PHOTO: Adobe Stock/Sikov
Small and medium-sized business owners in Canada may be dangerously underestimating the likelihood and complexity of a cyber breach, according to a survey commissioned by the Insurance Bureau of Canada (IBC).
Despite cybercrime hitting a global all-time high, fewer than half of respondents believe their small and medium-sized enterprises (SMEs) are vulnerable to a cyber attack or data breach. Only six per cent of survey respondents strongly agreed that there is a chance their business is vulnerable to a cyber attack or data breach, despite research from Business Development Bank of Canada (BDC) indicating that 73 per cent of small businesses have experienced a cybersecurity incident.
Adding to this concern, 66 per cent of respondents said they are confident in their business’s ability to withstand a data breach or website shutdown. These findings suggest that most SMEs may not fully understand the true impact and cost of recovering from a cyber attack.
According to the survey, only 47 per cent of respondents said their business is prepared for a cyber attack or data breach. While nearly 70 per cent of respondents expressed confidence in their understanding of emerging cyber risks, fewer than half have implemented any form of cyber defence, just 22 per cent carry cyber insurance, and only 12 per cent have a dedicated stand-alone cyber insurance policy.
“Cyber threats can lead to serious financial and legal issues for SMEs – issues that regular business insurance often doesn’t protect them from,” said Mahan Azimi, director, Catastrophic and Emerging Risk Policy, at IBC. “Responding to an attack may require hiring experts like forensic investigators, lawyers and public relations professionals, which can be extremely costly for businesses that don’t have dedicated cyber insurance. A stand-alone cyber policy can also help cover costs associated with lost income, recovery efforts and legal liabilities.”
IBC’s survey results also suggested that business owners are growing more concerned that artificial intelligence (AI) and other new technology will make it harder to protect themselves against cyber risks. Those concerns rose from 65 per cent of respondents in last year’s survey to 72 per cent this year. Still, only 45 per cent say they have policies and training in place to help employees spot AI-generated scams.
In addition, 27 per cent of respondents indicated concerns about potential lawsuits stemming from a cyber breach. As businesses increasingly rely on vendors, cloud services and outsourced IT providers, IBC says third-party cyber risk is becoming a major vulnerability that may leave small business owners liable if a vendor breach compromises customer data.
IBC offers a free Cyber Insurance Guide to help SME owners understand the impact of cyber attacks and how insurance can support recovery. It explains coverage details, offers protection and recovery tips, outlines the application process and shares resources to boost cyber resilience. The guide, along with other resources, is available at www.cybersavvycanada.ca.
“A cyber breach is not just a compromised website or lost data; it’s a business crisis that can impact your reputation and harm anyone whose data you may hold,” added Azimi. “Cyber insurance helps ensure that when the worst happens, you’re not facing it alone.”
