Most Canadian small businesses have experienced a cyber attack in the past five years, yet many continue to treat cyber insurance as optional, according to new findings from Coalition.

The cyber insurer’s Small Business Cybersecurity Study, which surveyed 1,000 decision-makers across small businesses globally, found that 86% of Canadian respondents have been hit by a cyber incident since 2019, higher than the global average of 79%. Despite this, the study points to a persistent underinvestment in cyber protection, including insurance coverage.

According to Coalition, three-quarters of Canadian small businesses allocate 10% or less of their total budget to cybersecurity, a category that includes cyber insurance. A majority also continue to underestimate their exposure, with 70% believing their business is too small to be an attractive target for threat actors.

“Threat actors not only target the most valuable companies but also the most vulnerable: small businesses,” said George Bozanin, head of Canada at Coalition. “Despite the increased risk, small businesses continue to view cybersecurity tools and services as elective purchases and misunderstand the potential serious impacts an attack could have on their business.”

The study found that 90% of Canadian respondents believe their cyber risk has increased over the past year, and more than half (52%) now spend over 10 hours a week on cybersecurity-related activity. However, this growing concern has not yet translated into more comprehensive risk transfer strategies.

Coalition, which offers cyber insurance and active threat monitoring, said the findings suggest small businesses remain underinsured, even as cyber threats become more frequent and costly.

The company plans to release further data from the study over the coming months, aimed at helping businesses, insurers, and brokers address gaps in cyber risk preparedness.