What does cyber insurance cover?

It covers your own costs after a cyber incident, including breach counsel, forensics, notification, ransomware response, data restoration and lost income while systems are down. It also covers claims against you when your security failure harms customers or partners, and defence in privacy regulatory proceedings. Funds transfer fraud and social engineering are often included to a sublimit.

Does my business package policy already cover cyber?

Usually not in any meaningful way. Most commercial property and general liability forms exclude or sharply limit losses from data and network events. Some packages add a small cyber endorsement, but it typically pays only limited breach costs and leaves out extortion, downtime, fraud and liability. Check the wording and the sublimit before relying on it.

Will cyber insurance pay a ransom?

Many policies cover an extortion payment where it is lawful and the insurer agrees in advance, along with negotiators and other experts. Paying is never automatic. The Canadian Centre for Cyber Security warns that payment does not guarantee recovery of your data, and restoring from offline backups is often faster and cheaper where they exist.

We're a small business. Are we really a target?

Yes. Statistics Canada found that 16% of Canadian businesses were impacted by a cyber security incident in 2023, and scams and fraud were the most common method. Many attacks are automated or rely on tricking staff, so size offers little protection. Smaller businesses also have less cash to absorb a week of downtime or a stolen payment.

What do insurers require before offering cyber coverage?

Most insurers ask about multi-factor authentication on email, remote access and admin accounts, offline and tested backups, endpoint protection, patching and staff training. They also ask how you verify payment changes. Missing controls can mean a decline, higher retention or tighter sublimits, and inaccurate answers can put a claim at risk.

Is cyber insurance claims-made?

Almost always. The liability parts respond to claims first made against you during the policy period, and first-party parts to incidents first discovered during it. Many policies also have a retroactive date. Keeping coverage continuous, and reporting incidents promptly, prevents gaps when you renew or change insurers.

Does cyber insurance cover fake invoice and email payment fraud?

Only if the policy includes social engineering or funds transfer fraud cover, which is usually a separate sublimit. Some forms also require that staff verified the payment change by phone. A commercial crime policy can provide similar cover, so we align the two to avoid both a gap and a dispute over which pays.

What is the waiting period in cyber business interruption?

It is the number of hours your systems must be down before income loss is covered, acting as a time deductible. Losses during the waiting period are yours. The waiting period is separate from the retention, so compare both when you look at quotes, especially if your revenue stops the moment systems go down.

How much does cyber insurance cost?

It depends mainly on revenue, industry, the data you hold, your security controls, your payment procedures and your claims history, plus the limit and retention you choose. Strong controls can widen the cover as well as lower the price. Canadian cyber rates fell 5% in the third quarter of 2026, according to Marsh.

Cyber Liability Insurance

When your systems are locked or your data is out, cyber insurance pays for the response, the recovery and the claims.

Get a quote

In short

Cyber insurance pays for the cost of responding to and recovering from a cyber incident, such as ransomware, a network intrusion or a data breach, and for the claims that follow. A full policy combines first-party cover for forensics, legal advice, data restoration, extortion and lost income with third-party cover for liability to customers, partners and regulators when your systems or data security fail.

Last reviewed October 26, 2026

Canadian insurers we compare, including cyber markets: 17; Canadian insurers we compare, including cyber markets
Canadian businesses impacted by a cyber security incident in 2023 (StatCan): 16%; Canadian businesses impacted by a cyber security incident in 2023 (StatCan)
Canadian businesses with cyber risk insurance in 2023 (StatCan): 22%; Canadian businesses with cyber risk insurance in 2023 (StatCan)
Canadian cyber rate change, Q3 2026 (Marsh): -5%; Canadian cyber rate change, Q3 2026 (Marsh)

Cyber insurance covers what a business loses when its systems or data are attacked: incident response and forensics, ransomware and extortion, restoring data, income lost while the network is down, and money stolen through payment fraud. It also defends you when customers, partners or regulators say your security failure harmed them. Breach notification duties are set out on our privacy breach page, and employee theft sits under commercial crime.

