Here are the five cyber risks most likely to affect your business right now – and what you can do about each one.

1. Ransomware

Ransomware is malicious software that locks you out of your own systems and demands payment to restore access. Attackers typically get in through a phishing email, an unpatched software vulnerability, or stolen login credentials. Once inside, they can encrypt your files, your backups, and anything else they can reach.

For small businesses, a ransomware attack can mean days or weeks of downtime – lost revenue, frustrated customers, and a costly recovery process. Some businesses never fully recover.

Cyber insurance with ransomware coverage pays for the ransom, the forensic investigation, and the cost of restoring your systems. It also gives you access to an incident response team who handles the situation on your behalf.

2. Funds transfer fraud

Funds transfer fraud – also called business email compromise – happens when a criminal impersonates someone you trust to trick you into sending money to the wrong account. It might look like an email from your CEO asking for an urgent wire transfer, or a message from a supplier saying their banking details have changed.

This type of fraud is devastatingly effective because it exploits trust rather than technology. No malware required – just a convincing email and a moment of distraction. Losses range from thousands to hundreds of thousands of dollars, and money wired internationally is rarely recovered.

A verification process – calling the requestor on a known number before processing any large transfer – stops most attempts before they succeed. Cyber insurance with funds transfer fraud coverage provides a financial safety net for the ones that get through.

3. Data breaches

If your business stores customer information – names, email addresses, payment details, health records, or anything else that could identify a person – you have data that criminals want. A data breach happens when that information is accessed, stolen, or exposed without authorization.

The consequences go beyond the breach itself. Under Canadian privacy law, businesses are required to notify affected individuals and report certain breaches to the Office of the Privacy Commissioner. Failure to do so can result in significant fines. And if customers sue, the legal costs can be substantial.

Cyber insurance covers the cost of breach notification, legal defense, regulatory fines, and credit monitoring for affected customers – so you’re not absorbing those costs alone.

4. Phishing attacks

Phishing is the most common entry point for cyberattacks. It involves sending fake emails, text messages, or websites designed to trick employees into handing over login credentials, clicking malicious links, or downloading infected attachments.

Modern phishing attacks are sophisticated. They mimic legitimate services your team uses every day – Microsoft 365, your bank, Canada Post, even your own IT department. A single employee clicking the wrong link can give an attacker full access to your systems.

Multi-factor authentication (MFA) is one of the most effective defences against phishing – even if credentials are stolen, attackers can’t get in without the second factor. Regular employee awareness training is also critical. Coalition’s Security Awareness Training helps your team recognize and report phishing attempts before they cause damage.

5. Third-party and supply chain attacks

Your business doesn’t operate in isolation. You use software, services, and suppliers – and each one is a potential entry point for attackers. A supply chain attack happens when criminals compromise a vendor or software provider you rely on to get access to your systems.

These attacks are particularly hard to defend against because they come through trusted channels. You may have strong security in place – but if your payroll software, cloud storage provider, or IT support firm is compromised, your business can be affected too.

Reviewing the security practices of key vendors, keeping software updated, and limiting what access third parties have to your systems all reduce this risk. Cyber insurance covers losses resulting from third-party failures, giving you a financial backstop when the risk comes from outside your control.

How to protect your business from cyber risks

You don’t need to solve every cyber risk at once. Start with the basics:

• Enable multi-factor authentication on all business accounts
• Train your team to recognize phishing emails
• Keep software and systems updated and patched
• Have a verification process for any wire transfer or banking change request
• Back up your data regularly and store backups offline or offsite
• Review what access your vendors and suppliers have to your systems

The cyber risks Canadian small businesses face aren’t going away — but they are manageable. Make sure you have cyber insurance in place. Not because you expect the worst — but because the right policy means that if something does happen, you have the financial support and expert help to get through it.

It might show up as an email that looks like it’s from your CEO, asking the accounting team to process an urgent wire transfer. Or a message that appears to be from a vendor you pay regularly, letting you know their banking details have changed. The email looks legitimate. The request seems reasonable. By the time anyone realizes something is off, the money is gone.

Why it works

Funds transfer fraud is effective because it exploits trust rather than technology. Unlike ransomware that requires breaking into your systems, this type of fraud often needs nothing more than a convincing email and a moment of distraction.

Criminals research their targets in advance – using publicly available information to understand your business relationships, your communication style, and your payment process. The messages they send can be surprisingly convincing.

What it costs

Funds transfer fraud is one of the most common causes of cyber insurance claims in Canada. Individual incidents range from a few thousand to hundreds of thousands of dollars – and money wired internationally is often very difficult to recover.

For small businesses, even a single incident at the lower end of that range can be financially devastating – especially without insurance coverage in place.

How to reduce your risk

The most effective defence is a simple verification process:

• Require that any funds transfer over a certain amount (say, $10,000 or $25,000) be verbally confirmed with the requestor using a known phone number – not one provided in the email
• Train your team to be skeptical of urgency. Fraudulent requests often come with pressure to act quickly and quietly.
• Verify any change to a vendor’s banking details with a phone call before you process a payment

These steps cost nothing. They stop most fraud attempts before they succeed.

