October is Cybersecurity Awareness Month.
Can you see what you're defending?

We kick-off October with Cybersecurity Awareness. Canada’s Get Cyber Safe campaign has set this year’s theme as “Your best defence is you,” and south of the border the National Cybersecurity Alliance is running with “Don’t Make It Easy for Them.” Both are good advice. Both offer good advice aimed at people, and people deserve the attention, because most attacks still start with the human element and an inbox.

But there’s a version of awareness that the posters never cover, and it’s the one we spend most of our time on with clients: organizational awareness. Do you actually know what’s happening inside your own environment? Because your analysts can be sharp, your staff can be trained, and your policies can be immaculate, and none of it matters if the systems doing the detecting never saw the event in the first place.

You can’t recognize a threat your tools never recorded. So before October arrives, we want to talk about the least glamorous, most important layer of your defence: your telemetry.

The problem isn’t too little data. It’s too much of the wrong kind, in the wrong place.

Every organization we work with is drowning in logs. Endpoint agents, firewalls, cloud platforms, identity providers, applications, and increasingly operational technology, all generating more data every year. The instinct is to send everything to the SIEM and sort it out later. Then the ingestion bill arrives.

What happens next is the part that worries us. Teams start making coverage decisions based on cost instead of risk. A log source gets dropped because it’s noisy. Retention gets cut because storage is expensive. Some system never gets onboarded at all because nobody wants to explain the invoice. Each choice is individually reasonable. Collectively, they carve blind spots into the exact places attackers like to live.

When we run penetration tests, we routinely find that the systems we compromised were logging just fine. The logs simply never made it anywhere a human or a detection rule would look. On paper the organization had visibility. In practice it had receipts nobody could read.

Why this hits municipal, education, and enterprise environments differently

For municipalities, the stakes are service continuity. Canada’s Cyber Centre continues to identify ransomware as the top cybercrime threat to critical infrastructure, precisely because disruption can knock out essential services. Municipal environments also blend IT with operational technology, water systems, facilities, transit, and the Cyber Centre has warned that internet-exposed OT is being targeted through basic weaknesses like insecure remote access and default credentials. You cannot govern dependencies you cannot see, and OT telemetry is often the last data anyone routes anywhere useful.

For schools and school divisions, the math is harsher. Education was the most targeted industry in the world through the first half of 2025, averaging 4,356 attacks per organization each week according to Check Point Research, and it defends itself on some of the thinnest IT budgets in the public sector. Alberta felt this directly: the PowerSchool breach reached the Calgary Board of Education and dozens of other boards, and Mount Royal University confirmed a ransomware attack this June in which attackers stole and deleted more than 10 terabytes of data. A school division will never out-spend an enterprise SIEM budget. Its path to visibility has to run through efficiency: keeping the security value of its data while shedding the volume it’s paying to store and never using.

For enterprises, the pressure is scale and what comes next. Detection, response, and compliance all run on telemetry, and now AI initiatives are lining up behind them asking for the same data, cleaner and better organized. An AI-ready data foundation and a security-ready one turn out to be the same project.

The answer isn’t “collect everything” or “collect less.” It’s control.

This is where our partnership with Cribl comes in, and why we think their model fits the moment. Instead of pointing every source at one expensive destination, a telemetry pipeline sits in the middle and gives you choices: route the security-relevant data to your SIEM, send the bulk to low-cost storage where it stays searchable for investigations, trim the noise before you pay to ingest it, and keep the flexibility to change destinations later without re-plumbing your whole environment.

The practical effect is that visibility stops being a budget line you lose arguments about. Organizations get to keep more of their data, see more of their environment, and spend less doing it. For a municipality, that can mean finally onboarding the OT and facilities systems that never fit the budget. For a school division, it can mean full coverage without an enterprise invoice. For an enterprise, it means the data foundation your security team and your AI roadmap both need.

A short pre-October checklist

If you want to walk into Cybersecurity Awareness Month with more than a poster campaign, spend the next two weeks on three questions:

• First, inventory your telemetry: what’s being generated, what’s actually being collected, and where does it go? The gap between those lists is your blind-spot map. 
• Second, check retention against reality: if an incident from four months ago surfaced tomorrow, could you investigate it? 
• Third, decide who owns these answers: because in most organizations nobody formally does.
• Then come chat about it with us in person.

On Tuesday, October 6, in the first week of Cyber Month, at CriblConnect Calgary with Cribl’s experts and Calgary-area IT and security leaders, including a perspective from the City of Calgary, followed by drinks and dinner. We’ll be digging into telemetry cost, governance, architectural flexibility, and AI readiness, which is to say, the unglamorous machinery that makes “your best defence is you” actually true.

Awareness Month is a great time to train your people. It’s an even better deadline for making sure your organization can see what they’re defending. Seats for October 6 are limited, so if this is on your roadmap, register or reach out to our team and we’ll save you one.