Cyber claims that go badly usually fail on detail: a social engineering sublimit far below the loss, a waiting period longer than the outage, vendors hired without consent, or an application that overstated controls. We review your controls and wording before you buy, and line cyber up with your other policies so each incident has one clear home.

What's covered

Incident response: breach counsel, forensics, notification and crisis PR
Ransomware and cyber extortion, including negotiation
Data and system restoration after an attack
Business interruption and extra expense from network downtime
Dependent business interruption for cloud and IT provider outages
Funds transfer fraud and social engineering, to a sublimit
Network security and privacy liability, including regulatory defence
Digital media liability for your website and online content

What cyber insurance covers

A cyber policy is a bundle of separate insuring agreements, each with its own limit or sublimit. Some pay your own costs (first-party). Others defend you and pay damages when someone else claims you caused their loss (third-party). The declarations page shows which parts you bought, and a policy that looks complete on the cover page can be missing one.

The main insuring agreements in a Canadian cyber policy
Insuring agreement	What it pays	Type
Incident response	Breach counsel, IT forensics, containment, notification and call-centre costs, crisis communications	First-party
Cyber extortion	Negotiation and, where lawful and agreed with the insurer, an extortion payment, plus the experts who handle it	First-party
Data and system restoration	Rebuilding or restoring software, data and systems damaged or encrypted in the attack	First-party
Business interruption	Lost profit and extra expense while your network is down after a covered event, after a waiting period	First-party
Dependent business interruption	Income lost when a cloud, software or IT provider you rely on suffers the outage	First-party
Funds transfer fraud and social engineering	Money stolen by fraudulent instructions or a compromised account, usually to a sublimit	First-party
Network security and privacy liability	Defence and damages when a customer or partner says your security failure harmed them	Third-party
Regulatory proceedings	Defence in privacy investigations and fines or penalties where the law allows them to be insured	Third-party
Media liability	Defamation or infringement in your website and digital content, usually narrow in a cyber form	Third-party

Cyber does not pay to upgrade your systems beyond what you had, replace hardware that simply wore out, or cover losses caused by a war or infrastructure failure the policy excludes. It also isn't the right home for every data problem. The legal duties that follow exposure of personal information are set out on our privacy breach coverage page, and claims about your published content belong under media liability.

Who needs cyber insurance

Any business that would stop working without its computers, email or payment systems, or that holds data other people trust it to protect. Statistics Canada found that 16% of Canadian businesses were impacted by a cyber security incident in 2023, and 30% of large businesses. Scams and fraud were the most common method, reported by half of impacted businesses, followed by identity theft at 31% and ransomware at 13%. Only 22% of businesses had cyber risk insurance.

Professional and advisory firms holding client files and trust funds, often alongside professional liability.
Clinics and health practitioners, where records are sensitive and downtime cancels appointments. See clinic insurance.
Retailers and e-commerce sellers taking card payments and running online stores.
Manufacturers and distributors whose production, shipping and invoicing run on networked systems.
IT firms, software developers and managed service providers, who also need technology E&O for client losses.
Any business paying suppliers by electronic transfer, because invoice and payment fraud needs no malware at all.

How a cyber policy works: triggers, limits and retentions

Most Canadian cyber policies are written on a claims-made basis. The third-party parts respond to claims first made against you during the policy period, and the first-party parts to incidents first discovered during it. A retroactive date may exclude events that began before it, so keep coverage continuous when you change insurers.

Aggregate limit: one limit is usually shared across every insuring agreement for the year. A large ransomware event can use most of it before a liability claim arrives.
Sublimits: social engineering, funds transfer fraud, dependent business interruption and regulatory fines are often capped well below the main limit. Read these lines first.
Retention: cyber's word for the deductible. It applies per claim, and some policies waive it if you call the insurer's breach hotline first.
Waiting period: business interruption starts only after your systems have been down for a set number of hours, which is a separate time deductible.
Panel vendors and consent: many policies require you to use, or get approval before hiring, the insurer's forensic firms and breach counsel. Costs you incur without consent may not be reimbursed.
Defence within limits: defence costs usually reduce the limit available for damages, so liability limits need to allow for legal fees.

