Small Businesses Underestimate Cyber Risks Despite Increased Threats: IBC Survey

Most small businesses don’t believe they will experience a cyber attack, yet many employees are concerned they are putting their organizations at risk, according to a recent poll by Insurance Bureau of Canada (IBC).

IBC’s 2023 Cyber Security Survey found that more than 60% of small businesses believe their business is too small to be targeted by cyber criminals. This number rises to 73% for sole proprietors.

While the majority of business owners surveyed were not concerned about their staff posing a cyber risk, three out of four employees surveyed admit to having taken at least one action that poses a cyber security risk, the poll found.

The poll also showed growing employee concerns with cyber safety, including:

• 25% of employees don’t feel they have the tools and training needed to identify potential cyber threats at work,
• 22% of employees are concerned their actions could contribute to a cyber attack or data breach,
• 10% of employees have shared confidential information with a publicly available chatbot or artificial intelligence (AI) platform.

“While large companies are often common targets for cyber criminals, small and medium-sized businesses are also at a heightened risk,” said Liam McGuinty, vice president of Strategy at IBC. “Both employers and staff play an important role in cyber security, and regular staff training is a critical component in reducing risk.”

Despite nearly 40% of small business employees indicating that they had seen an increase in scam attempts over the last 12 months, employer responses showed that they may not be making enough investments in cyber protection:

• 69% do not consider cyber security a financial priority,
• Only 20% have any intention of purchasing cyber insurance within the next year,
• 17% don’t think they would qualify for cyber insurance.

“All businesses, but especially those that rely heavily on an online presence and use e-commerce, should consider contacting their insurance representative to help find ways to manage their cyber risk,” added McGuinty. “However, cyber insurance is just one component of an overall cyber risk mitigation strategy – it is not a replacement for cyber resilience.”

Cyber Savvy Assessment Launched

As part of Cyber Security Awareness Month, IBC is launching a self-assessment tool to help business owners understand the steps most cyber insurers want businesses to take to reduce their cyber risk.

While this free tool cannot provide an assessment of a business’s actual risk profile, its questions can help business owners gauge their level of readiness for cyber insurance and help determine which areas they may need to focus on to bolster their cyber resilience.

The Cyber Savvy Assessment is available until Oct. 31, 2023 at cybersavvycanada.ca, along with resources and information about the proactive measures businesses can take to help reduce their cyber risk.

Survey Methodology

Findings are from a survey conducted by Insurance Bureau of Canada from Aug. 3-9, 2023 among 305 Canadian business owners and decision makers who work at companies with up to 500 employees. All respondents were members of the online Angus Reid Forum. Interviews were conducted in English and French. For comparison purposes only, a sample of this size would yield a margin of error of +/- 5.6 percentage points, 19 times out of 20.

In addition, the IBC surveyed from Aug. 3-9, 2023 1,506 employed Canadians aged 18-plus who work at organizations with 2 to 499 employees and work primarily on a computer or other digital devices. All respondents were members of the online Angus Reid Forum and interviews were conducted in English and French. For comparison purposes only, a sample of this size would yield a margin of error of +/-2.5 percentage points, 19 times out of 20.

Source: Insurance Bureau of Canada

Topics Trends Cyber Commercial Lines Business Insurance