Ottawa is looking at how a breach was disclosed, not only how it happened
September 29, 2026. From issue 8 of The Compliance Brief, 2 stories for Canadian companies answering customer security reviews.
Issue 8 of The Compliance Brief went to subscribers on September 29, 2026. 2 of its 5 stories bear on security reviews, vendor diligence and trust, and they are below in short form. The full issue, with every take in full, is on traztech.ca.
Free weekly email
Get the next issue on Tuesday
One email a week: what changed in security and compliance, and what it means for Canadian companies answering customer security reviews.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.
Source: The Record
Canada's federal privacy regulator opened an investigation into IDScan following a data breach. The probe covers the company's security practices and, separately, whether the notifications sent to affected individuals met the requirements of the federal private-sector privacy law.
Our take, in short
Notification adequacy being named as its own line of inquiry is the detail to take away. Almost every incident response plan I review has a solid technical section and two vague sentences about telling people, with no template, no owner and no defined clock.
Read the full take on traztech.ca
Your AI agents are logging in as humans and SOC 2 cannot tell
Source: BleepingComputer
A vendor-authored piece argues that AI agents often operate through human credentials, so actions taken by an agent look identical to actions taken by the person whose credentials it borrowed. The argument is that existing SOC 2 controls have no way to distinguish the two, leaving a gap in access review and logging evidence.
Our take, in short
It is marketing content and the framing is overheated, but the underlying problem is one I run into on real engagements. If your agent authenticates as a staff member, your quarterly access review is describing a person who is not the one taking the actions, and your audit trail will not survive a serious customer question.
Read the full take on traztech.ca
Related on TrustCenter
- Trust centers for health technology
- Data residency statements for Canada
- A trust center before your first report
- Building a security answer library
Also in issue 8
Outside security reviews, vendor diligence and trust, but in the same email:
- Eight NetScaler flaws, two already being exploited
- Labcorp's settlement is a preview of your next vendor contract
- A stolen OAuth token from a former employee's laptop
Older: issue 7 All issues on TrustCenter
Free weekly email
Get it every Tuesday
The next issue goes out Tuesday morning. Read it in your inbox instead of finding it here a week later.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.