RESOURCE
Utilities, municipalities, mines, pipelines, telecoms and defence suppliers running networks installed between 2010 and 2020 are planning refreshes while AI driven attackers probe continuously. The refresh buys evidence or just boxes, and the order of operations decides which: observed inventory, segmentation, rebuilt keys, then equipment, then verification.
Fabric Networks
Any organization whose core network, firewalls, remote access and site tunnels were installed between about 2010 and 2020, that has a refresh budget approved or coming, and that does not have a dedicated security team. That describes a power or water utility with substations and treatment plants on the far end of a tunnel. It describes a municipality running traffic systems, transit, facilities and a 911 centre on the same network it bought a decade ago. It describes a mine, a pipeline, a gas plant, a regional telecom or fibre operator with headends and towers, a port or an airport, a hospital district, a school board and a defence supplier. In our experience it describes most mid sized operators of critical infrastructure in Western Canada. It is not a weakness; it is the normal state of an organization that has been busy running the service. What has changed is who is on the other side of the firewall.
If that is you and the refresh is already in motion, the short version: build the observed inventory before you choose the equipment. Request a scoping call and we will tell you in twenty minutes whether it fits your timetable.
Three things happened in a single week this autumn.
A Canadian utility appeared on a ransomware group's leak site at the end of September. The claim is unverified and the company has not confirmed it, so we treat it as a claim. What matters is the pattern, not the name: a long lived operator of essential services, a wide estate of sites and tunnels, and an attacker who did not need anything exotic to get in. Nothing about that pattern is specific to utilities. A municipality, a mine, a telecom or a regional health authority has the same shape.
Days later, Canadian press reported AI driven agents probing Government of Canada web properties at a scale and tempo that human operators could not match. Automated reconnaissance is now cheap, continuous and patient. It does not get tired, it does not get bored, and it tries every door.
On October 1, 2026 the Treasury Board's Standard on Protecting Information in Networks took effect for federal departments. The government said plainly that the standard was written for the AI era. It is not a mandate on a private company or a municipality, and this guide does not pretend it is. It is the clearest public statement so far of what the people who defend Canada's largest network think a defensible network has to look like in 2026, and it is useful as a yardstick.
An attacker that runs continuously will find a 2014 VPN concentrator with a preshared key nobody has rotated, a flat network where the plant, the substation, the water treatment PLCs or the traffic controllers share a broadcast domain with the office, and a certificate that expired quietly two years ago. Those are exactly the things a refresh is supposed to fix. The question is the order in which you fix them.
Most refresh plans start with the equipment list. The vendor quote arrives, the switches and firewalls are chosen, the cutover is scheduled, and security is a line item near the end that says "harden after migration." That order is backwards, and the AI era makes it expensive.
Not the asset list. The asset list tells you what you bought. You need to know what is actually negotiated on the wire: which tunnels exist, between which endpoints, with what protocols, what cipher suites, what key lengths, which certificates, and who is on the other end. A 2010 to 2020 estate has ten to fifteen years of tunnels that were set up for a project, a vendor, a contractor or a site and never torn down. Some of them carry the plant, the substation, the lift station, the intersection or the tower.
This is done passively. A virtual probe at a boundary you choose observes live traffic for several weeks without decrypting it, without agents on endpoints and without touching a production configuration. What it asks of your team is a SPAN or TAP feed, a technical contact for the remote install, and about two hours in meetings: the kickoff and the week six findings workshop. The output, at three months, is a dated, observed inventory of every flow, ranked by what a failure would do to the service it carries.
The inventory is what makes the refresh defensible. It tells you which of the old boxes are carrying something that must not break, which tunnels can be retired rather than migrated, and which flows need to be rebuilt on the new platform with proper key management rather than copied across with the same preshared key from 2014.
The single most valuable change in an older estate is separating what must never be reachable from the internet, directly or indirectly, from everything else. Process control, SCADA, safety systems, historians, building and traffic controllers, emergency communications and the remote sites belong in their own zones with controlled, inspected, encrypted paths between them. This is the heart of the Treasury Board standard and of every operational technology guideline the Cyber Centre has published.
