Cybersecurity costs in Canada, line by line for a 30–80 seat business: licences, monitoring, assessments and insurance readiness, with published 2026 ranges.
There is no single price for "cybersecurity" — there is a stack of line items, and your total depends on which you actually have. The published anchors: an endpoint licence can list for as little as CAD $4.10 per user per month, while a fully managed security layer from a Canadian provider can run CA$185 to CA$230 or more per user per month. Most 30–80 seat businesses land between those poles.
Statistics Canada's latest business survey, released in The Daily on October 21, 2026, found about 16% of Canadian businesses with 10 or more employees were impacted by a cybersecurity incident in 2025 — 15% among small businesses (10–49 employees). Among impacted businesses, scams and fraud were the most common method at 55%, ransomware had fallen to 8%, and only 11% reported the incident to police. The typical incident is no longer a movie-style hack; it is an employee tricked, or a known weakness nobody patched.
The readiness side is thin. The Canadian Small Business Cyber Risk Report 2026 (Cybersecurity Canada, October 11, 2026), built on Statistics Canada's tables, found that in 2023 only 15.4% of small businesses had a written policy to manage cyber security risks, only 17.8% patched operating systems monthly or more often, and 45.1% had no employee doing cyber security tasks in their regular role. The same report calculates small businesses spent about $15,000 per business per year on prevention and detection in 2023.
This is the software on every laptop and server watching for malicious behaviour. Basic antivirus reacts to known threats; EDR (endpoint detection and response) records what a device actually did, so an attack can be investigated and rolled back. At the licence-only end, Microsoft lists Microsoft Defender for Business at CAD $4.10 per user per month (paid yearly); it is also included in Microsoft 365 Business Premium. The licence is the cheap part — the driver is who reviews its alerts at night: your team's time, or part of a managed service.
Because scams and fraud lead Statistics Canada's method list, the inbox is where most incidents start. Costs are usually a per-user licence for advanced filtering and impersonation protection — often bundled into a higher Microsoft 365 tier — plus one-time work to configure SPF, DKIM and DMARC so your domain cannot be easily spoofed.
MFA is frequently already included in the Microsoft 365 or Google plan you pay for, so its licence cost can be zero — its real cost is the hours to enforce it on every account (including forgotten admin and service accounts) and set conditional-access rules. Insurers ask about MFA by name, which makes "we turned it on for most people" an expensive answer — see insurance below.
Backup is priced by users, servers, and data volume — and by whether restores are actually tested. A backup nobody has restored is a hope, not a control, and ransomware is the scenario it exists for. The real conversation is independence — a copy an attacker inside your tenant cannot also delete — plus retention and signed-off restore tests.
This is the widest price spread in the stack, because it is people, not software. At one end, alerts land in someone's inbox and get read during business hours. At the other, a 24/7 SOC (security operations centre) or MDR (managed detection and response) service watches, triages and acts overnight. As a published Canadian reference point, Fusion Computing's 2026 rate card prices its standalone cybersecurity layer at CA$185 to CA$230+ per user per month, with security-inclusive, CIS-aligned coverage at about CA$230 — one provider's published figures, not a national average, but a realistic marker for managed, monitored security on its own. Whether you need that level depends on your hours, contracts, and insurer — not on fear.
Assessments are normally one-time or annual projects, priced to the environment's size and complexity rather than per user. Owners skip this one most often — yet it decides whether the rest of the budget aims at real gaps or at a brochure, and produces the written, prioritized list an insurer or enterprise customer will ask to see.
Cyber insurance is a separate premium, paid to an insurer or broker — not to your IT provider. Published Canadian guidance from SecEvolution (August 20, 2026) puts small-business premiums anywhere from about $1,200 to $15,000+ CAD per year, depending on industry, revenue, the data you hold, and the controls you can prove. The readiness cost hides underneath: underwriters ask specifically about MFA, EDR, and verified backups, and a "no" can mean a higher premium or an outright decline. (What you hold also matters for privacy duties — our PIPEDA basics guide walks through them.)
Build the budget in layers. First, the floor: EDR on every endpoint, MFA on every account, configured email security, and an independent, tested backup. Second, the watch: decide honestly who sees an alert at 2 a.m. — if the answer is "nobody," either accept that risk in writing or pay for monitoring, through a managed plan or a dedicated security service. Third, the proof: an assessment and the written policies your insurer and bigger customers will request.
One last piece of honesty about our own pricing: Amen Security does not publish a rate card, and no range in this post is an Amen price. Our cybersecurity services are quoted after an assessment, because the drivers above change the work too much for an honest webpage number.
How much should a small business spend on cybersecurity in Canada?
Start from the line items, not a percentage. Licence-only floors begin at a few dollars per user per month (Microsoft lists Defender for Business at CAD $4.10); a fully managed security layer from a published Canadian provider runs CA$185–$230+ per user per month. Cybersecurity Canada's ~$15,000-per-business average (2023) is a useful cross-check.
Antivirus vs EDR — what's the difference, and is antivirus enough anymore?
Antivirus mainly blocks known threats by signature. EDR records device behaviour, so an attack can be investigated, contained, and rolled back — and it produces the evidence insurers ask for. Antivirus alone is no longer a defensible endpoint strategy for a business whose work stops when its systems stop; the real question is who watches the EDR.
What do we need to qualify for cyber insurance in 2026?
Expect questions on MFA for all accounts, EDR on endpoints, and separate, tested backups — plus incident-response basics in writing. Published Canadian ranges put premiums roughly between $1,200 and $15,000+ a year, and missing controls can raise the premium or end the application.
In-house security vs a managed security provider for a 50-person company?
One hire gives you one person's hours, skills, and holidays — and 45.1% of small businesses have nobody doing security tasks at all. A managed provider spreads a team's coverage, tooling, and overnight watch across many clients. Many land in between: an internal owner who is accountable, and a provider who operates the stack.
Cybersecurity cost stops being a mystery the moment a quote is itemized. If a proposal gives you one number and no line items, you do not have a price — you have a promise. Ask for the stack in writing: endpoints, email, identity, backup, monitoring, assessment, and the insurance evidence at the end.
If you would like that itemization for your own environment, our free assessment is a practical place to start — bring the quotes you already have, or start from a blank page with us.
Your comment will be published after our team reviews it.
