The state of cyber insurance in Canada

Cyberattackers in Canada are getting more sophisticated. They’re exploiting people and trusted business relationships as much as the technology itself. 

“Cyber is no longer an IT issue. It has become an operational and business resilience issue affecting organizations of every size and industry,” says Leanne Taylor, Senior Manager, Tech & Cyber, at Sovereign Insurance. 

Understanding how these threats are evolving can help brokers spot where clients remain vulnerable and connect coverage to broader cyber preparedness. 
 
Trust under attack 

While ransomware and business email compromise (BEC) remain significant concerns, two developments are emerging as top threats facing Canadian businesses: AI-enabled social engineering and a growing cybercrime-as-a-service economy. 

“AI is making existing attacks faster, cheaper, more scalable, and harder to detect,” says Taylor. 

AI now enables criminals to produce personalized, polished phishing messages within seconds, she adds, meaning typos and awkward phrasing are no longer reliable warning signs. Voice cloning and synthetic video can make a request look as if it’s from a trusted executive. 

“AI is also automating reconnaissance for ransomware groups, while cybercrime-as-a-service puts ready-made tools, phishing kits, and access credentials within reach of less-skilled attackers,” she says.  

Canadian organizations’ heavy reliance on cloud providers, managed service providers, and other vendors also means a single weak link can give attackers a trusted way in. 

“AI is pushing security leaders past questioning whether they have the right technology toward considering who and what they can trust,” says Taylor.  

With the old warning signs gone, verification procedures, multifactor authentication, staff training, and incident response capabilities have become essential. 
 
Disruption drives losses 

The most common cyber losses Sovereign sees continue to involve ransomware, business interruption, social engineering, and privacy breaches. 

“Cyber resilience is no longer about preventing every attack. It’s about minimizing the disruption that follows and recovering quickly,” she says. 

The most severe losses are usually driven by the operational disruption that follows an attack: lost revenue, interrupted service, reputational damage, forensics costs, legal expenses, and regulatory obligations. 

Social engineering and BEC are especially costly because they target human behaviour. “A convincing payment request or compromised vendor account can produce a major loss even at organizations with strong technical controls,” says Taylor. 

Claims frequently expose the same gaps: limited employee awareness, weak incident response planning, overreliance on third parties, and holes in identity and access management.
 
“There’s a long-standing idea that cyber risk affects only certain industries,” she says. “But if you’re connected to the internet, you’re exposed.” 

Exposure still differs by sector, she explains. Manufacturers face production and supply chain disruption. Healthcare organizations hold sensitive patient data alongside essential services that can’t go down. Municipalities often run on legacy technology, making them attractive ransomware targets. Professional service firms hold valuable client information that draws BEC and data theft. Retailers face exposure through payment systems and customer data as e-commerce grows. And construction firms depend on connected project platforms and a web of suppliers and contractors. 

“The type of cyber event may differ between sectors, but the potential for operational disruption is universal,” says Taylor. 
 
A maturing market 

The Canadian cyber insurance market has matured considerably following earlier periods of rapid growth, significant ransomware losses, and tighter underwriting conditions. Today’s market is more stable, Taylor says, built on stronger underwriting, improved risk selection, enhanced cyber controls, and greater client awareness. 
Due to rising regulatory expectations, boards increasingly recognize that a cyber incident can trigger regulatory, legal, financial, and reputational consequences, complicated by privacy and breach rules beyond Canada’s borders.  
“That’s pushing cybersecurity into board-level conversations and changing how clients buy insurance,” says Taylor.

“They want to know what their policies cover and whether they match their risk profiles, and they’re pressing insurers on how incident response works when a claim comes in.” 

Insurers are also placing more emphasis on cyber hygiene and security controls, and organizations with stronger governance are generally better positioned for favourable terms. 

This creates an opportunity for brokers to move beyond policy placement, toward helping clients examine identity controls, employee awareness, incident response planning, vendor dependencies, business interruption exposures, and potential policy gaps. 

“Cyber insurance is no longer a stand-alone solution. It’s one piece of the overall puzzle,” says Taylor. “The most effective brokers are helping clients bridge the gap between cybersecurity and insurance. They’re translating technical risks into business impacts and helping organizations make informed decisions that strengthen resilience.” 

Her advice for brokers is to lean into that education. Insurers are generally willing to share materials and expertise, and brokers who use them are better equipped to guide clients through a claim or toward the coverage that fits the risk. Doing that consistently is what will make a broker a trusted cyber risk advisor.