President for Fortinet Canada, to unpack why Canadian businesses are being singled out, why passwords are finished, and why security has quietly become a fixed cost of staying in business.
A Target, Because We’re Worth Targeting
The threat landscape has not simply grown busier; it has been professionalized. Cybercrime, Wanounou said, has become “a fully industrialized complex” — and Canada’s wealth of resources, technology and intellectual property makes it unusually attractive to the people running it.
His headline statistic is uncomfortable. Canada, he said, is now “the third most targeted country in the world.” He frames it, half-ruefully, as a compliment: it is a testament to the strength of Canadian business on a global stage. It also makes the country an enormous target.
Attacks at Machine Speed
What has changed is not the attacker’s intent but their throughput. AI has collapsed the time it takes to produce a convincing fake — spoofed login pages, cloned financial services portals, the impersonated relative who urgently needs money. Work that once took effort and time now rolls off an assembly line, automatically.
That creates a defensive problem Canadian businesses are visibly losing. Wanounou cited research indicating that 60% of Canadian leaders now say they have lost the ability to respond at the speed threats arrive. “We’re actually capturing maybe half of what’s going on,” he said — and the rest is fingers crossed.
Defence at the Same Speed
The only credible answer to machine-speed attacks is machine-speed defence. Fortinet has been building AI into its products for 15 to 20 years, Wanounou said, and the scale of what it now intercepts is difficult to picture: last year the company blocked more than three trillion attacks aimed at its customers.
“You can only do that number with automation,” he said. For Canadian SMBs, the practical takeaway is that a defensive posture built on human vigilance alone — someone noticing a suspicious email — is no longer a strategy. It is a hope.
The Hygiene That Costs Almost Nothing
Asked for the single step a resource-constrained SME can take immediately, Wanounou did not reach for a product. He reached for a habit.
“Passwords just aren’t secure anymore,” he said. Turn on two-factor authentication — everywhere, on everything — whether by text message or an authenticator app. Consider zero-trust networking, so the business actually knows who is on the other end of a connection. And patch. “Make sure they’re always up to date,” he said of the tools a company has already paid for. In an era of AI-accelerated threats, he argued, unglamorous maintenance is a genuine edge.
Why Security Became a Cost of Doing Business
Many small businesses still file cybersecurity under expensive optional. Wanounou’s counter-argument runs through AI rather than fear.
Over the next five to ten years, he said, businesses of every size will need AI to compete — to improve processes and scale their customer base. But you cannot safely deploy AI on an insecure environment. Security therefore stops being a discretionary line item and becomes the precondition for the thing that keeps you competitive. “It’s a fixed cost of doing business today,” he said.
He expects the bar to rise sharply. Two shifts are coming for Canadian SMEs, in his view: AI capability currently concentrated in large enterprises will filter down to smaller businesses — and the level of security required of an SME will increase roughly fivefold.
Keep the Data in Canada
Fortinet has run global threat intelligence out of Canadian hubs — Burnaby, Calgary and Ottawa — for 25 years, drawing on a domestic talent pool Wanounou clearly rates. “We’re a global security company with the heartbeat of a true Canadian,” he said.
That matters commercially, not just patriotically. The company builds sovereign security options — arrangements in which a Canadian business’s data stays in Canada, and is protected by Canadians. For SMEs weighing vendors, that is a question worth asking out loud.
The Bottom Line: Know Where Your Data Sleeps
Asked for his top advice to owners worried about data security, Wanounou kept it concrete. Know who manages your data. Know what they do with it. Know, physically, where it lives — whether it is in Canada, and how it moves.
“If you can wrap your arms around that,” he said, “you’re a step ahead of the game.” His closing thought was about partnership: in the next five to ten years, who a Canadian business chooses to defend it will matter as much as what it buys.
That was Rafi Wanounou from Fortinet Canada — a vital masterclass on why staying ahead of automated threats requires both smart tools and a smarter security mindset.
To learn more, visit canadiansme.ca, and visit the CanadianSME Small Business Foundation at smbfoundation.ca. A special thank-you to podcast partners UPS and ADP for their ongoing commitment to empowering small businesses across Canada.
Disclaimer: This article is based on publicly available information intended only for informational purposes. CanadianSME Small Business Magazine does not endorse or guarantee any products or services mentioned. Readers are advised to conduct their research and due diligence before making business decisions.
