How Claudiu Popa’s vision for Canadian cybersecurity spans four decades and connects independent assurance, public education, and the ambition to standardize the load bearing pillar of trust services across all business sectors.
For Claudiu Popa, the distance between looking trustworthy and deserving confidence has become a subject of enduring curiosity, and the organizing principle behind his work. A supplier can look credible long before anyone has examined its claims. So can an app, a directory listing, or a convincing message. Trust services are the reliance on independently verifiable evidence that demonstrates legitimacy to the world, because a credible independent company stands behind that guarantee. Unlike cybersecurity business models dependent on explosive growth and astronomical exit valuations, Claudiu’s vision has been the creation of a critical service that would remain a barometer of trust over time.
In 1989, he registered the programming and computer-services business that would become Informatica. Over the following 37 years, it developed into a group of specialist practices addressing cybersecurity, privacy, industrial security, and workforce education. Its published history records the introduction of its standardized Verify risk-assessment methodology in 2002, followed by international audit assignments across 12 countries between 2004 and 2008.
A computer science graduate, Popa’s interests extend beyond systems and software to cyberfraud, surveillance, misinformation, and the techniques through which people are persuaded to accept something as legitimate. His professional biography describes a career combining technical assessments, education, research, and public commentary.
That concern also finds expression in KnowledgeFlow Cybersafety Foundation, the nonprofit he co-founded to make cybersafety and digital media literacy accessible to people who cannot be expected to become specialists themselves. Its work encompasses misinformation, fraud prevention, privacy, and protection against digital exploitation.
The connection between those activities becomes clearer when Popa explains what he has been trying to build.
You trained in computer science. How did that lead to such a broad interest in trust and credibility?
Claudiu Popa: My technical background gives me a habit of wanting to understand what is happening underneath the explanation. What are the assumptions? What does the system actually do? What would demonstrate that the claim is correct?
That curiosity applies just as readily to a business proposition or a persuasive message as it does to software.
I am interested in why something appears legitimate, who benefits from that appearance, and whether the evidence supports it. Cyberfraud, misinformation, propaganda, and deceptive commercial practices all give you reasons to investigate those questions, although they are not interchangeable problems.
The ambition has been to turn that curiosity into something useful to other people. An observation in my notebook has limited value. A method that another professional can apply, or a lesson that helps someone recognize an attempt to manipulate them, can travel much further.
You chose not to pursue mergers or a public listing. What were you trying to preserve?
Popa: The ability to decide what the organization is for.
A merger or a public listing can be a sensible choice for another founder. My interest was in building specialist capability that we could continue to develop and stand behind. I did not want an eventual transaction to become the organizing purpose of the company.
That matters particularly when your work involves examining other people’s claims. An assessor must be able to tell a paying client that the evidence is insufficient, the scope is too narrow, or a conclusion cannot be supported.
Private ownership does not automatically make someone impartial. Independence has to be protected in the work itself. Our published professional code addresses conflicts of interest, work within demonstrated competence, peer review for high-impact assignments, and the obligation to avoid exaggerated reassurance. Those are standards against which clients should judge us.
What I wanted to preserve was the freedom to apply those standards when doing so was inconvenient.
Why describe Informatica as a trust services company rather than simply a cybersecurity business?
Popa: Because the question we help answer is broader than whether a particular security product has been installed.
An organization may have policies, certificates, test reports, training records, and assurances from its suppliers. Someone still has to establish what that evidence actually supports. Does it address the decision being made? Is it current? What was excluded? What remains uncertain?
That is how we use the term trust services: independent professional work that gives people a defensible basis for relying on consequential claims. Informatica’s approach brings together evidence concerning security, privacy, resilience, suppliers, technology, and workforce readiness.
Imagine a small supplier being considered for access to a customer’s sensitive information. The customer needs more than the supplier’s confidence in itself. It needs evidence appropriate to that access and its consequences.
This is an important Canadian business capability. The Canadian Centre for Cyber Security recommends incorporating audits and risk assessments into supply-chain management, regularly reassessing suppliers, and using third-party assessments for critical suppliers.
