Why do I need cyber insurance?

Even though Canada has seen a sharp increase in cyber crime over the past few years, many businesses still underestimate their exposure to cyber risks. According to a recent survey commissioned by the Insurance Bureau of Canada (IBC), fewer than half of small and medium-sized businesses (SMBs) believe their business is vulnerable to a cyber attack or data breach. Yet, research from the Business Development Bank of Canada (BDC) shows that 73% of small businesses have already experienced a cybersecurity incident.

Despite this, just 22% told the IBC that they carry cyber insurance and only 12% have a dedicated stand-alone cyber insurance policy. Read on to learn more about why cyberattacks don’t only target larger businesses and how cyber insurance can help protect yours.

Why are small and mid-sized businesses (SMBs) most at risk in Canada?

According to the same BDC research, 61% of those who responded to the poll said they believed larger companies are more likely to be targeted by hackers. And that’s a pretty common way to think. Larger companies have more money, so that means larger potential payouts for the hackers, right?

Think again. The BDC says that for cyber criminals seeking large payouts, it can actually be easier to demand smaller amounts from multiple less-protected businesses than to attack a single large company that has more resources to protect itself.

This is why small and mid-sized businesses are often targeted. While they may use the same technology as large organizations, they tend to have fewer internal security resources in place. Further, some business owners may assume that cloud services will protect them from online risks. But while cloud providers secure their platforms, your business is still responsible for how accounts are accessed, how email is protected and how data is shared.

Common threats facing Canadian SMBs

The Canadian Centre for Cyber Security says phishing attacks are one of the most reported types of fraud, while ransomware attacks are one of the most serious cyber threats in Canada because they can:

• Disrupt or completely shut down business operations

• Damage or destroy important business data

• Expose sensitive customer or employee information

Other cyber threats can also delay billing, interrupt payroll and slow or halt a business’s day-to-day operations. For example, in February 2024, a ransomware attack on the Canadian pharmacy chain London Drugs temporarily forced some of its stores in Western Canada to close.

What is cyber insurance?

Cyber insurance is a type of business insurance coverage that responds to losses caused by cyber incidents, such as data breaches, ransomware and online fraud. It helps to cover costs related to hiring cybersecurity experts for incident response and investigation, as well as legal fees, settlement costs and judgments against your company because of incidents like data breaches. It can also help support communication and recovery efforts when a breach affects customer trust and a company’s reputation. These policies usually include two parts: first-party coverage (your own costs) and third-party coverage (claims by others). Here's what you should know:

First-party coverage

First-party coverage pays for costs your business incurs directly after a cyber incident. This commonly includes:

Third-party coverage

Third-party coverage, often called cyber liability insurance, is what responds when others make claims against your business due to a network security or privacy event. This may include:

• Claims related to privacy breaches

• Allegations of failure to protect systems or data

• Regulatory defence costs

• Certain payment card–related assessments or penalties

Optional coverage

With standard cyber insurance coverage, some types of cyber risks are not included automatically. This means for your business to have a more comprehensive cyber insurance policy, you may need to add riders or endorsements to protect it from things like:

• Social engineering fraud

• Funds transfer fraud

• Non-malicious system failures

• Bricking

• Reputational harm

How does a cyber insurance claim work?

If a cyber incident happens, you can file a claim with your insurer to help you recover. Let's take a look:

1. Contain the problem

The first step is stopping the incident from getting worse. Your IT provider or managed service provider should be able to help you isolate the affected systems, disable any compromised accounts and preserve your logs and evidence so that the cause can be investigated properly.

2. Notify your insurer as soon as possible

Cyber policies usually include a 24/7 claims hotline. This will give you access to the insurance company’s incident response team, including forensic analysts and PR specialists, who will help to minimize downtime, guide you through the next steps and coordinate the response. Early notice is often essential or required to keep your coverage intact.

Note: Starting work or hiring vendors before notifying the insurer can affect your coverage.

3. Investigate what happened

Your insurer will assign digital forensics specialists to look at email activity, system access and security logs to determine how the incident occurred and what was affected. They will also assign you legal counsel to advise you on privacy and notification obligations under PIPEDA or any applicable provincial laws.

4. Notify people and organizations if required

Canada has privacy laws, such as PIPEDA and in some cases, provincial laws like PHIPA, that may require a business to formally notify its customers or clients when their personal information is exposed. You may need to let your business’s customers, employees or patients know about the privacy breach and offer support services such as credit or identity monitoring.

With help from legal guidance, you will also need to send any required notices to regulators, payment processors or business partners, based on federal or provincial privacy laws and contract terms.

5. Decide how to recover

With guidance from your insurer and its response team, you’ll make decisions about whether it’s best to restore systems or rebuild environments or how to respond to any ransomware or extortion demands, as payments are generally not recommended and are only allowed where they do not violate Canadian sanctions or criminal law.

6. Restore your business operations

Once your files and applications are restored, you can resume your normal business operations. Security controls such as multi-factor authentication or endpoint protection are often strengthened at this stage.

