Loblaw Companies [TSE: L]

Michael Laing

Cyber Risk Advisor

Today the traditional playbook of firewalls, antivirus and patch everything is colliding with a new world of zero trust, continuous monitoring and risk-based decisions where not all vulnerabilities are created equal.

From Fortresses to Fluid Boundaries

In the “old world,” cybersecurity assumed a hard perimeter with firewalls, VPNs and antivirus acting as the main sentries. This model worked when systems were mostly on premise, internet exposure was limited and remote work was rare.

Today, cloud adoption, SaaS, APIs and hybrid work mean there is no single perimeter to defend. Modern security must follow identities, devices and data across networks and providers, focusing on context rather than location.

Old Playbook: Reactive And Signature-Based

Traditional defenses leaned heavily on known bad indicators such as malware signatures, IP blocklists and static rules. Security operations often relied on scheduled scans, periodic log reviews and manual association of alerts after a suspicious event surfaced.

New Playbook: Assume Breach and Zero Trust

Modern approaches embrace an “assume breach” mindset, treating every access request as untrusted until verified. Zero trust architectures combine strong identity verification, device health checks and continuous authorization.

"Where possible treat security as a living system; constantly evolving, experimenting and learning, with AI amplifying human judgment instead of replacing it."            

New practices emphasize prevention, prediction and rapid containment through threat intelligence, threat hunting and behavior-based analytics that look for anomalies rather than just known signatures. AI-backed analytics correlate signals across endpoints, identities and networks to reduce dwell time and automate containment.

Vulnerability Prioritization: From Patch Everything to Risk First

Historically, organizations tried to “patch everything” driven by generic severity scores and compliance dates. This created backlogs, patch fatigue and inconsistent coverage, especially on legacy systems and mission critical infrastructure.

Newer programs use risk-based vulnerability management that blends exploit availability, active threat intelligence, asset criticality and exposure paths.

Role of Automation and AI

Traditional security approaches depended on human analysis for triage, enrichment and response, which can not keep pace with today’s alert volumes. This can lead to alert fatigue, slow investigations and inconsistent incident handling outcomes.

Security operations are shifting towards automation and AI to correlate signals, enrich alerts and trigger playbooks for routine containment actions. Machine learning-based analytics detect anomalies and patterns that static rules miss, while still relying on expert humans for complex decisions and tuning.

Blending Old Fundamentals with New Thinking

Clinging to yesterday’s playbook in today’s threat landscape is like locking the front door while the back wall is missing. Old approaches still have value but relying on them alone leaves gaps that modern attacker’s AI-powered toolset are looking to exploit. The organizations that thrive will be the ones that treat security as a living system: constantly evolving, experimenting and learning, with AI amplifying human judgment instead of replacing it.