What cyber insurance covers

If your business falls victim despite taking reasonable precautions, a cyber insurance policy with funds transfer fraud coverage can help recover some or all of the loss – up to your policy’s sublimit for this type of claim.

Sublimits vary between policies, so it’s worth asking specifically about the funds transfer fraud limit when comparing options. Make sure it reflects the size of transactions your business actually processes.

The bottom line

Funds transfer fraud is one of the easiest cyber risks to defend against with the right process in place – and one of the most expensive when that process isn’t there. A combination of employee awareness, verification procedures, and solid cyber insurance gives your business real protection against this very real threat.

If nobody is watching, those early warning signs just go unnoticed. That’s the gap Managed Detection and Response (MDR) fills. It’s a service that monitors your IT environment continuously, looks for signs of intrusion, and responds to threats before they escalate into something serious.

What MDR actually does

Think of MDR as a team of security analysts watching your systems 24 hours a day, 7 days a week, using specialized tools designed to catch threats that standard antivirus software might miss.

When something suspicious is flagged, the team investigates. If it’s a real threat, they act – isolating affected systems, blocking malicious activity, or alerting your team with clear next steps.

For most small businesses, this level of monitoring isn’t realistic without a service like MDR. You’d need to hire multiple security specialists and maintain around-the-clock coverage yourself. MDR delivers all of that as a managed service running quietly in the background.

MDR vs. MXDR – what’s the difference?

MDR focuses on your laptops, desktops, and devices. MXDR goes further, extending monitoring to your cloud platforms as well – things like Microsoft 365, Google Workspace, your firewall, and identity systems. If your team works in the cloud or remotely, MXDR gives you a more complete view.

Both services include 24/7 threat monitoring and response from Coalition’s security team, plus the SentinelOne endpoint protection platform.

How MDR and cyber insurance work together

MDR and cyber insurance complement each other naturally. MDR works to prevent incidents – or catch them early. Cyber insurance covers the financial fallout if one does happen.

There’s also a practical financial benefit: adding Coalition MDR to your Coalition cyber insurance policy may qualify you for a premium credit of up to 12.5%. Investing in better protection can actually reduce what you pay for coverage.

Is MDR right for your business?

Managed Detection and Response is worth a look if your business:

• Stores sensitive customer or financial data
• Has employees working remotely or using remote access tools
• Processes electronic payments or wire transfers
• Doesn’t have a dedicated IT security team

If you’re already thinking about cyber insurance, MDR is a natural next question. We’re happy to help you figure out whether it makes sense for your situation.

The bottom line

Managed detection and response gives small businesses access to enterprise-level security monitoring without the cost of building an in-house team. Combined with a solid cyber insurance policy, MDR is one of the most effective ways a small business can protect itself from the growing threat of cyberattacks.

The answer to both is yes. Here’s the thinking.

What cybersecurity tools do

Cybersecurity tools – antivirus software, firewalls, multi-factor authentication, threat monitoring – are designed to prevent attacks from succeeding. They raise the difficulty for attackers, catch suspicious activity early, and help limit damage when something does get through.

Good security tools reduce your risk. They can’t eliminate it.

What cyber insurance does

Cyber insurance covers the financial fallout of an attack that succeeds despite your defences. It pays for forensic investigation, system recovery, legal costs, regulatory fines, lost income, and more. It also typically includes access to an incident response team to help you manage the situation in real time.

Insurance doesn’t stop attacks. It means you’re not financially wrecked by one.

Why you need both

Think of it like car insurance and careful driving. Good driving habits reduce your chances of an accident. Insurance covers you when one happens anyway.

Security tools make your business a harder target. Cyber insurance covers you when a determined attacker – or a well-crafted phishing email – gets through anyway.

Businesses that invest in both are in the strongest position: lower risk, and a financial safety net when risk shows up.

There’s a financial bonus too

There’s a real incentive to combining both. Insurers assess your security posture as part of underwriting. Businesses with stronger controls often pay less for equivalent coverage.

And if you pair your Coalition cyber insurance policy with Coalition MDR, you may qualify for a premium credit of up to 12.5%. Better security can actually lower your insurance bill.

The bottom line

The question isn’t really cyber insurance vs. cybersecurity tools – it’s how to get the most protection for your business with the budget you have. For most small businesses, the answer is a combination of both – starting with the basics and building from there.

Here’s a plain-English breakdown of what a solid cyber insurance policy should cover – and a few things worth watching for.

First-party coverage – losses to your own business

First-party coverage pays for direct losses your business suffers as a result of a cyber incident.

