Canadian research report
The cost of cybercrime to Canadian businesses
Canadian businesses spent about $1.2 billion recovering from cyber security incidents in 2023, twice the 2021 amount reported by Statistics Canada. This research brief separates recovery, prevention, staffing, software, training, breach volume, and operational exposure so leaders can use public evidence instead of fear-based estimates.
Incident recovery spending reported for 2023
Prevention and detection spending
Businesses providing formal non-IT cyber training
What the national figures actually measure
Statistics Canada surveys enterprises with Canadian operations and at least 10 employees across most economic sectors. Its figures distinguish spending to prevent or detect incidents from money spent recovering after an incident. That distinction matters: security investment is planned, while recovery spending is usually forced by disruption.
The 2023 release reported approximately $3.8 billion in employee salary costs related to prevention or detection, $2.9 billion in security software costs, and $1.9 billion for consultants or contractors. These categories should not be added to a small-business budget without adjusting for company size, technology footprint, regulation, and internal staffing.
A budgeting framework businesses can reuse
Separate the budget into identity, endpoint and email protection, backup and recovery, monitoring, awareness, incident readiness, vendor assurance, and technical labour. Record the owner, annual cost, evidence produced, and risk reduced for each line. This makes the plan reviewable instead of turning security into an unexplained software total.
Recovery exposure should be modelled separately using downtime, lost transactions, emergency labour, legal and privacy response, restoration, customer communication, and replacement hardware. The result is a range, not a promise about what an incident will cost.
How to use this report
Use the public figures as a national context, then calculate an organization-specific scenario. Do not divide national totals by the number of Canadian businesses. That shortcut ignores industry, company size, systems, incident severity, insurance, and reporting differences.
Review the model quarterly and after acquisitions, major cloud changes, new locations, insurance renewal, or a material incident. Date every source because official totals and reporting definitions change.
Primary sources
This page separates sourced facts from North Star's operational guidance. Check the current source before relying on a changing price, rule, list, or technical standard.
Questions businesses ask
Did Canadian recovery spending really double?
Statistics Canada reported that total recovery spending increased from about $600 million in 2021 to $1.2 billion in 2023.
Is this a prediction of one company's loss?
No. National totals provide context. Company exposure must be estimated from its systems, downtime, data, contractual duties, and recovery capability.
What is the first useful budgeting step?
Inventory critical systems and identities, define recovery objectives, and map existing controls and owners before selecting more products.
Turn the research into an operating plan
North Star can help assess the environment, define scope, document ownership, implement controls, and verify the result.
Review cybersecurity services