Canadian small businesses are underprepared for cyber attacks
Small and medium-sized business owners in Canada may dangerously underestimate the likelihood and complexity of a cyber breach, according to a new survey commissioned by Insurance Bureau of Canada (IBC).
Toronto, ON (Oct. 1, 2025) – Despite cyber crime hitting a global all-time high, fewer than half (48%) of respondents representing small and medium-sized enterprises (SMEs) believe their business is vulnerable to a cyber attack or data breach. Only 6% of them strongly agree that there is a chance their business is vulnerable to a cyber attack or data breach, despite research from Business Development Bank of Canada (BDC) highlighting that 73% of small businesses have experienced a cyber security incident.
Adding to this concern, 66% of respondents said they are confident in their business’s ability to withstand a data breach or website shutdown. These findings suggest that most SMEs may not fully understand the true impact and cost of recovering from a cyber attack.
Other key findings from the survey include:
- Only 47% of respondents say their business is prepared for a cyber attack or data breach.
- Nearly seven-in-10 (69%) of respondents expressed confidence in their understanding of emerging cyber risks.
- Fewer than half (48%) have implemented any form of cyber defence.
- Just 22% carry cyber insurance, and only 12% have a dedicated stand-alone cyber insurance policy.
“Cyber threats can lead to serious financial and legal issues for SMEs – issues that regular business insurance often doesn’t protect them from,” said Mahan Azimi, Director, Catastrophic and Emerging Risk Policy, IBC. “Responding to an attack may require hiring experts like forensic investigators, lawyers and public relations professionals, which can be extremely costly for businesses that don’t have dedicated cyber insurance. A stand-alone cyber policy can also help cover costs associated with lost income, recovery efforts and legal liabilities,” he added.
IBC’s survey results also showed that business owners are growing more concerned that artificial intelligence (AI) and other new technology will make it harder to protect themselves against cyber risks, with concerns rising from 65% of respondents in last year’s survey to 72% this year. Still, only 45% say they have policies and training in place to help employees spot AI-generated scams.
In addition, 27% of respondents indicated they are concerned about potential lawsuits stemming from a cyber breach. As businesses increasingly rely on vendors, cloud services and outsourced IT providers, third-party cyber risk is becoming a major vulnerability – potentially leaving small business owners liable if a vendor breach compromises customer data.
IBC has developed a free Cyber Insurance Guide to help SME owners understand the impact of cyber attacks and how insurance can support recovery. It explains coverage details, offers protection and recovery tips, outlines the application process and shares resources to boost cyber resilience. The guide, along with other resources, is available at www.cybersavvycanada.ca.
“A cyber breach is not just a compromised website or lost data; it’s a business crisis that can impact your reputation and harm anyone whose data you may hold,” added Azimi. “Cyber insurance helps ensure that when the worst happens, you’re not facing it alone.”
About the Angus Reid survey
These findings are from a survey conducted by Insurance Bureau of Canada from August 20th to August 22nd, 2025, among a representative sample of 1506 online adult Canadians who are members of the Angus Reid Forum. The survey was conducted in English and French. For comparison purposes only, a probability sample of this size would carry a margin of error of +/-2.53 percentage points, 19 times out of 20.
About Insurance Bureau of Canada
Established in 1964, Insurance Bureau of Canada (IBC) is the national industry association representing Canada’s private home, auto and business insurers. Its member companies make up the vast majority of Canada’s highly competitive property and casualty (P&C) insurance market. As the leading advocate for Canada’s private P&C insurers, IBC collaborates with governments, regulators and stakeholders to support a competitive environment for the P&C insurance industry to continue to help protect Canadians from the risks of today and tomorrow. IBC believes that Canadians value and deserve a responsive and resilient private P&C insurance industry that provides insurance solutions to both individuals and businesses. For more information, visit www.ibc.ca.
Source: Insurance Bureau of Canada (IBC)
Tags: Business Development Bank of Canada (BDC), cyber attacks, cyber risk, Insurance Bureau of Canada (IBC), small business, survey