Handbook | What’s causing the cyber insurance gap?   

Only 22% of Canadian businesses carried cyber risk insurance in 2023, according to Statistics Canada’s Canadian Survey of Cyber Security and Cybercrime.

Two years later, a 2025 Cybersecurity Survey from the Canadian Internet Registration Authority (CIRA) found 42% of Canadian organizations had experienced a breach of customer or employee data in the previous 12 months – up from 29% in 2022.

The two figures come from different surveys, different samples, and different years. But they suggest far more Canadian organizations are being breached than are purchasing insurance.

One caveat about the insurance gap noted above: it could be wider.

Statistics Canada’s survey counts businesses with 10 or more employees. And so, the smallest firms in the country — which often have no IT staff, no security budget, and the least capacity to absorb losses — are not part of that survey group.

Uneven exposure

When we ask why businesses aren’t buying cyber coverage, the usual answer is price. Yet, when we spend time with small businesses, a different story emerges: they do not believe they are targets of cybercrime. The Insurance Bureau of Canada’s 2023 Cyber Security Survey found more than 60% of small businesses believe they’re too small to be of interest to criminals, and only 20% said they intended to purchase cyber insurance in the following year.

Police-reported data do not support their confidence. Statistics Canada’s cybercrime table shows the national cybercrime incident rate fell 6.5% in 2025, to 218.6 incidents per 100,000 population. Toronto moved the other way: its rate rose 11.2% to 162.4. And Hamilton saw incidents escalate 70.5%, to 242.3, the largest single-year increase of any census metropolitan area in Canada.

A measurable control

When considering cyber insurance applications, underwriters routinely ask about multi-factor authentication, endpoint detection, tested backups, and patch cadence. But these can only be verified by taking the applicant’s word for it, or by paying for an assessment.

Email authentication is the exception. Sender policy framework (SPF), DomainKeys identified mail (DKIM) and Domain-based message authentication, reporting and conformance (DMARC) records are published in the public Domain Name System (DNS). Anyone can check them in seconds, without permission and without touching the applicant’s network.

So, we did. On Aug. 1, 2026, we ran DNS checks across a random sample of 500 Greater Toronto Area business domains, of which 481 were mail-enabled. The results described are aggregate; no domain is named. Adoption looks healthy on the surface. Some 91.7% of those domains publish an SPF record, and 52.4% publish a DMARC record.

Enforcement is another matter.

Only 20.6% have DMARC set to quarantine or reject the settings that cause a spoofed message to be stopped. A further 31.8% publish DMARC using a setting that reports on abuse but does not block anything. Put another way, 60.7% of organizations that take the trouble to deploy DMARC left that function in monitor-only mode. Only 35.6% have SPF, DKIM and DMARC all in place, and 7.3% have neither SPF nor DMARC at all.

Monitor-only DMARC is a smoke detector with the battery taken out. It is generating data, but it will not stop anything.

This matters to underwriters

A business that deploys DMARC but never finishes the rollout has stopped at the point where it would have started blocking mail.

Moving DMARC from monitor-only to quarantine or reject is a step that risks breaking something, because enforcement also stops legitimate email sent on a company’s behalf by third parties it has never fully inventoried — such as payroll providers, marketing platforms, and online booking or invoicing systems. So, the record stays where it is, the application still says the company has DMARC, but nothing is actually stopped.

The same organizational behaviour leaves multi-factor authentication enabled for staff but not for service accounts, or backups running without restore-testing them. In other words, nobody has ever pulled the data back off the backup in a drill to confirm that:

• it comes back
• it comes back intact,
• it comes back within a number of hours the business requires to survive.

The DNS record is simply the part of that behaviour that’s visible from outside. It means an underwriter has a free, instant, and objective data point available before the first phone call — one that does not depend on how an applicant chooses to answer a questionnaire.

Closing the gap

The cyber insurance gap will not close by trying to sell coverage to people who do not believe they are targets. Two things would move the needle.

The first is treating the cyber policy application as a diagnostic rather than a filter. Small businesses that fail on their cyber risk controls today may be willing to change their operations. More often, they do not know what they have, let alone what is missing.

A cyber insurance application that tells the business client which control failed, and the effect of remediating that failure on the premium, turns a decline into a project.

The second is using observable data. A broker who can show an owner what that company’s own DNS says about whether its invoices can be spoofed is able to have a very different conversation than one quoting a premium against a risk the owner does not accept exists.

Survey data suggest twice as many Canadian businesses are being breached as are insured. That’s not primarily a pricing failure: It’s the distance between what the cyber insurance market asks businesses to attest to, and what those businesses are able to do.

Nauman Kahn is vice president, IT, of IT Rapid Support. This article is excerpted from one that appeared in the October 2026 print edition of Canadian Underwriter.