Cyber Insurance for Canadian Businesses

Air1 is based in Langley, BC and works with clients across Canada. Availability depends on the province and the insurer, so call us on 1-888-917-1177 and an advisor will confirm what we can arrange for your business.

Contact your insurer’s claims or incident line before you pay a ransom or hire outside help, as many policies require their consent. Then disconnect affected devices, keep a record of what happened, and check whether privacy law requires you to report a breach. This is general information, not legal advice.

Insurers commonly ask about security basics such as multi-factor authentication, tested backups, software updates and staff training. Some may require certain controls before offering cover or may price based on them. Others do not set conditions. We can tell you what each option asks, so there are no surprises at claim time.

Some policies include cybercrime cover for losses from fake invoices, impersonation emails and funds transfer fraud. It is often optional or has a lower sub-limit than the main cover. If your business pays suppliers by e-transfer or wire, ask specifically how this is covered and what verification steps the insurer expects.

Often only partly, and sometimes not at all. Many commercial general liability and property policies exclude or sharply limit electronic data and cyber events. Ask your broker to check your wording. Our business insurance team can review what you have and show where a cyber policy would fill gaps.

There is no standard price. Cost depends on your industry, revenue, the amount and type of data you hold, your security controls, the limit and deductible you choose, and your claims history. Published estimates vary widely. The reliable way to find out is a quote based on your actual business, which we can arrange.

Many cyber policies respond to ransomware and other extortion, which can include specialist response costs and, where the policy allows, ransom-related costs. Some insurers treat extortion as an optional extra or limit it. Ask whether it is included, what the limit is, and what you must do before paying anything.

A cyber policy can include incident response, data recovery, business interruption, cyber extortion, privacy and network security liability, notification and regulatory costs, and cybercrime such as funds transfer fraud. Not every policy includes every part, and some parts carry lower limits, so compare the wording rather than the headline limit.

If your business uses email, takes payments, stores customer or employee information or depends on computer systems, it has cyber risk, whatever its size. Statistics Canada found that 15% of small businesses were impacted by a cyber incident in 2025. Whether you need cover depends on how much a serious incident would cost you and what your contracts require.

The two names are usually used for the same type of policy. “Cyber liability” tends to point to the third-party side, such as claims against you after a breach, while “cyber insurance” often also includes your own costs, such as incident response and lost income. Check which parts a policy includes.

Cyber insurance is business insurance for the financial cost of a cyber incident, such as ransomware, a data breach, stolen funds or a long system outage. Depending on the policy, it can help pay for incident response, data recovery, lost income, legal costs and claims from people whose information was exposed. Cover varies by insurer and policy wording.