Trade Wars: How U.S. Tariffs Are Reshaping Cyber Risk and Resilience

As of March 4th, the U.S. has imposed new tariffs on Canada, Mexico, and China, setting off a geopolitical and economic ripple effect that extends beyond supply chains and global markets. These tariffs—25% on many Mexican and Canadian imports, a 10% levy on Canadian energy, and a doubling of Chinese tariffs to 20%—have already triggered retaliation.

Canada has responded with reciprocal tariffs on certain commodities, with some officials in Canada taking U.S. alcohol and other products off their shelves and canceling orders. China responded with tariffs of its own on U.S. agricultural exports and expanded its export restrictions on critical technology components and cybersecurity-related industries.

At first glance, tariffs seem like an economic and trade issue, but the cybersecurity implications are just as significant. Trade disputes impact the cost and security of IT supply chains, alter the accessibility of cybersecurity tools, and could even lead to retaliatory cyberattacks from nation-state actors. This article explores how the latest tariffs could reshape cybersecurity for enterprises, cybersecurity vendors, and government agencies.

Cybersecurity professionals are already grappling with the risks of supply chain attacks, and these tariffs add another layer of complexity. Many cybersecurity hardware components—including semiconductors, network infrastructure, and cloud computing hardware—are sourced from tariff-affected regions.

We asked cybersecurity professionals on both sides of the U.S.-Canada border for their thoughts, politics aside.

"Let's put aside for the moment any complexities to regulatory oversight and enforcement of compliance standards for companies operating in China, Mexico, and Canada. That headache is real, of course, but accountants and lawyers will step up to sort it out," said Mike Wilkes, Former CISO, MLS; Adjunct Professor, NYU. "Thinking a bit more widely, though, I can imagine there will be a concomitant rise in cyber espionage and attacks between groups of impacted groups in China and the U.S. given the tensions around core economic impacts of the tariffs. The markets understandably take a dip, folks have already been hoarding electronic components which become increasingly scarce. Train cars and trucks of eggs have already been heisted even before these tariffs began. More heists of shipments will happen."

"Taking another perspective on new risks, maybe a U.S. farmer can no longer sell their chicken, wheat, corn, or cotton as those are having reciprocal Chinese import tariffs applied. Maybe that farmer has a kid who wants to exact some pain on someone either physically or digitally and lashes out. I expect a whole swath of exasperation and digital criminal activity to arise, and we'll see more supply chain disruptions pop up and surprise us with just how interconnected everything has become."

Wilkes concluded: "In my NYU and Columbia University courses on cybersecurity and risk management, I teach that systemic risk is an emergent property of complex systems. We are about to experience a 'load test' of sorts on our economy in ways that even trained and experienced economists dare not speculate."

As supply chains shift to alternative, potentially less secure vendors, organizations could inadvertently expose themselves to new vulnerabilities, including these possible risks:

• Companies scrambling to shift suppliers may bypass security due diligence to avoid tariff costs.
• Increased counterfeit risks in hardware procurement as organizations look for cheaper alternatives.
• Longer refresh cycles on security appliances and infrastructure, leaving organizations running older, less secure systems.

Additionally, China dominates the supply of rare-earth minerals used in semiconductors, networking equipment, and encryption hardware. Any export controls from China could severely impact the availability of next-gen cybersecurity technology in the U.S. and other countries.

"It is no surprise to security leaders that the current tensions are amplifying supply chain risks—delays in hardware refreshes, counterfeit components, and reliance on potentially untrusted sources for rare-earth minerals for parts," said Ali Abbas Hirji, VP, Cybersecurity and Technology, Computek College; Special Advisor, Cybersecurity and ICT Initiatives, 369 Global. "My plan? Well this forces me to pivot to software-defined security, tighten third-party vendor audits, and monitor for APTs exploiting trade-driven disruptions. And, it is no surprise once again that cybersecurity is now a supply chain and geopolitical challenge not just a technical one. And, oh, my cyber awareness campaigns will step up; I totally expect too-good-to-be-true emails with a link promising salvation coming to an inbox near my team very, very soon."