My view is that qualified, independent assurance belongs among the essential services supporting those relationships. Without someone equipped to examine the evidence, a consequential decision can rest on a persuasive description of arrangements that nobody has adequately checked.
What makes an assessment worthy of that reliance?
Popa: Independence, competence, and a disciplined method have to work together.
An assessor should understand the environment being examined and the limits of their own expertise. The assessment needs a defined purpose, appropriate criteria, documented evidence, and conclusions that another qualified professional can follow.
Standardization is important because a finding should not depend entirely on which individual happens to conduct the review. But it does not mean treating a factory, a school, and a software company as identical. Recognized assessment approaches, including NIST’s security and privacy control assessment procedures, provide structure while allowing the work to be tailored to the organization and its risks.
Through Datarisk’s Verify process, we examine existing evidence or assess controls and safeguards. Where the evidence warrants it, a Statement of Trust records the assessment’s scope, basis, limitations, date, and validity period. That makes the conclusion inspectable without publishing sensitive internal material.
The distinction I want clients to understand is straightforward: they are paying for rigorous work, not purchasing a favourable conclusion.
A professional opinion becomes useful because someone is accountable for how it was reached.
Why organize the work into Datarisk, Managed Privacy Canada, OTSEC, and WorkLife Learning?
Popa: Because competence has boundaries, and I wanted the organization to respect them.
Datarisk Canada concentrates on cybersecurity risk and assurance. Managed Privacy Canada examines a different set of responsibilities, including data practices, privacy assessments, consent records, retention, and accountability. A technically protected system can still raise serious questions about what information it collects and how that information is used.
OTSEC addresses industrial and operational environments, including control systems, utilities, transportation, and manufacturing. WorkLife Learning develops the knowledge of the employees and managers expected to put security and risk-management decisions into practice, through professional courses, workshops, and continuing learning.
I did not want one broad label to conceal those differences.
The practices need enough separation to develop genuine depth, and enough coordination to deal with problems that cross their boundaries. A supplier relationship, for example, may involve cybersecurity evidence, personal information, operational access, and employee responsibilities at the same time.
The leadership task is to bring the right expertise together without pretending that expertise is interchangeable.
What did building beyond your own technical expertise demand of you?
Popa: Getting knowledge out of my own head.
A founder becomes a constraint when every important judgment depends on their personal availability. Building an organization requires methods, documentation, capable colleagues, and enough clarity that people can exercise sound judgment without waiting for the founder to enter the room.
Our investment in structured workplace education goes back to 1998, when WorkLife Learning began with an interactive catalogue of 100 seminars. That was an early expression of the same ambition: take what specialists know and organize it so others can use it.
The difficult part is preserving the quality of judgment as the work expands. You need people who will question assumptions, including yours. You need to distinguish an efficient process from an abbreviated investigation.
For me, scale should mean that more people can benefit from dependable expertise. A larger organization that produces less defensible conclusions would not represent progress.
Where does KnowledgeFlow fit? Is it your passion project, or part of the same undertaking?
Popa: It is deeply personal, but the underlying question is the same: who has access to the knowledge needed to make an informed decision?
A business can commission an assessment. A young person navigating an unfamiliar platform, a senior receiving a convincing message, or a community organization with limited resources may need a very different route to help.
I wanted a dedicated nonprofit through which public education could be a continuing responsibility, rather than something fitted around commercial assignments.
KnowledgeFlow’s mission brings together practical cybersafety and critical evaluation of information. It addresses fraud, misinformation, data misuse, and privacy violations, with particular attention to people and communities facing barriers to specialist support.
The point is not to make people afraid of technology. I want them to participate with greater confidence and better questions.
And calling it my passion project should never suggest it is a one-person accomplishment. Building something useful to the public depends on educators, contributors, community partners, and people willing to do the patient work of making complicated subjects understandable.
What does that public mission look like in practice?
Popa: It has to give people something they can actually use.
The Cybersafety Academy offers free, self-paced learning. The course catalogue includes Cybersafety for Everyone, How Scammers Target Seniors, age-appropriate learning for children and teenagers, and education for parents. Its CARE course gives victim-services professionals practical ways to understand digital harms such as stalking, impersonation, and image-based abuse.