Segmentation decided on paper looks tidy and breaks the service. Segmentation decided from the observed inventory in step 1 is the one that holds, because you already know every flow that crosses each boundary and what it carries.
The refresh is the one moment when every tunnel is being rebuilt anyway. Use it. Every site to site tunnel gets managed keys with a rotation schedule. Every certificate gets an owner and an expiry that someone is watching. Every remote access path goes through a managed point with strong authentication. Key delivery is vendor agnostic. Where the new estate uses Fortinet, delivery into the FortiGate is validated; Juniper, Cisco, Palo Alto Networks and Ciena are examples of other platforms reached through open interfaces, not an exclusive list, and nothing has to be ripped out.
This is also the step that gets the post-quantum question out of the way. Anything that must stay confidential past about 2032 is exposed today to harvest now, decrypt later. The Canadian and US migration roadmaps both begin with the same cryptographic inventory you built in step 1. Build it once; it serves the refresh, the segmentation and the migration.
By now the equipment list writes itself. You know the boundaries, the zones, the flows that cross them, the throughput each one needs and the cryptography each one must support. The vendor quote becomes a response to a specification instead of the thing that defined it. In our experience this is also where the refresh budget stretches furthest, because you are no longer buying capacity for tunnels that should not exist.
An observed inventory taken after cutover, compared to the one taken before, is the proof that the refresh did what it was supposed to do. It is also the artefact an auditor, an insurer, a parent company, a council, a regulator or a government contracting authority will ask for first. Keep it current. The attacker that found the 2014 concentrator is still running; the inventory is how you find the next one before it does.
The Canadian Program for Cyber Security Certification is now in select Department of National Defence contracts. Level 1 is thirteen controls and a self assessment, and it is more thorough than its length suggests; Fabric has completed its own. Level 2, assessed by an accredited body from spring 2027, asks a supplier to show which cryptography protects specified information, where, with what keys, and to prove it.
The practical consequence is simple. Companies that have not completed the self assessment will not receive the contracts that carry the requirement. Primes flow the obligation down to their suppliers on the prime's timetable. Municipalities and provincial bodies are not in CPCSC's scope, but they answer to the same Cyber Centre guidance, to their insurers and increasingly to provincial direction, and their vendors are. An organization refreshing a 2010 to 2020 network in 2026 that does steps 1 through 3 above has already built the evidence Level 2, an insurer or a council will want. One that upgrades the boxes first and documents later will be building it twice.
The companion paper, CPCSC Level 2 is a cryptography question, quotes the controls by number.
It does not say that any product prevents a breach. It does not say that the Treasury Board standard applies to you if you are not a federal department. It does not say that CPCSC is a quantum mandate; it is not. It says that in the AI era the cheapest moment to fix an older network is the refresh you are already paying for, and that the order of operations decides whether the money buys evidence or just boxes.
If you have a refresh planned and no observed inventory of what the current estate is doing, that inventory is the first step and it does not depend on which vendor you choose. Fabric's Discovery Program is a fixed scope, three month, passive engagement that produces it, operated on a Canadian instance, with a written scope before any work starts.
Request a scoping call. Twenty minutes, a written scope to follow, no obligation.
Or read how the Discovery Program is structured.
Treasury Board of Canada Secretariat, Standard on Protecting Information in Networks (SPIN), in effect October 1, 2026, and the accompanying statement on cyber security readiness for the AI era. Fabric summary (link)
Public Services and Procurement Canada, Canadian Program for Cyber Security Certification, programme overview, page modified September 29, 2026. canada.ca (link)
Canadian Centre for Cyber Security, ITSP.10.171, second release October 28, 2025; ITSM.40.001, Roadmap for the migration to post-quantum cryptography for the Government of Canada.
The utility incident and the reporting on AI driven probing of Government of Canada sites are described from public press reporting in late September and early October 2026. The leak site claim is unverified and is presented as a claim.
Start with a conversation about your cryptographic posture.