So what should CISOs do? Some obvious moves, much less decisions they must make daily, include reassessing third-party risk management (TPRM) frameworks and requiring stricter security audits for new suppliers; working with vendors to verify the authenticity of hardware and software components; and considering diversifying procurement strategies before major supply chain shifts force reactionary decisions.

"Economic tariffs between countries, particularly those that regularly engage in trade and technological collaboration, will have far-reaching consequences. The impact will be felt well beyond the involved countries of Canada, USA, Mexico, and China," said  Kenrick Bagnall, Founder, KONCYBER & RB-Cyber Assurance; Royal Candian Mounted Police (RCMP) Contractor/Instructor; Toronto Police Service (Cybercrime Unit) (Ret.). "The domains of cybersecurity, cybercrime investigations, and cyber insurance will all be impacted. While tariffs are often implemented as economic or political tools, their unintended impact on cybersecurity efforts, especially cross-border vulnerability research, crime investigations, and public sector and small business security, must be closely examined."

Beyond tariffs, export restrictions on cybersecurity tools and software are tightening. The U.S. government has already imposed new restrictions on intrusion software, surveillance tools, and AI-driven security technologies, making it harder for companies to collaborate on global cybersecurity research.

[RELATED: AI Diffusion Rule to Protect U.S. National Security, Economic Strength]

Challenges for cybersecurity vendors and researchers include:

• Penetration testing tools and red-teaming software could face licensing restrictions, making it harder for companies to defend against cyber threats.
• Cross-border cybersecurity research collaborations could decline, impacting the discovery of new vulnerabilities.
• Restrictions on AI-driven cybersecurity solutions may hinder innovation and adoption of cutting-edge defensive tools.

"Tariffs, at their core, are a form of geopolitical disruption. As with all disruption, prudent response demands a risk-based evaluation of the types of mitigating activities our third-party ecosystems and our business themselves may take, together with the corollary impact of those activities on security architecture and controls," said Edna Conway, CEO, EMC Advisors; Former Chief Security & Risk Officer, Microsoft Cloud. "Identifying those impacts and reconfiguring controls and processes (e.g., co-development and testing in secure enclaves; increased levels of PAM deployment) are essential to navigating the immediate and longer-term effects of such disruption."

"At a minimum, cybersecurity professionals should keep up with export regulations impacting your cybersecurity toolsets; work with legal and compliance teams to ensure security research isn't affected by shifting trade policies; and, if sourcing from China, monitor for new export restrictions that could cut off access to critical software or hardware components."

"These tariffs will create real cyber risks. When firms rush to find new suppliers, they often skip proper checks. This opens doors to cyberattacks. At the same time, nation-states may launch more cyberattacks as payback," said Kip Boyle, vCISO, Cyber Risk Opportunities LLC. "The biggest danger is making rushed choices. Security teams need to plan now, not later. They should know which parts come from high-risk places and have backup plans ready. Smart leaders will use this time to build stronger, more diverse supply chains before a crisis forces their hand."

With tariffs driving up the cost of hardware and networking components, cybersecurity vendors must rethink their pricing, supply chain strategies, and product development cycles. Some expected implications include rising prices for firewalls, intrusion detection systems, and network security appliances; some vendors may delay major hardware refreshes or product launches; and increased costs for cloud security providers could trickle down to enterprises in the form of higher subscription fees.

"While many cybersecurity companies operate on a SaaS model, a significant number still rely on on-premises hardware like firewalls, switches, routers, and SD-WAN devices. The new 25% U.S. tariffs on Canadian imports, effective March 4, 2025, could drive up prices for these essential components," said Evgeniy Kharam, Cybersecurity Architect and Evangelist. "Adding to the strain, the strong U.S. dollar has already made imports more expensive for Canadian firms. In response, Canada imposed a 25% surtax on U.S. goods, further escalating costs. These combined factors will likely increase expenses for Canadian cybersecurity companies, forcing them to adjust pricing and operational strategies."