7. Calculate your business losses

If the incident caused any downtime for your business, any lost income and extra expenses can be reviewed and calculated for a payout, according to your policy.

8. Learn from the incident

Now that you’ve fully recovered, it’s time to review exactly what went wrong and figure out how you can reduce the risk of this happening again, such as making improvements to your current security measures or updating your insurance coverage.

What do insurers expect from businesses in 2026?

When an insurance provider assesses your business’s cyber risk today, they’re not necessarily looking to see that you have the perfect security setup. What they really want to know is whether you had basic safeguards in place and if they were actually used. Most Canadian insurance companies now expect businesses to have at least the following cybersecurity measures in place:

• Remote access, VPNs and cloud admin accounts to require multi-factor authentication

• Endpoint protection software to be installed on workstations and servers that are actively monitored for alerts

• Backups to be kept offline or immutable and tested regularly to make sure data can be restored

• Operating systems, firewalls, VPN devices and browsers to be patched within defined timeframes

• Email accounts to use multi-factor authentication for all users, not just administrators

• Email filtering to block common phishing attempts and scan links and attachments

• Payment or banking changes to require out-of-band verification, such as a phone call

• Employees to receive basic security awareness or phishing training at least once per year

• Administrative privileges to be limited to staff who need them for their role

• Third-party vendors or IT providers to use secure access methods and limited permissions

• A written incident response plan and a list of who to contact if something happens

Insurance providers may ask about these security steps when you apply for coverage, renew your policy or after a claim and they expect your answers to match how your systems actually work day to day. If those basic steps aren’t in place or if they discover that they don’t match what was described, your insurer may decide to charge you higher premiums or limit your coverage or they may decline to offer a policy or renew it.

What may not be covered by standard cyber insurance?

Because cyber insurance does not cover every loss connected to a cyber incident, it’s important to understand where your coverage usually stops. Here's what you should know:

• Incidents that started before the policy began or were known but not disclosed

• Fines and penalties if they’re not legally insurable in Canada, even when legal costs are covered

• Large-scale cyber conflict, though wording and scope vary by insurer

• Losses involving outdated or unsupported systems that contributed to the incident

• Certain types of cybercrime, like email fraud, non-malicious system outages and losses caused by a vendor’s systems (can be added with endorsements)

• Bodily injury and physical property damage (they’re handled under other types of business insurance)

How much does cyber insurance cost?

The cost of cyber insurance usually comes down to two things: what kind of business you run and how well your systems are protected. When determining your rates, insurance companies look at factors like:

• Your industry

• Your revenue

• The kind of data you handle

• Your current security practices

• Whether you’ve had cyber incidents before

• How much coverage you want

A business that stores customer information, employee records, health data or payment details will usually face higher premiums, simply because claims involving those types of personal information tend to be more expensive to deal with.

However, a business can help offset that higher cost by proving that they use more and better security measures, as the right measures will not only reduce the chance of an incident, but they can also help limit how bad things get if one happens. Contact a local insurance broker today to find out how much cyber insurance would cost for your business.

How to choose your policy limit and deductible

A single data breach can cost millions of dollars in forensic investigations, legal fees, regulatory fines, customer refunds and lost revenue. According to Statistics Canada, recovery spending for businesses doubled from $600 million in 2022 to $1.2 billion in 2023.

That’s why many Canadian small and mid-sized businesses carry cyber limits between $1 million and $5 million, with their deductibles chosen based on what they could safely absorb financially. When choosing a cyber insurance limit, it may help if you think less about worst-case scenarios and more about what it would actually cost to get your business back on its feet. Keep the following in mind:

Your revenue and cash flow

If you rely on email, shared files, online payments or time-sensitive work, even a short outage could disrupt your cash flow. Business interruption coverage is often one of the biggest parts of a cyber insurance claim, especially if systems are down for several days.

The type of data you handle

Businesses that store customer details, employee records, health information or payment data tend to face higher costs after an incident. Even a simple email compromise can lead to a legal review, notification requirements and follow-up support for affected customers or business partners.

Your downtime tolerance

Ask yourself how long you could realistically operate without access to your main systems. Recovery time depends on the type of incident and how good your backups are. It’s not that uncommon for getting fully back to normal to take longer than you expected.

Your contractual requirements

Some clients, vendors or payment processors may require your business to carry specific minimum cyber insurance limits or coverage, such as protection against payment card assessments or cyber extortion.

While some financial losses may technically be covered, like email fraud or dependent business interruption, it’s often at a smaller limit unless higher limits are added with an endorsement. A business insurance broker can help you decide the best limits and deductibles for your business.

Contact BrokerLink today

Get in touch with BrokerLink today by phone or email to speak with one of our licensed business insurance experts who can help you find the right cyber insurance policy that’s customized to fit your unique business needs. You can also visit us in person at any one of our locations throughout Canada or try out our free online quote tool that can provide you with a competitive quote in minutes from the comfort of your home!

Call Us 1-866-724-2372