92% of Canadian companies say they’re confident in their cybersecurity posture. Yet only 38% have tested their business continuity plan in the past year. Confidence, it turns out, is not the same as resilience.
That’s not a rhetorical setup — it’s what the data actually shows. NOVIPRO’s IT Trends 2026 report surveyed Canadian business leaders on cybersecurity readiness, and the confidence numbers are genuinely striking: 92% of organizations report they feel secure, and 40% describe themselves as very confident. Those are overwhelming majorities. Then you look at what’s underneath them.
Seventy-seven percent of Canadian companies have a business continuity plan (NOVIPRO, pp.27–30). Of those, only 38% have tested it in the last year. Thirteen percent have never tested it at all. An untested piece of paper that your employees don’t know how to operationalize has not enhanced your resilience — it has given you the feeling of resilience without the substance of it.
Why Canadian businesses consistently overestimate their security
The gap between perceived security and actual preparedness shows up in several places in the NOVIPRO data, and the pattern is consistent: organizations are better at acquiring tools than at maintaining and testing the systems built around them.
Cyber insurance is a good example. Adoption surged from 27% of Canadian companies in 2025 to 60% in 2026 (NOVIPRO, p.27) — a genuinely meaningful shift. But only 20% of those policies cover both customer and employee data. And insurance, by definition, activates after an attack. It absorbs financial shock; it does not prevent operational disruption, regulatory scrutiny, or the loss of client trust that follows a breach.
The training numbers tell the same story (NOVIPRO, p.28). Sixty-seven percent of companies have offered cybersecurity training — but that figure still hasn’t returned to the 74% seen in 2019, even as the threats have become more sophisticated. And there’s a quieter problem inside that number: IT decision-makers are far more likely to report that training has taken place than non-IT leaders — 76% versus 43%. When training happens, it’s not consistently reaching every department that handles data, clicks on links, or has access to business systems. Employees are one of the most common entry points for attacks. Partial training is partial protection.
There’s also a structural gap between IT and leadership that shapes how these decisions get made. IT leaders report 95% confidence in their company’s security posture; non-IT leaders report 86%. On having a business continuity plan: IT leaders say 84%, non-IT leaders say 63%. The people making budget decisions and setting company strategy are working from an incomplete picture — not through any fault of their own, but because the visibility between IT and the executive level hasn’t been built to give everyone an accurate view. That misalignment means investment in security gets underfunded, training gets deprioritized, and continuity plans go untested — not out of negligence, but because the urgency isn’t legible to the people who need to act on it.
What traditional security tools miss in 2026
Most small and mid-size businesses in Canada are working from a security model that was built for a different threat landscape. Antivirus, a firewall, and a password policy cover real risks — but they’re foundational controls designed primarily for known threats delivered in predictable ways.
The Canadian Centre for Cybersecurity’s National Cyber Threat Assessment 2025–2026 warns that the threat environment has shifted significantly: attacks are more automated, more targeted, and increasingly enhanced by AI tools that allow attackers to operate at a pace and scale that wasn’t previously possible. The NOVIPRO report is specific about the consequence: basic tools alone are no longer sufficient against persistent, automated, and AI-driven attacks.
What this means in practice is that security postures built around detection of known malware may not catch newer attack vectors — phishing campaigns generated by AI that are indistinguishable in tone and style from legitimate correspondence, or credential stuffing attacks that systematically test your systems using breached passwords from unrelated services. These aren’t exotic threat scenarios. They’re common, and they don’t require a sophisticated attacker to execute.
A firewall doesn’t help when the entry point is a staff member who clicked something that looked exactly like a message from your bank.
The “we’re too small to be targeted” myth
This is the one I hear most often, and it’s worth addressing directly: the belief that small businesses aren’t worth attacking.
Attackers don’t sort by company size. Many modern attacks are automated — they scan for vulnerabilities across large numbers of systems and exploit what they find, regardless of whether the target is a five-person firm or a regional manufacturer with 200 employees. Small businesses are significantly less prepared than large enterprises, but no less likely to be targeted — and considerably less able to absorb the impact of a breach, whether in the form of downtime, customer loss, or recovery costs.
Small organizations are, in some ways, a more attractive target than they might assume: less security infrastructure, less trained staff, and a higher likelihood that foundational controls — multi-factor authentication, regular backups, access management — haven’t been consistently implemented. The assumption of safety is part of what makes the risk real.
What a real breach costs a Canadian organization
IBM’s Cost of a Data Breach Report 2026 puts the average cost of a Canadian data breach at $7.11 million — up from $6.98 million in 2025. The average time to detect and contain a breach: 205 days.
That is nearly seven months of operational disruption, legal exposure, regulatory scrutiny, and reputational damage before the incident is even contained. For a large enterprise, that’s significant but survivable. For a mid-size or growing business, the combination of financial cost, lost clients, and regulatory penalties can be existential.
The math for small businesses is even less forgiving. Less ability to absorb the cost, less internal capacity to manage the response, and less reputational runway if clients or partners lose confidence. Treating a potential breach as an IT nuisance rather than a business continuity event is a misjudgement of the actual risk.
Three things to check this week that cost nothing
None of these require a security vendor, a consultant, or a budget conversation. They take an afternoon and will tell you something concrete about where you actually stand.
1. Check your company email addresses on Have I Been Pwned. This free tool tells you whether any of your business email addresses appear in known data breaches — which means credentials from your organization may already be circulating. If you find hits, the immediate priority is ensuring those passwords have been changed and those accounts are protected by multi-factor authentication.
2. Review the third-party apps connected to your Google Workspace or Microsoft 365 account. Most organizations have far more connections than they realize — tools that were integrated once for a specific project and never disconnected, apps that staff members authorized without a formal review process, integrations that may no longer be maintained by the vendor. Every connected application is a potential entry point. Reviewing this list and revoking anything unfamiliar or unused takes less than an hour. (If you’ve added AI tools to your stack, those connections deserve particular scrutiny.)
3. Confirm that multi-factor authentication is enabled across your entire organization — not just for some people, not just for the executive team, but for every account that has access to business systems. MFA is one of the most effective controls available, and it costs nothing to implement for most Microsoft 365 and Google Workspace plans. If it isn’t on across the board, that’s the first fix.
None of these replaces a proper security assessment. But all three will give you an honest picture of where you stand — which is a better starting point than confidence built on assumption.
If you want a more complete look — a structured assessment of where your security posture holds up and where an attacker would find the gaps — book a 30-minute coffee meeting and we’ll start there.