The Business of Defense: AI Agents and Market Blind Spots at SecTor 2026

TORONTO, ON – October 14, 2026

In the high-stakes world of corporate cybersecurity, the transition from human-led defense to artificial intelligence has moved from theoretical whitepapers to the enterprise bottom line. This rapid evolution was the undeniable undercurrent at SecTor 2026, Canada’s largest cybersecurity conference, which concluded last week at the Metro Toronto Convention Centre.

The event, part of the global Black Hat portfolio, drew over 6,500 verified attendees—a staggering 22% year-over-year growth that underscores a booming industry grappling with unprecedented technological disruption. But beyond the crowded expo floors featuring 36 Arsenal tool demos and heavy-hitting Diamond Sponsors like CrowdStrike, SentinelOne, and Concentric AI, a more complex narrative emerged. The conversations in Toronto revealed an industry fracturing along two distinct fault lines: the immense governance liabilities introduced by autonomous AI agents, and the glaring market failures in how commercial threat intelligence is gathered and sold.

"The 22% growth we saw at SecTor this year reflects just how quickly the cybersecurity conversation in Canada is evolving,” said Suzy Pallett, President of Black Hat. “What makes SecTor distinctive is the combination of rigorous independent research, practical security expertise, and a community willing to tackle emerging threats openly. From agentic AI to threats against civil society, the conversations in Toronto showed how significantly the security landscape is changing."

The Commercial Blind Spot: Why Threat Intelligence Ignores Civil Society

One of the most sobering revelations at SecTor 2026 came not from a corporate product pitch, but from the academic sector. Ron Deibert, Director of The Citizen Lab at the University of Toronto, used his keynote to highlight a massive disparity in global threat visibility: a mere 4% of commercial threat intelligence reports focus on civil society.

This gap exists despite well-documented, widespread state-sponsored targeting of journalists, human rights defenders, and non-governmental organizations. The root cause of this disparity is fundamentally economic. Commercial threat intelligence is a lucrative, demand-driven market. Major vendors build their intelligence indices based on the threat models of their paying clientele—predominantly Fortune 500 enterprises, financial institutions, and defense departments. These organizations are primarily concerned with ransomware, intellectual property theft, and financial fraud.

Because civil society organizations generally lack the massive procurement budgets required to retain top-tier cybersecurity firms, their specific threat landscapes are largely ignored by the commercial market.

"The companies that produce these threat intelligence reports . . . are giving what I would argue is a very distorted picture of the threat environment," Deibert stated during his address.

From a business strategy perspective, this distorted picture creates a systemic global risk. Industry analysts note that threat actors frequently use under-defended NGOs and independent journalists as testing grounds for advanced persistent threats (APTs) or as backdoor entry points into larger, more lucrative supply chains. By ignoring these targets, the commercial cybersecurity sector is effectively blinding itself to emerging zero-day exploits and novel espionage tactics until they inevitably spill over into the corporate sector.

When AI Takes the Wheel: The Governance Crisis of Agentic Enterprise Software

While market economics dictate threat visibility, technological leaps are forcing a rewrite of enterprise governance. The integration of "agentic AI"—artificial intelligence systems capable of making decisions and executing tasks without continuous human intervention—has become the new frontier for corporate IT.

At the AI x Cloud Security Summit, the business implications of this shift took center stage. Helen Oakley, a strategic advisor in AI and cybersecurity, delivered a stark warning about the rush to deploy autonomous agents in the workplace. Her presentation, "Who Gets to Decide? Security in the Agentic Enterprise," tackled the dangerous conflation of algorithmic ability and corporate authorization.

“Human attention is valuable, so we need to make the most of it,” said Oakley. “Capability is not authority, and you cannot have your model define the risks for your organization.”

The financial liability of getting this wrong is immense. Traditional identity and access management (IAM) models were built for human employees or static software scripts. Agentic AI breaks this paradigm. If an AI agent is given the capability to draft a vendor payment, does it also have the authority to approve and execute the wire transfer? Security executives argue that without strict separation of reasoning from execution, organizations are exposing themselves to catastrophic risks, ranging from automated insider threats to sophisticated prompt injection attacks that could drain corporate accounts in seconds.

To mitigate these risks, enterprise security teams are increasingly turning to frameworks like the OWASP Top 10 for Large Language Models. Live demonstrations at the summit showcased defenders detecting unauthorized AI agent activity minutes before critical actions were executed, proving that continuous monitoring and the principle of least privilege must be hard-coded into the DNA of any agentic enterprise system. For the C-suite, the message was clear: automation drives efficiency, but unconstrained AI agency is a direct threat to the bottom line.

Canada's Infosec Surge: What SecTor 2026 Reveals About the Regional Cyber Hub

The record-breaking attendance at SecTor 2026 is indicative of a much larger economic trend: Canada's rapid emergence as a global cybersecurity powerhouse. Market projections estimate the Canadian cybersecurity sector will experience a compound annual growth rate of roughly 8% to 11% through the next decade, potentially reaching over $28 billion by 2030.

This growth is fueled by a confluence of tightening federal data privacy regulations, increasing cloud adoption, and a surge in venture capital funding targeting AI-driven threat detection. Toronto, in particular, has solidified its position as a critical node in this ecosystem, bridging the gap between rigorous academic research institutions and agile commercial startups.

Nowhere was this innovation more apparent than at the SecTor Startup Spotlight Competition. Following evaluations by a panel of industry judges, Spotlight Security emerged as the winner. The company's business model perfectly encapsulates the industry's shift toward practical, AI-driven defense mechanisms. Spotlight Security is developing an "agentic cyber defender" specifically tailored for legacy infrastructure—a notoriously under-defended segment of the market that includes regional utilities, municipal systems, and co-ops.

Rather than competing in the saturated market of general-purpose enterprise IT, Spotlight Security is capitalizing on a massive, high-need total addressable market. Their proprietary, purpose-trained large language models automate threat detection and translate complex system data into actionable, plain-English guidance for stretched IT teams. The startup has already secured non-dilutive grant funding and established a critical design partnership with a major Managed Service Provider (MSP), allowing them to monitor over 8,000 endpoints.

By bridging the "action gap" for critical infrastructure, Spotlight Security demonstrates how targeted innovation can capture significant market share while addressing real-world vulnerabilities. As the winner of the Toronto competition, the company will now represent SecTor at the Global Startup Spotlight Competition during Black Hat USA 2027, pitting Canadian innovation against the best emerging technologies worldwide.

As the dust settles on SecTor 2026, the overarching lessons for corporate leaders are sharply defined. The cybersecurity market is bifurcating. On one end of the spectrum, the relentless push toward autonomous AI is forcing enterprises to completely reimagine their internal governance and risk models. On the other, basic market economics are leaving critical democratic institutions and legacy infrastructure dangerously exposed. Navigating the next decade of digital business will require leaders who can not only harness the efficiency of the algorithmic frontier but also recognize the hidden liabilities lurking in the market's blind spots.