Cybersecurity for agriculture in northern Alberta.

The single largest dollar loss category we see in agriculture is supplier banking-change fraud. An attacker compromises the email mailbox of a fertilizer dealer, a seed supplier, or an equipment company. They watch for an invoice going out to you. They modify the bank details and let the email through. You pay the invoice on time. The money is offshore by the end of the day. Losses of $50,000 to $400,000 per incident are common. Recovery rates are under 10%.

Ransomware against ag operations has shifted from opportunistic to targeted. The timing is deliberate — early seeding or mid-harvest, when an operation cannot afford a day of downtime, let alone a week. Mid-sized farm operations have paid ransoms because the alternative was losing a planting window or watching grain quality degrade in storage while the office was offline.

Precision-ag and GPS dependency creates a quieter but real risk surface. RTK corrections, John Deere Operations Center, FieldView, the autosteer subscription — none of these are individually catastrophic if interrupted, but the operation increasingly cannot function without them. The exposure is less about a glamorous attack and more about identity theft, credential stuffing, and accounts shared across family members on personal email.

Starlink has solved the bandwidth problem and created a new one — a flat, unsegmented network where the cab tablet, the farm-office desktop, the kid's gaming console, and the agronomist's iPad all sit on the same broadcast domain. One compromised device reaches every other device on the property.

Three structural reasons. First, the dollar size of routine transactions is high — a single fertilizer or seed invoice can clear six figures, and large EFTs between known counterparties are the perfect cover for a redirected payment. Second, ag operations sit at the edge of a rural cybersecurity budget — most still rely on local break/fix IT and have not implemented managed EDR, MFA, or cloud backup. Third, attackers know exactly when you cannot afford downtime — seeding and harvest are calendar-fixed pressure points and ransomware groups time their campaigns accordingly.

We start with the Microsoft 365 tenant — because that is where the email lives, and email is where the banking-change fraud begins. Conditional access policies, enforced MFA on every account (including the ones that “just check QuickBooks”), legacy authentication blocked, mailbox auditing on, and external sender warnings configured. We help write a supplier banking-change verification procedure — a two-minute phone call to a known number before any EFT change goes through — and we make sure the bookkeeper actually follows it.

Managed EDR (Huntress) goes on every endpoint — the office desktop, the laptop in the truck, the precision-ag tablet, the agronomist's shared device. Cloud backup runs separately from the M365 retention period. We segment the network so the cab tablets and the kid's Xbox cannot talk to the office accounting machine. Starlink is configured as primary with cellular failover where the use case justifies it.

For the precision-ag side, we audit shared credentials on Operations Center, FieldView, and the equipment manufacturer portals — and convert shared logins to per-person accounts with proper access. This is unglamorous work that prevents the next agronomist or seasonal hand from walking off with full access to your entire operational data history.