Canada prides itself on being a technologically advanced nation, investing heavily in research, producing skilled engineers, and promoting innovation as a key driver of economic growth. However, according to veteran cybersecurity leader Steve Waterhouse, the country continues to fall behind peer nations such as Israel, Singapore, the United Kingdom, and the United States in cybersecurity. The root cause, he argues, is not a lack of talent or technology but a cultural and structural problem.
A Rare and Credible Perspective
Waterhouse brings a unique and credible viewpoint to this assessment, with a career spanning over two decades across the Canadian military, government, and private sector. Having worked at the operational level within government bureaucracy and alongside industry leaders, he has gained a clear understanding of where Canada struggles and why progress has been uneven. He emphasizes that Canada has no shortage of capable people or advanced tools; what it lacks is consistent alignment between leadership accountability, decision-making, and long-term execution.
Cybersecurity Failures Stem from Hesitation
According to Waterhouse, cybersecurity failures rarely result from missing technology. Instead, they stem from hesitation, fragmented authority, and delayed action. He argues that Canada often knows what needs to be done but struggles to act decisively. Innovation exists in pockets, but national coordination remains weak. In cybersecurity, delay itself becomes a significant risk.
From Military Readiness to Cyber Reality
Waterhouse began his career in the Canadian Armed Forces in the mid-1990s, transitioning from traditional military roles into information technology during the early days of military cyber operations. He describes this shift as moving from a rifle to a keyboard at a time when digital systems were becoming mission-critical. Over a 23-year military career, he managed large-scale infrastructure supporting thousands of users across multiple sites and played key roles during national stress events such as the 1998 ice storm and the Y2K transition.
Preparation Matters Most Before a Crisis
These experiences reinforced a lesson that still shapes his thinking: preparation matters most before a crisis begins. Later in his military career, Waterhouse was tasked with rebuilding the IT infrastructure at the Royal Military College Saint-Jean. Given unusual freedom and resources, he was able to design systems with long-term resilience in mind. This experience underscored the value of strategic planning, trust-driven leadership, and clear ownership rather than reactive fixes. In cybersecurity, resilience is rarely built during emergencies; it is built quietly long before they occur.
Building Threat Intelligence Before the Crisis
After leaving the military, Waterhouse moved into the private sector before being recruited in 2022 by Quebec's minister of cybersecurity. His mandate was explicit: change the cybersecurity culture inside the government. This role further highlighted the need for a cultural shift to address the structural issues that hinder Canada's cybersecurity posture.