Ransomware and the first 72 hours

The Canadian Centre for Cyber Security assesses that ransomware will almost certainly remain the most impactful cyber threat facing Canadian organizations, and its data shows Canadian ransomware incidents growing by an average of 26% a year since 2021. Its ransomware playbook warns that paying does not guarantee your data back. Attackers may leak the data anyway, demand more or come back, and payment can breach some laws.

This is where a cyber policy earns its premium. The value is less the extortion payment than the coordinated response: breach counsel to protect privilege and manage the legal clock, forensic investigators to find the entry point and confirm what was taken, negotiators, and restoration specialists. Our walkthrough of a 72-hour ransomware response shows how those pieces fit.

The same controls that limit the damage also decide whether you can buy cover. The Cyber Centre recommends multi-factor authentication on all administrative accounts and network access points, at least two backups held offline, encrypted backups and regular restore tests, monthly being one example. Our ransomware readiness checklist turns that into a to-do list.

Funds transfer fraud: where cyber and crime overlap

Payment fraud is the incident small businesses meet most often, and it sits between two policies. A cyber form may cover money lost through a compromised network or email account. A commercial crime policy covers employee theft and, by endorsement, social engineering where an employee is tricked into sending money. Each tends to carry a modest sublimit, and each has conditions that decide who pays.

Which policy typically responds to common payment-fraud scenarios
Scenario	Cyber policy	Crime policy
Hacker takes over your banking session and sends a wire	Usually responds under funds transfer fraud	May respond under computer fraud, depending on wording
Employee pays a fake invoice after a spoofed email from a 'supplier'	Responds only if social engineering is included	Responds under a social engineering endorsement, often only if the request was verified by call-back
Your email is compromised and your client pays the fraudster	May respond under liability or a specific invoice-manipulation extension	Usually not covered, as the money lost wasn't yours
Employee steals funds or diverts payments	Not covered	Core employee dishonesty cover

The practical fix is to buy both, align the sublimits and adopt the verification procedure the wording requires. Our article on employee theft and crime coverage explains the crime side, and team cyber habits covers the call-back discipline insurers ask about.

Common exclusions, and how to close the gaps

Cyber wordings vary more than almost any other commercial line, so exclusions matter more than the headline limit. These are the ones we check first.

Typical cyber exclusions and where the cover comes from
Excluded or limited	How to cover it
Bodily injury and physical property damage	Commercial general liability and commercial property; confirm neither carries a broad cyber exclusion that leaves a gap
Professional errors that aren't security failures	Technology E&O or professional liability
Employee theft of money	Commercial crime
Failure of power, internet or other infrastructure	Not usually insurable under cyber; business interruption may respond to physical causes
War and state-backed attacks	Read the war and cyber operation wording; it varies by insurer and is rarely negotiable
Betterment: upgrading systems after an attack	Not covered; budget for it or negotiate a limited betterment extension
Known incidents and unpatched, known vulnerabilities	Disclose fully on the application and patch before binding
Failing to maintain controls you declared	Keep MFA, backups and patching as described, or the claim can be challenged

Cyber vs. your package policy, CGL and privacy breach cover

Many owners assume their package policy already covers cyber. Most commercial property and CGL forms exclude or sharply limit losses arising from data and network events, and any cyber endorsement on a package is usually a small sublimit for breach costs only. Our guide to cyber insurance for small businesses compares the options.

Privacy breach coverage is often sold as part of a cyber policy, or as a smaller standalone or endorsement. It focuses on what follows exposure of personal information, including paper records and lost devices, with no hacking involved. Cyber adds the operational side: extortion, system restoration, network downtime and fraud. A business with modest data and simple systems may only need the privacy part. A business that would lose revenue during an outage needs the full program.

