A renewal notice comes with a new line item: cyber liability coverage. A few hundred dollars a year, easy to discount — the same instinct you’d use on an extended warranty upsell at checkout. A fee that mostly pays for someone else’s peace of mind, not yours.
Good instinct. But wrong.
Before writing off the line item, it helps to know what it offers.
The bet you’re making either way
Most business owners assume a cyberattack happens to someone else — bigger companies, the ones with customer databases worth stealing. A BDC survey of Canadian small businesses found 61% believe exactly that.
They’re wrong. The same survey found 73% of small businesses had already had a security incident. More than half of them weren’t ready when it happened.
Phishing led the way in, then malware, then the nastier ones — network intrusions, ransomware. The number attached to a ransomware demand in that survey: around $50,000 CAD. That’s in addition to the days the business can’t operate while it gets sorted out.
Skip the insurance, and that bet doesn’t go away. It just shows up in your books instead.
What it covers that your other policies don’t
General liability or property insurance already has this covered — or so the assumption goes. It doesn’t. The Insurance Bureau of Canada is blunt about it: most property and liability policies either exclude cyber risk outright or barely touch it.
Cyber coverage exists because a standard policy was never built to pay for what a breach costs — a forensic investigator to figure out what happened, notifying every customer whose data was involved, legal costs, getting your systems working again.
Why it’s gotten harder to buy
A few years ago, filling out a cyber insurance application was a formality. Check a few boxes, sign, done.
Not anymore. Insurers now want to see multi-factor authentication, backups, employee training, and a plan for what happens during an incident already in place — the same baseline the Canadian Centre for Cyber Security has been recommending for years. Show up without it, and you’re either declined or quoted a premium that makes the “waste of money” question answer itself.
That’s the real takeaway: cyber insurance isn’t a replacement for those basics. It covers what preparation can’t eliminate — the cleanup and notification costs after something gets through anyway.
So — worth it?
If the fundamentals are already in place, a policy is a small add-on covering costs a bad week could otherwise put on your books.
If the fundamentals aren’t in place yet, that’s the real problem. Fix them first, and the insurance question mostly answers itself — better coverage, a fairer premium, an application that won’t get declined.
We can tell you honestly where your business stands in relation to what insurers ask for as part of our cybersecurity services. Not sure you’d even qualify for coverage right now? Book a call with us and we’ll walk through it.
