Awareness · 3 min read
Your Best Defence Is You: A Simple Cyber Checklist for Canadian Businesses
This year's Cyber Security Awareness Month theme says it well: your best defence is you. Here is where to start.
People are the front line
October is Cyber Security Awareness Month in Canada. This year's theme, from the federal Get Cyber Safe campaign, is "Your best defence is you." It is good news for a business owner, because it means much of what keeps you safe is already in your hands.
Most cyber incidents do not begin with someone breaking through a firewall. They begin with a person being asked to click a link, enter a login, or move some money. If people are the way in, people are also the way to stop most of it. A few simple habits go a long way.
The numbers put this in context. CIRA found that around four in ten Canadian organizations were hit by a cyber attack in the past year, and small businesses are very much in that group. Research from BDC puts it higher still, with 73 percent of Canadian small businesses reporting a cyber incident of some kind. The point is not to worry you. It is that this is ordinary now, and ordinary risks are the ones worth building simple habits around.
Five things worth doing this month
- Turn on multi-factor authentication. Email first, then banking and anything else that matters. It is the best return on ten minutes you will find anywhere.
- Use a password manager. One strong, unique password for every account, and you do not have to remember any of them.
- Verify before you pay. If a supplier's banking details change, or an email asks you to send a payment, pick up the phone and confirm. A faked invoice or a spoofed request that redirects a wire is one of the costliest things that can happen to a small business.
- Test your backups. Running is not the same as restoring, so confirm yours actually brings your files back. A backup nobody has tested is a guess.
- Know who you would call. Write down the first call you would make if something went sideways, while things are calm rather than during an incident.
None of this needs an IT department. That is the whole idea behind this year's theme. The Government of Canada's Get Cyber Safe campaign has free, plain-language resources on each of these.
Where insurance fits
Good habits prevent a great deal. They do not prevent everything, and that is what cyber insurance is for. It is the backstop for the incident that still gets through, the one that takes your systems offline for a week or puts a privacy obligation on your desk. The aim is simple: do the basics well, and carry coverage that responds when the basics are not enough.
Cyber coverage reads differently from one policy to the next. What is included, what sits as an add-on, and where the limits land can vary quite a bit. October is as good a time as any to read yours, or to have someone walk you through it in plain terms.
Frequently asked questions
What is Cyber Security Awareness Month?
It is a national campaign held every October, led by the Government of Canada's Get Cyber Safe program, to help people and businesses build simple habits that reduce cyber risk. The 2026 theme is "Your best defence is you."
What are the most important cyber habits for a small business?
Turn on multi-factor authentication, use a password manager, verify payment changes by phone, test your backups, and know who you would call if something goes wrong. None of them require an IT department.
Does cyber insurance replace good security habits?
No. Good habits prevent most incidents. Cyber insurance is the backstop for the ones that still get through, covering costs like recovery, downtime, and breach response.
Not sure where your coverage stands?
Run the free Coverage Assessment, or book a no-pressure review and I'll read your actual policy and tell you exactly where the gaps are.
By J.R. Genua, CCIS, Certified Cyber Insurance Specialist and Registered Insurance Broker. Insurance services provided by St. Andrews Insurance Brokers Ltd.