Canadian rules that shape a cyber claim

Most cyber claims involving personal information trigger legal duties. Under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), an organization must report a breach of security safeguards to the Privacy Commissioner of Canada, and notify affected individuals, where it reasonably believes the breach creates a real risk of significant harm. Both must happen as soon as feasible after it determines the breach occurred, and every breach must be recorded. Knowingly failing to report, notify or keep records is an offence carrying fines of up to $100,000.

Alberta and Ontario's health sector add their own regimes, and British Columbia differs again. Those rules, and the costs they generate, are covered on our privacy breach page. The Cyber Centre also asks victims to report ransomware to local police, the Canadian Anti-Fraud Centre and the Cyber Centre itself. Breach counsel funded by the policy will normally manage all of these notices.

A ransomware claim, worked through (hypothetical)

A hypothetical 40-person distributor in Ontario arrives on Monday to find its servers encrypted and a ransom note demanding payment in cryptocurrency. Its cyber policy has a $1,000,000 aggregate limit, a $10,000 retention and an eight-hour waiting period for business interruption.

1The owner calls the insurer's breach hotline. Breach counsel is appointed within hours and engages a panel forensic firm.
2Forensics finds the attackers entered through a remote-access account without MFA and copied a folder of employee payroll files before encrypting the network.
3Offline backups are intact, so the business restores rather than pays. Restoration takes six days.
4Counsel assesses the payroll exposure as a real risk of significant harm, reports to the Privacy Commissioner, notifies employees and arranges credit monitoring.
5Business interruption pays lost profit and overtime for the six days after the waiting period. Incident response, restoration and notification are paid under their own insuring agreements, all within the aggregate.

The weak point in this scenario is the application. If the business had declared MFA on all remote access, the insurer could question the claim. Accurate answers protect the policy as much as the controls do.

What cyber insurance costs

Cyber premiums are set by revenue band and industry, then adjusted heavily for controls. The questions on the application are the rating factors:

Revenue and industry: a proxy for how much data you hold and how much a day of downtime costs.
Records held: the volume and sensitivity of personal, health and payment information.
Controls: MFA on email, remote access and admin accounts; endpoint detection; offline, tested backups; patching cadence; and staff phishing training.
Payment procedures: call-back verification for new or changed banking details, which drives the social engineering terms.
Claims history and prior incidents, including ones that were never claimed.
Limits and retention chosen, and the sublimits you need for fraud and dependent business interruption.

The market is currently favourable to buyers. Marsh's Global Insurance Market Index put Canadian cyber rates down 5% in the third quarter of 2026. That is a good moment to raise limits or remove restrictive sublimits rather than just pocket the saving. Our article on hard and soft markets explains why that can change quickly.

How we place cyber insurance

Insurabiz is an independent brokerage working only in business insurance. Cyber is a line where the application answers and the wording matter more than the premium, so we spend our time there.

1Exposure review: we map the data you hold, the systems revenue depends on, and how money leaves the business.
2Controls check: we go through the insurer questions with you before you apply, so the answers are accurate and gaps are fixed first.
3Coordination: we line cyber up with your crime, CGL, property and professional liability so fraud, bodily injury and professional errors land on one policy each.
4Marketing: we take the submission to the insurers on our panel of 17 that write cyber for your industry and size.
5Comparison: we compare aggregate limits, sublimits, retentions, waiting periods, panel requirements and war wording, not just price.
6Renewal: we update the controls story each year, since improvements can lower the premium or widen the terms.

Cyber can often be placed alongside your package and liability lines with the same broker and renewal date.

If you have a cyber incident

1Call the insurer's breach hotline, or us, before anyone touches the systems. Early notice is a policy condition.
2Isolate affected devices from the network, but don't wipe or rebuild them. Forensics needs the evidence.
3Don't contact the attacker or pay anything without breach counsel and the insurer.
4Use the insurer's panel vendors or get written consent before hiring your own.
5Keep a log of decisions, costs and downtime from the first hour; it supports the business interruption claim.
6Let breach counsel decide on notices to regulators, individuals, police and the Cyber Centre.