For vendors, they do have some strategies moving forward, including to prioritize software-based cybersecurity solutions over hardware-dependent products; explore supply chain partnerships outside tariff-affected regions; and monitor tariff retaliation from Canada, Mexico, and China that could affect international sales.

"While CISOs will need to ensure that their security teams are performing adequate due diligence on potential new vendors, they will be pressed to meet the tight deadlines being set by the business in order to keep up with the organizations own goals. This will take a balance of speed, agility, and depth of security review," said Derek Fisher, Director of the Cyber Defense and Information Assurance Program at Temple University. "Further complicating the job of cybersecurity teams is an isolationist stance by the U.S. that is likely to reduce the collaborative relationships that we have with other countries, leading to a decrease in information sharing abroad. This is likely to further complicate the challenges that we have as we adjust to new realities in our cybersecurity strategy, supply chain security, and global partnerships."

Fisher continued, "Lastly, with the last trade war leading to increased cyber activity from adversarial nations, coupled with staff cuts and reduction in funding for cyber defense efforts at the national level, we are at an increased risk of successful attacks on our nations critical infrastructure and financial system."

Trade tensions often escalate into the digital realm. During the previous U.S.-China trade war, Chinese nation-state hackers ramped up cyber espionage campaigns against American companies and government agencies. The latest round of tariffs could provoke similar cyber retaliation.

Chinese APT groups may increase cyberattacks on U.S. critical infrastructure, including energy, finance, and defense sectors. Cloud-based supply chain attacks may spike as companies shift to new, less secure vendors. Espionage against cybersecurity vendors could intensify as foreign actors seek to gain access to security research and software vulnerabilities.

Col. Cedric Leighton, CNN Military Analyst; U.S. Air Force (Ret.); Chairman, Cedric Leighton Associates, LLC, had this comprehensive summary of the fallout from the tariff wars:

"The threat of increased cyberattacks is a real one—especially from China. The Chinese Foreign Ministry spokesman warned that China would fight both trade wars and real wars to the bitter end, clearly implying that the tariffs imposed on China by the Trump Administration are viewed as an act of war by Beijing.  

"We already know that China is targeting America's critical infrastructure.  VOLT TYPHOON and SALT TYPHOON are among the latest known hacking operations that use 'living off the land' techniques to target both military and civilian infrastructure. As cheaper components of cybersecurity products make their way into the supply chain, we can expect various APTs to become more active and dangerous. This will be a major challenge to CISOs everywhere—and it won't get better anytime soon.

"The Mexican cybersecurity market has actually been quite lucrative for U.S. cybersecurity vendors. Currently valued at $2.8 billion, it's expected to grow to $3.19 billion by 2028. And it's a market that can use solid U.S.-made cybersecurity solutions. It turns out that Mexico experienced an estimated 31 billion cyberattacks just in the first half of 2024, an incredible number, or 55% of all cyberattacks in Latin America, making it the most attacked country in the region. The recently imposed U.S. tariffs—and the pending Mexican response to them—could easily put a damper on U.S. cybersecurity vendors' efforts in that country. Tariffs are the last thing U.S. companies need as they try to build trust within a business culture that is often distrustful of U.S. companies.

"Mexico does not have a comprehensive cybersecurity strategy, nor does it have robust legal protections in case companies experience a breach. That makes it even more necessary for companies doing business in Mexico to have as robust a suite of protections as possible. If, as expected, the tariffs make it harder to do business there, the repercussions could be profound for both the Mexican and U.S. economies.

"In contrast to Mexico, Canada does have a National Cyber Security Strategy, as well as a series of National Cybersecurity Action Plans. Last year, Canada's cybersecurity market was valued at over $14 billion and is expected to grow to over $27 billion by 2030. It goes without saying that tariffs could effectively close the door to this very lucrative market for U.S. cybersecurity companies.  

[RELATED: Canada Releases 2025 National Cyber Security Strategy]

"Canada has a talented and experienced cybersecurity workforce. Tariffs could impact the sharing of cyber talent between the U.S. and Canada—and that could negatively impact both nations' abilities to counter pernicious nation-state and criminal threat actors.