There is also work directed at the organizations supporting those audiences. The Cyber Hub for Nonprofits provides free templates, checklists, self-assessments, and educational material, including cybersafety tip sheets available in 14 languages. Online delivery makes these resources available beyond a particular classroom, community, or Canadian location. For schools, our partnership with the Information and Communications Technology Council provides a practical distribution model. National CyberDay 2025 offered six learning missions, with bilingual lesson plans, teacher guidance, and take-home resources available at no cost. The material was designed for use throughout the school year, rather than only on the event date.
That is the kind of reach I care about: useful material that a teacher, librarian, parent, or community worker can put into someone else’s hands.
How do you prepare the next generation without simply giving them another lecture about online dangers?
Popa: Give them something to investigate, and then let them teach someone else.
The 2025 UnHackathon asked students to turn what they had learned into projects that explained cybersafety concepts to older adults, including grandparents or community members. They could create a video, poster, game, or another format suited to the person they wanted to help.
I like that reversal. The young person is no longer only the recipient of a warning. They have a reason to understand the material well enough to explain it.
The same principle applies to misinformation. I am less interested in supplying a permanent list of things to believe than in helping someone examine a source, identify a claim, look for corroboration, and notice when urgency or emotion is being used to bypass scrutiny.
Nor should education carry the entire burden. KnowledgeFlow’s Cybersafety by Design resources help schools and nonprofits assess the technologies and programs they put in front of people, including risks involving surveillance, exploitation, and privacy.
Nobody can honestly promise immunity from deception. The ambition is to make people better equipped to recognize, resist, and respond, while expecting the organizations serving them to provide safer environments.
Purple Pages sounds like a different kind of project. What are you trying to change?
Popa: The ambition is to make the evidence behind an organization’s credibility easier to find and understand.
A traditional directory helps you discover who offers a service. With Purple Pages, we are developing the idea of a directory built around trust evidence and understandable indicators of risk.
A person considering an organization should be able to ask: Who is accountable? What has been reviewed? What does the evidence cover? How current is it? Which questions remain unanswered?
The project strategy calls for profiles connected to current verification records and public trust information, with scope, validity, and limitations made visible. It also makes an important distinction: inclusion must mean something beyond having paid for prominence.
Accessibility is essential, but simplification must not become overstatement. An automated risk indicator is not the same thing as a completed professional assessment. Missing evidence does not, by itself, establish wrongdoing. A warning should help someone ask an informed question rather than substitute a label for judgment.
The project is still developing. The test I would apply to it is whether an ordinary person can understand both the value and the limits of what they are seeing.
A directory built around trust should invite scrutiny of its own methods.
You connect accessibility to the names Informatica and KnowledgeFlow. What do those names mean to you?
Popa: Both reflect my interest in making information useful.
For me, Informatica connects the technical work with the responsibility to explain it. KnowledgeFlow makes the public ambition explicit: knowledge should move beyond the people who already possess it.
Someone should not need my computer science degree to understand why an app wants access to their information, what a supplier’s assurance actually covers, or why a persuasive message deserves a second look.
That does not mean making every question simple. It means giving people an intelligible explanation, a way to examine the evidence, and an honest account of uncertainty.
After 37 years, I remain interested in building things that can do that at greater scale. Specialist practices, assessment methods, courses, and public tools are different ways of pursuing the same objective.
I want the expertise we build to give other people more control over their own decisions.
Your role in staying up to date is integral to our shared mission of fostering a community of innovators. CanadianSME Magazine is a valuable treasure trove of entrepreneurial knowledge. Click here to subscribe to our monthly editions for updates on Canadian businesses. Follow our handle @canadian_sme on X to remain updated on all business trends and developments. Your support is crucial to our mission.
Disclaimer: This article is based on publicly available information intended only for informational purposes. CanadianSME Small Business Magazine does not endorse or guarantee any products or services mentioned. Readers are advised to conduct their research and due diligence before making business decisions.