Our claims team stays with you through the response and the settlement.

Good to know

Frequently asked questions

What does cyber insurance cover?: It covers your own costs after a cyber incident, including breach counsel, forensics, notification, ransomware response, data restoration and lost income while systems are down. It also covers claims against you when your security failure harms customers or partners, and defence in privacy regulatory proceedings. Funds transfer fraud and social engineering are often included to a sublimit.
Does my business package policy already cover cyber?: Usually not in any meaningful way. Most commercial property and general liability forms exclude or sharply limit losses from data and network events. Some packages add a small cyber endorsement, but it typically pays only limited breach costs and leaves out extortion, downtime, fraud and liability. Check the wording and the sublimit before relying on it.
Will cyber insurance pay a ransom?: Many policies cover an extortion payment where it is lawful and the insurer agrees in advance, along with negotiators and other experts. Paying is never automatic. The Canadian Centre for Cyber Security warns that payment does not guarantee recovery of your data, and restoring from offline backups is often faster and cheaper where they exist.
We're a small business. Are we really a target?: Yes. Statistics Canada found that 16% of Canadian businesses were impacted by a cyber security incident in 2023, and scams and fraud were the most common method. Many attacks are automated or rely on tricking staff, so size offers little protection. Smaller businesses also have less cash to absorb a week of downtime or a stolen payment.
What do insurers require before offering cyber coverage?: Most insurers ask about multi-factor authentication on email, remote access and admin accounts, offline and tested backups, endpoint protection, patching and staff training. They also ask how you verify payment changes. Missing controls can mean a decline, higher retention or tighter sublimits, and inaccurate answers can put a claim at risk.
Is cyber insurance claims-made?: Almost always. The liability parts respond to claims first made against you during the policy period, and first-party parts to incidents first discovered during it. Many policies also have a retroactive date. Keeping coverage continuous, and reporting incidents promptly, prevents gaps when you renew or change insurers.
Does cyber insurance cover fake invoice and email payment fraud?: Only if the policy includes social engineering or funds transfer fraud cover, which is usually a separate sublimit. Some forms also require that staff verified the payment change by phone. A commercial crime policy can provide similar cover, so we align the two to avoid both a gap and a dispute over which pays.
What is the waiting period in cyber business interruption?: It is the number of hours your systems must be down before income loss is covered, acting as a time deductible. Losses during the waiting period are yours. The waiting period is separate from the retention, so compare both when you look at quotes, especially if your revenue stops the moment systems go down.
How much does cyber insurance cost?: It depends mainly on revenue, industry, the data you hold, your security controls, your payment procedures and your claims history, plus the limit and retention you choose. Strong controls can widen the cover as well as lower the price. Canadian cyber rates fell 5% in the third quarter of 2026, according to Marsh.

Sources

Impact of cybercrime on Canadian businesses, 2023. Statistics Canada, The Daily, October 21, 2024.
National Cyber Threat Assessment 2025-2026. Canadian Centre for Cyber Security, 2024 (information as of September 20, 2024).
Ransomware playbook (ITSM.00.099). Canadian Centre for Cyber Security, January 28, 2026.
Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, ss. 10.1 to 10.3 and 28. Justice Laws Website, Government of Canada, Current to September 30, 2026.
Canada commercial insurance rates fall for third straight year (Marsh Global Insurance Market Index, Q3 2026). Insurance Business Canada, October 21, 2026.

This page is general information, not insurance or legal advice. Coverage depends on your policy wording and the insurer. Speak with a licensed broker about your situation.

Insurers we compare for cyber liability insurance

We shop these partners to find the right coverage and price for you.

Cyber Liability Insurance

Compare 17 insurers, no obligation

Get a quote

Speak with an advisor

Get your business its best insurance.

A fast, no-obligation quote from Canada's commercial insurance specialists. Real advice, the whole market compared, and someone who picks up the phone.

Get a quote Contact us