"From a national security standpoint, these tariffs could impact the 'Five Eyes' intelligence sharing arrangement that both the U.S. and Canada are a part of. If cyber intelligence is no longer shared between the two countries, both nations will be less secure. And that will have repercussions far beyond the economic dislocations we can expect."

Some common sense approaches for defending against cyber retaliation include:

• Enhance threat intelligence efforts to monitor geopolitical cyber threats.
• Increase red-team exercises to simulate nation-state attack scenarios.
• Tighten cloud security policies as organizations shift workloads to new providers amid trade instability.

For governments and enterprises alike, tariffs and trade disputes are no longer just about economics—they are about national security. The U.S. government is pushing to onshore critical cybersecurity technologies, but this will take years. In the meantime, CISOs, security teams, and IT leaders must adapt to the new cyber risk landscape.

"These real life scenarios are practically ripped from the pages of sample scenarios in NIST SP 800-161, titled 'Cybersecurity Supply Chain Risk Management Practices for Systems and Organization,'" said Justin Armstrong, vCISO and Founder, Armstrong Risk Management, LLC. "It underscores the need to have a Third Party Risk Review Board (NIST refers to this as the Program Management Office or PMO) which meets regularly to go beyond cybersecurity risks and to factor in global politics and finance, regulatory risk, and more."

Bagnall sees four key areas that will be affected by the tariff wars, including cross-border vulnerability research; cybercrime investigations; impact on the public sector and small businesses; and impact on the cyber insurance industry. Here is his detailed breakdown:

1.Cross-border vulnerability research

Cybersecurity research often requires global cooperation, as vulnerabilities in widely used software and hardware transcend national borders (as does cybercrime). Tariffs on cybersecurity tools, research software, or hardware components can have significant effects:

• Restricted access to security tools: Higher costs for security testing tools and forensic software can hinder collaboration between security researchers across different jurisdictions.
• Slower threat intelligence sharing: Tariffs can create tensions between allied nations, reducing the willingness of governments and private sector entities to share intelligence on cyber threats and vulnerabilities. I can see this one being a major problem.
• Fragmentation of security standards: Countries affected by tariffs may develop independent, non-compatible security frameworks, making global cybersecurity efforts less effective and opening gaps for attackers to exploit. "Zero Trust" will take on a whole new meaning. 

2. Cybercrime investigations

Cybercrime investigations require access to international databases, forensic tools, and partnerships between law enforcement agencies worldwide. Tariffs and geopolitical restrictions can impact these efforts in multiple ways:

• Delayed or limited access to forensic tools: If tariffs increase the price of cybersecurity forensic software, law enforcement agencies, particularly in developing or budget-constrained regions, may struggle to afford them. These costs will have to be transferred to tax paying citizens. 
• Reduced cross-border collaboration: When tariffs escalate into broader geopolitical disputes, international cooperation in cybercrime investigations may weaken, slowing responses to threats and hindering prosecution efforts.
• Supply chain security concerns: Cybercriminals may exploit alternative supply chains to bypass tariff restrictions, resulting in an influx of unregulated, potentially compromised technology in critical infrastructure.

3. Impact on the public sector and small businesses

Public sector institutions and small businesses already operate under tight budgets, making them particularly vulnerable to the negative effects of tariffs on cybersecurity products and services.

• Increased costs for security solutions: Higher tariffs on cybersecurity hardware and software lead to increased operational expenses, forcing organizations to make difficult budget decisions that could leave them under protected. Cybersecurity versus roads, parks, and schools for constituents has always been a tough sell. It will become impossible now. 
• Limited access to essential technology: Public sector entities may struggle to secure advanced cybersecurity tools, potentially leaving critical infrastructure more vulnerable to cyber threats.
• Greater risk of cyberattacks: Small businesses often rely on affordable, third-party security solutions. If these solutions become more expensive due to tariffs, businesses may either opt for inadequate security measures or forego cybersecurity investments altogether, increasing their risk exposure.

