Statistics Canada reported that 16% of Canadian businesses were impacted by cybersecurity incidents in 2023, compared with 18% in 2021 and 21% in 2019. That decline should not be read as permission to reduce readiness — this remains the most recently published cycle of this survey; a 2025 cycle has been fielded, with results not yet released.
Among affected businesses, scams and fraud remained the most commonly reported method. Identity theft affected 31% of impacted businesses, and 13% reported ransomware attacks. Total recovery spending doubled from approximately $600 million in 2021 to $1.2 billion in 2023.
What the numbers mean for an SMB
The practical issue is concentration. A small business may depend on one email tenant, one accounting platform, a few administrators and a small number of critical vendors. A single identity compromise can therefore affect communication, payments, customer trust and operations at the same time.
The most useful priorities remain disciplined fundamentals:
- Enforce MFA on email, remote access, administrators and critical cloud systems.
- Remove unsupported systems and apply security updates.
- Protect business email through account controls, SPF, DKIM, DMARC and payment verification.
- Maintain protected backups and test restoration.
- Limit privileged access and remove departed users promptly.
- Know which vendors can reach critical systems or information.
- Prepare a usable incident-response plan and external contact list.
The governance gap
Statistics Canada found that only 26% of businesses had written cybersecurity policies in 2023, while 22% had cyber-risk insurance. A policy document is not a control by itself, but the absence of written ownership and response expectations can slow decisions when an incident occurs.
Leadership should know who owns cybersecurity risk, which systems are essential, which gaps have been accepted, what evidence exists and when the next review will occur.
AI increases both opportunity and exposure
AI can improve analysis, communication and automation, but it can also increase convincing phishing, uncontrolled data disclosure and automated operational errors. Businesses need clear approved-use rules, human review for consequential actions and stricter controls when AI connects to live systems.
A useful 2026 objective
Do not try to implement every control at once. Establish a credible baseline, rank gaps by business impact and complete a small number of measurable improvements each quarter.