Ottawa Just Said Assume Breach. Out Loud. In Writing.

Pillar 01 · Security

On October 1, Treasury Board Secretariat published a Security Policy Implementation Notice on cyber readiness in the frontier AI era.

Most people will skim it. It reads like the pamphlet at the dentist’s office. MFA. Patching. Asset inventory. Backups. The things your IT team has been asking for since BlackBerry was a status symbol, now on Treasury Board letterhead so somebody finally reads them.

But section 2 contains a phrase I have been waiting about fifteen years to see in a federal policy document. Departments are to operate under an “assume breach” paradigm.

Assume breach. From Treasury Board. In writing. With control IDs and a deadline.

I may have it framed. It’ll hang right next to my collection of vendor slides promising an impenetrable perimeter. Those aged well.

Why now

The SPIN has six pillars. Identify, Accelerate, Harden, Fortify, Monitor, Prepare. Every department has to submit a prioritized list of its critical services by November 30, 2026. Start with no more than three. The crown jewels.

The reason is in the context section, and it is blunt. Frontier models can find vulnerabilities on their own, write the exploit, and orchestrate a multistage attack at machine speed. They can chain a handful of low-severity flaws into one critical one.

Translation. The gap between “vulnerability disclosed” and “vulnerability exploited” used to be measured in weeks. Now it is closer to lunch. Patch Tuesday meets Exploit Tuesday, about 11:45.

The Five Eyes put it plainly too. Cyber risk assumptions now go stale in months. Not years.

So they’re in. Now what?

Assume breach changes the question you ask in the architecture review. For thirty years the question was how do we keep them out. The SPIN now asks a harder one. They are already in. What do they get?

Most answers today are good ones. Segment the network. Lock down admin pathways. Run EDR. Log everything and protect the logs. Buy the dashboard with the reassuring green dots. Do all of it. The SPIN says so and it is right.

But look at where the data sits at the end of all that work. Whole. In one place. Readable by whoever holds the keys. The admin. The provider. Or the attacker who now holds the admin.

Notice what that list has in common. The firewall is a perimeter. Segmentation is the perimeter again, drawn smaller and billed separately. EDR and logging tell you someone got past it, usually in a beautifully formatted report. Every one of them waits for the attacker to move, then responds. That is reactive security. A very good smoke detector is still a smoke detector. At machine speed, the waiting is the expensive part.

The SPIN itself describes the playbook. Threat actors get in through whatever is exposed, then move laterally toward high-value data. That second step assumes the high-value data exists somewhere, intact, waiting.

So take that assumption away. Encrypt on the client. Split the result into shards. Put the shards in independent locations run by independent operators. Set it up so no single location, operator or admin account ever holds enough to rebuild the file.

Now compromise one node. You get noise. Compromise the provider’s console. More noise. Lateral movement still works fine. It just has a destination problem.

That is proactive security. The protection is built into the data before anyone shows up, so there is no race to win. It limits the blast radius in arithmetic, and it doesn’t depend on the attacker being slow, polite, or human.

Two clauses worth reading twice

PRP-5. Backups for critical services must be logically separated from production and, where feasible, immutable. PRP-4 adds that restores get tested and checked against a known good reference.

Ransomware crews have gone after backups first for years. Frontier AI just makes them punctual. If your backup lives on the same identity plane as production, it is a second copy of the target with a nicer label.

Section 7.3. Departments remain responsible for GC information and assets even when a third party or managed service provider runs them.

Read that one slowly. Your MSP is not your alibi.

The SPIN tells departments to write its requirements into contracts. Good. Do that. Lawyers love a schedule. But a contract describes what a provider promises to do. It says very little about what an attacker holding that provider’s admin credentials will do on a Saturday night. Attackers rarely read the MSA. It also says nothing about a foreign court order served on the provider’s parent company, which tends not to ask how you feel about it.

If the provider never holds a readable copy, both of those problems get a lot smaller. The provider can be honest, compromised or compelled. The data stays shards either way.

One more for the AI crowd. HRD-6 puts AI agents in the same bucket as service accounts. Owner, purpose, life cycle, privilege reviews. The robots now need badges. Somewhere a service account called svc_temp_2017 with domain admin is starting to sweat.

One question per crown jewel

If I were a DG building that list of three critical services before November 30, I’d ask one question about each system.

If an attacker had full admin on this today, what would they be able to read?

If the answer is “everything,” you have found your work. Do the MFA. Do the patching. Do the EDR and the tabletop exercises. All of it still matters. Then fix the part where one set of keys opens the whole vault.

Treasury Board has told departments to assume the breach. Fine. Assume it. Then make the breach boring.

Bias declaration. I’m the founder and CEO of SkyeConnex. We build data custody on exactly this principle, so I have an obvious interest in departments taking the SPIN seriously. Read accordingly. The SPIN is worth reading either way.