AI Cyberattacks Are Hitting Canadian Small Businesses. Here’s What Cyber Insurance Covers

That distinction costs businesses real money, and we’ll get to it below. First, the part most owners underestimate: how much the threat has changed in the last 18 months. 

How Big Is the Cyber Threat to Canadian Small Businesses? 

Canada-specific numbers tell the story better than global ones: 

• More than half (53%) of 1,000 Canadian small business owners experienced a cyberattack in 2025, a Zensurance survey found, with 46% being hit with a phishing attack.

• 43% of Canadian organizations said they were targeted by a cyberattack in the past 12 months, according to the Canadian Internet Registration Authority (CIRA), and 42% experienced a breach of customer or employee data; up sharply from 29% in 2022.
• Just 22% of Canadian small and medium-sized businesses carry cyber insurance, and only 12% have a dedicated standalone cyber policy, according to the Insurance Bureau of Canada (IBC).
• Ransomware incidents in Canada are on the rise overall and continue to increase annually, according to the Canadian Centre for Cyber Security, and incidents have grown an average of 26% year over year from 2021 to 2024.
• Across Canada, individuals and businesses lost a record $704 million to fraud in 2025. The Canadian Anti-Fraud Centre (CAFC) estimates only 5% to 10% of fraud is ever reported, so the real figure is likely several times higher.

How Are Criminals Using AI to Attack Small Businesses? 

Three ways, and none of them require technical skill on the attacker’s end:

1. Voice cloning and deepfake approvals. A few seconds of audio (a podcast, an Instagram Reel, a voicemail greeting) is enough to generate a convincing fake call. The scam is simple: someone who sounds like the owner phones the bookkeeper and approves an urgent transfer.
2. Phishing without the tells. The old advice was to watch for typos, odd grammar, and stilted phrasing. AI erased that. Attackers now produce fluent, on-brand emails at scale, and can mirror a real supplier’s tone by scraping an existing email thread. The message asking you to update banking details looks exactly like every other message that supplier has sent you.
3. Invoice and payment fraud at volume. What used to take a criminal an afternoon of research now takes minutes, which means small businesses that were once too much effort to bother with are now worth targeting. Business email compromise remains the most expensive single incident type for Canadian SMBs.

How Can You Protect Your Business From AI-Powered Scams? 

The controls that stop AI-powered attacks are mostly free, and the most effective one is a phone call:

• Put phishing-resistant multi-factor authentication on email, banking, and payroll first. Your business should require employees to use MFA when accessing your data and network from any computing device. Start with those three accounts before worrying about anything else. They’re where the money and the credentials live.
• Set a verbal callback rule. Any payment request or change to banking details gets verified by phone, using a number you already have on file. Not the number in the email. Not the number in the signature block. This one habit defeats both voice cloning and business email compromise, and it costs nothing.
• Agree on a code word. Pick a phrase only you and whoever moves money would know, and use it for urgent requests. Cheap insurance against a voice that sounds exactly like you.
• Test your backups by actually restoring a file. Untested backups are the most common reason a ransomware incident turns expensive. Keep at least one copy offline.
• Spend 15 minutes this month walking your team through one real phishing email. Cybersecurity Awareness Month gives you the excuse. Get Cyber Safe publishes free, co-brandable assets you can use.

What Does an AI-Enabled Attack Actually Cost? A Real Claim 

One of our clients was hit with a ransomware attack. Their cyber insurance covered more than $70,000 in damages.

What the $70,000 paid for: Forensic investigation, system restoration, legal advice, breach notification, business interruption, ransom payment if applicable. Most small businesses don’t have $70,000 sitting idle. 

And per our 2026 Small Business Confidence Index survey, 61% of the Canadian small business owners we surveyed are operating without insurance at all.

Does Cyber Insurance Cover AI-Generated Cybercrime? 

Yes. Cyber policies are written around what happened to your business, not the tools the criminal used. A deepfake voice call that leads to a fraudulent wire transfer is assessed the same way as a phone call from a human impersonator. 

But which part of your policy responds depends on how you were hit, and that’s where AI-driven scams catch businesses: 

1. Cyber liability insurance handles the aftermath of a breach: Forensics, legal advice, breach notification, credit monitoring, and restoring your systems. 
2. Cybercrime insurance handles stolen funds: Phishing, spear phishing, and hackers getting into your servers, website, or email accounts. 

The deepfake wire transfer falls under the second one. A cyber liability policy alone may not respond to money you sent voluntarily, even if you were deceived into sending it. If you only carry one of the two, ask a broker which is best for your business.

For a full breakdown of what cyber insurance covers, see our guide to cyber insurance for Canadian small businesses. 

What Doesn’t Cyber Insurance Cover? 

Social engineering and funds transfer fraud are often sub-limited or excluded on base cyber wordings, which is exactly the gap AI-powered scams exploit. Other common limitations include: 

• An employee hacking or damaging your systems or data
• A power surge or failure resulting in damage to your systems or data (this is covered by equipment breakdown insurance)
• Patent/IP infringement (you can purchase this coverage separately)

How Much Does Cyber Insurance Cost in Canada?

Cyber coverage starts at about $300 per month for a small business with under $100,000 in annual revenue. Your premium depends on your revenue, how many customer records you store and what kind, your industry, and the security controls you already have in place.

That last factor works in your favour. The MFA and staff training in the checklist above can lower what you pay.

Frequently Asked Questions About Cyber Insurance in Canada

Does cyber insurance cover deepfake or AI voice fraud?

Generally yes, when the loss is a theft of funds and your policy includes cybercrime or social engineering coverage. Cyber liability coverage alone may not respond to money transferred voluntarily. Check your policy’s social engineering sub-limit.

Is cyber insurance mandatory in Canada?

No. It isn’t legally required. But clients may ask for proof of it in contracts, and PIPEDA obligates you to report breaches that create a real risk of significant harm.

Does my business insurance already include cyber coverage?

Usually not. A commercial general liability policy typically won’t respond to a data breach or a ransomware demand. Cyber is either an add-on or a standalone policy.

How much cyber insurance does a small business need?

It depends on how much data you hold and how long you could survive with your systems down. Most small businesses start with a $50,000 limit. A broker can size it against your revenue and record count.

How to Get Cyber Insurance for Your Small Business in Minutes

Get a free cyber liability insurance quote in minutes. 

We’ll shop our network of more than 50 insurers, tailor the policy to your business, and issue your certificate of insurance often the same day. 

Zensurance is trusted by hundreds of thousands of Canadian small businesses and independent professionals. 

– Updated September 30, 2026.