• Ransomware and extortion – covers ransom payments and the cost of responding to an extortion demand
• Business interruption – replaces lost income if your systems go down and you can’t operate
• Data restoration – covers the cost of recovering or rebuilding data that was damaged or destroyed
• Forensic investigation – pays for the technical experts who figure out what happened and how
• Crisis management – covers public relations costs if the incident damages your reputation

Third-party coverage – claims made against your business

Third-party coverage protects you if customers, partners, or regulators come after you following an incident.

• Privacy liability – covers legal costs if customers sue you over exposed personal data
• Regulatory defense – covers fines and penalties from privacy regulators
• Network security liability – covers claims that your systems caused harm to others

Cyber crime coverage

This is a separate but related area that covers financially motivated fraud rather than just system attacks.

• Funds transfer fraud – covers losses from being tricked into sending money to a fraudulent account
• Social engineering – covers manipulation-based fraud like fake invoice scams
• Phishing – covers losses resulting from credential theft via fake emails or websites

What to watch for

Not all policies are created equal. A few things worth asking about:

• Sublimits – some policies have lower limits for specific coverage types like funds transfer fraud. Make sure the sublimits reflect the actual size of transactions your business processes.
• Waiting periods – business interruption coverage often has a waiting period before it kicks in. Shorter is better.
• Retention – this is the cyber equivalent of a deductible. Know what yours is and whether it applies to every coverage type or just some.
• Pay on behalf vs. reimbursement – the best policies pay costs on your behalf upfront. Reimbursement models mean you cover costs out of pocket and wait to be paid back.

The bottom line

Cyber insurance is worth having – but only if the policy actually covers the risks your business faces. That means reading the details, asking the right questions, and working with a broker who can explain what you’re actually getting.

What Does Cyber Insurance Cover? Questions to Ask Your Broker

Understanding what does cyber insurance cover is just the first step. Before signing any policy, it’s worth asking your broker a few targeted questions to make sure the coverage actually fits your business. Here are the key things to clarify:

Does the policy cover ransomware payments and related negotiation costs? Some insurers restrict this or impose sublimits.

What is the waiting period for business interruption coverage? Many policies have a minimum waiting period of 8–12 hours before coverage kicks in.

Is social engineering fraud included, or is it an add-on? This is often sold separately and is one of the most common claim types for small businesses.

Does the policy pay on your behalf or reimburse you after the fact? Pay-on-behalf policies provide immediate financial relief without requiring out-of-pocket outlay.

Standard commercial general liability insurance – the policy most BC businesses carry – was designed for physical risks. Slip and falls. Property damage. It wasn’t built for ransomware, data breaches, or fraudulent wire transfers. If a cyberattack hits your business and you’re relying on a general liability policy, you’re likely on your own.

What general liability doesn’t cover

General liability insurance covers bodily injury and property damage caused to others. It doesn’t cover:

• The cost of recovering your own data or systems after an attack
• Ransom payments demanded by hackers
• Lost income while your systems are down
• Legal costs if customer data is exposed
• Fraudulent transfers made by criminals impersonating your suppliers or executives

Some business owners assume their property insurance covers digital assets. It typically doesn’t – most property policies explicitly exclude electronic data. This is one of the most common and costly coverage gaps we see when reviewing policies for BC businesses.

What cyber insurance BC small business policies actually cover

A dedicated cyber policy is designed specifically for these risks. A solid cyber insurance BC small business plan typically covers:

• Ransomware response and extortion payments
• Data breach notification and legal costs
• Business interruption losses while systems are restored
• Forensic investigation to understand what happened
• Funds transfer fraud if you’re tricked into sending money to the wrong account
• Regulatory fines and penalties for data exposure

Policies vary significantly in what they include, so it’s important to review the specific terms. A broker experienced in cyber risk can help you understand what’s actually covered and where the exclusions are buried.

The gap is bigger than most people think

A 2023 survey found that more than half of Canadian small businesses had experienced a cybersecurity incident – yet fewer than 20% had cyber insurance. That gap represents a lot of businesses absorbing costs they didn’t plan for and couldn’t easily recover from.

The average cost of a data breach for a small Canadian business runs into the tens of thousands of dollars at minimum. Ransomware incidents regularly cost more. According to the Government of Canada’s cybersecurity resources, small and medium businesses are increasingly targeted precisely because they tend to have weaker defences than larger enterprises.

For BC businesses specifically, the combination of remote work, cloud-based accounting tools, and email-based client communication creates multiple points of exposure that simply didn’t exist a decade ago.

How to find out where you stand

The fastest way to know if you have a gap is to pull out your current policy and look for the words “cyber,” “data breach,” or “network security.” If those words don’t appear, you probably don’t have meaningful cyber coverage.

When shopping for cyber insurance, BC small business owners should compare a few key factors: coverage limits, whether social engineering and funds transfer fraud are included, and any sublimits on ransomware payments. These details matter far more than the price of the premium alone.

The next step is a conversation with a broker who understands both the insurance side and the risk side. We’re happy to have that conversation with you – no pressure, no jargon.