4. Impact on the cyber Insurance industry

The cyber insurance industry relies on precise risk modeling, threat intelligence, and the ability of policyholders to implement strong cybersecurity controls. Economic tariffs can disrupt this ecosystem in several ways:

• Higher risk exposure: If businesses and public sector organizations are unable to afford essential cybersecurity tools, insurers will face an increase in claims due to a higher frequency of successful cyberattacks.
• Increased insurance premiums: With higher risk exposure, insurers may be forced to raise premiums or impose stricter underwriting requirements, making cyber insurance less accessible to small businesses and government agencies.
• Challenges in incident response: Delays in acquiring forensic and incident response tools due to tariffs may hinder rapid mitigation efforts following a breach, increasing claim costs for insurers.

Bagnall added: "In my experience, these economic tariffs will can have unintended but severe consequences on cybersecurity efforts, cross-border crime investigations, and the ability of public institutions and small businesses to defend against cyber threats. The cyber insurance industry, in turn, faces heightened risk exposure and increased costs, which may lead to more stringent policy requirements and higher premiums.

"There will 100% be an uptick in the frequency and severity of nation-state cyberattacks. 

"To mitigate these risks, policymakers should consider exempting cybersecurity-related products and services from tariffs, encouraging international cooperation in cybercrime investigations, and fostering public-private partnerships to subsidize critical cybersecurity tools for small businesses and the public sector. Failure to address these concerns could leave organizations more vulnerable to cyber threats, ultimately undermining economic and national security."

Here are what some experts from cybersecurity vendors have to say.

Casey Ellis, Founder at Bugcrowd:

"Tariffs disrupt supply chains, and when organizations scramble to adapt, security and long-term resilience often takes a backseat. This creates a perfect storm for vulnerabilities, especially with rushed supplier transitions or the temptation to cut corners on due diligence. I'd emphasize that CISOs need to double down on third-party risk management (TPRM) and supplier audits to avoid introducing new risks while adapting to these changes.

"The potential for cyber retaliation from nation-states like China is a serious concern. Historically, trade tensions have escalated into the digital realm, particularly around increases in espionage. Organizations need to consider their threat intelligence capabilities and prepare for more sophisticated attacks targeting supply chains and intellectual property."

James Turgal, Vice President of Global Cyber Advisory, Risk and Board Relations at Optiv:

"There is a direct correlation between tariffs and their effect on cybersecurity in two major areas.

Tariffs increase costs for businesses, often forcing them to adjust operations, which leads to economic strain on the workforce. Unfortunately, cybersecurity budgets are historically among the first to be cut during economic downturns. We saw this happen over the last few years of higher interest rates, where the cost of corporate borrowing increased so dramatically that it caused layoffs and other issues.

Additional areas of cyber impacts related to tariffs are as follows:

• Smaller security teams: With potential layoffs or a hiring freeze, cybersecurity teams who are already understaffed may be stretched even more, reducing their ability to respond to threats. This situation allows nations facing trade restrictions to increase their cyber espionage efforts for lost access to technology.
• Less investment in security infrastructure: Organizations may delay upgrades to firewalls, intrusion detection systems, and endpoint protection solutions.
• Higher risk of insider threats: Economic uncertainty and significant reductions in force (RIFs) can lead to disgruntled employees, some of whom may leak sensitive data, intentionally or inadvertently. There has been a marked increase over the last few years of nation-state threat actors searching the internet and social media platforms looking for disgruntled employees who are complaining about their job. These insiders have actually been paid by the threat actors to launch attacks or install malware.

• When tariffs force companies to shift supply chains to new, untested vendors, they may inadvertently introduce vulnerabilities. Less reputable manufacturers could have weaker cybersecurity practices, leading to an increased risk of supply chain attacks, hardware backdoors, or compromised software.
• Adversarial nations might exploit these shifts by inserting malicious components into alternative supply chains.

Cybercriminals—especially nation-state threat actors such as China, Russia and Iran—actively exploit financial downturns, targeting businesses that reduce their security defenses."