Insurance Bureau of Canada (IBC) issued fresh guidance last week urging businesses to evaluate their exposure to cyberattacks, warning that companies handling sensitive customer data, processing online payments or relying heavily on digital infrastructure face heightened risk.
The advisory, written by Mahan Azimi, IBC's director of catastrophic and emerging risk policy, points businesses toward a free 10-question Cyber Insurance Assessment to gauge readiness for coverage.
The advisory lands as Canada's cyber insurance market softens. Rates decreased 5% in the first quarter of 2026, with capacity expanding across excess and primary layers, including from new market entrants, increasing competition, according to Marsh's Canadian coverage index. That follows a longer trend. Canadian cyber insurance rates fell 6% in the first quarter of 2025 as capacity increased, with clients using competitive conditions to enhance coverage and reduce retentions.
Despite that softening, cheaper and more available cover has not translated into higher uptake. IBC-commissioned survey data found that just 22% of respondents, small and medium-sized enterprises (SMEs), carried cyber insurance, while only 12% had a dedicated standalone cyber policy - the gap between falling prices and flat demand is itself the story the advisory is trying to address, since it suggests the barrier to purchase isn't cost.
The uptake gap tracks a wider confidence gap. Only 48% of SME respondents believe their business is vulnerable to a cyberattack or data breach, and just 6% strongly agree there is a chance their business is vulnerable, despite Business Development Bank of Canada survey data showing that 73% of small businesses have experienced a cybersecurity incident. Written cybersecurity policies have also stalled, with 26% of Canadian businesses having one in place in 2023, unchanged from 2021, according to Statistics Canada.
"A cyber insurance policy may help your business manage some of the costs associated with a data breach, such as notifying affected customers, providing credit monitoring services to customers, hiring cyber forensic experts to investigate the crime and covering certain legal expenses," Azimi said.
CIRA's 2025 Canadian Cybersecurity Survey reported 43% of Canadian organizations were hit by a cyberattack in the past 12 months, with the steepest year-over-year increase in the small-business cohort.
The July advisory walks businesses through three exposure checkpoints: whether they store customer data online, whether they process electronic payments, and whether they hold employee records digitally. IBC noted a cyber policy may help cover breach notification, credit monitoring, forensic investigation and certain legal costs, as well as lost business while systems are restored and system recovery costs.
