Digital Insights
The changing landscape of cyber security following the COVID-19 pandemic

Societal changes accelerated by the COVID-19 pandemic have had an unprecedented impact on the operations of Canadian businesses, motivating many to change their business models and begin using the Internet and other technologies in new ways. According to the Survey of Digital Technology and Internet Use, a third (33%) of Canadian businesses received orders or made sales of goods and services over the Internet in 2021, up from 25% before the pandemic in 2019. More businesses also reported offering employees the option to telework in 2021 compared with 2019 (+14 percentage points).^Note

While a growing online presence has created new opportunities for many businesses, it has also exposed them to new risks regarding privacy, data protection and cyber security. Many of the types of crime in the news in 2021, including cybercrime, fraud and counterfeiting, were not new, but rather existing types of crime taking advantage of technological developments to improve on techniques.^Note This article examines how Canadian businesses are adapting to cyber security threats in the aftermath of the pandemic by leveraging data from the Canadian Survey of Cyber Security and Cybercrime (CSCSC).^Note   

Canadian businesses are taking more cyber precautions

In 2021, 26% of Canadian businesses had written policies in place related to cyber security, an increase of at least four percentage points since 2019.^Note This demonstrates that businesses are becoming increasingly aware of the threat posed by cyber security incidents.

Businesses also demonstrated growing cyber-awareness in other ways; for example, the proportion of businesses conducting activities to identify cyber security risks on a scheduled basis increased by five percentage points to 39% in 2021. Data from the Canadian Survey on Business Conditions for the second quarter of 2022 also showed that one fifth (21%) of Canadian establishments plan to take new or additional cyber security actions over the next twelve months.^Note

Canadian businesses are spending more on cyber security prevention and detection

The apparent increase in cyber security awareness among Canadian businesses was also reflected in their cyber security spending. In 2021, the average spending on prevention and detection of cyber security incidents was $52,000, a substantial 46% increase from 2019 which far outpaced the inflation rate over the same period (+4%).^Note In 2021, large businesses spent about $340,000 more on prevention and detection of cyber security incidents than they did in 2019, whereas small businesses spent about $9,000 more. However, the increase in cyber security awareness may not be occurring evenly throughout the economy; four in ten businesses still did not report any direct expenditures on cyber security in 2021, a figure that has not changed since 2019.

Data table for Chart 1



Data table for chart 1
Table summary
This table displays the results of Data table for chart 1. The information is grouped by Business size (appearing as row headers), 2021 and 2019, calculated using average spending (dollars) units of measure (appearing as column headers).

Business size	2021	2019
	average spending (dollars)
Large businesses	1,008,000	667,000
Medium businesses	83,000	68,000
Small businesses	19,000	10,000
Source: Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2019 and 2021.

Part of the motivation of some businesses to invest more in cyber defenses and policies may be the parallel awareness among consumers of the potential risks of sharing their personal information when shopping online. The 2020 Canadian Internet Use Survey found that one-quarter (25%) of Canadian individuals were very or extremely concerned about cyber security or privacy threats when using online shopping sites or applications.^Note Similarly, in the CSCSC 2021, protecting personal information was the most common reason businesses gave for spending time or money on cyber security, with two-thirds (66%) selecting that response.

Despite businesses demonstrating growing cyber-awareness in some areas of their operations, the trend was not universal; the proportion of businesses that had dedicated cyber security employees remained largely unchanged from 2019 (60%) to 2021 (61%), and only slightly more businesses provided formal training to develop or upgrade the cyber security skills of their non-information technology employees in 2021 (+3 percentage points). Human error has long been known as a major source of cyber security incidents, so increasing the cyber security knowledge of all employees can play an important role in improving organizational cyber resilience.^Note

Fewer Canadian businesses were impacted by cyber security incidents in 2021 but the reported costs of incidents were higher

Slightly fewer Canadian businesses (18%) reported being impacted by a cyber security incident in 2021 than in 2019 (21%). This differed from the trend observed for Canadian individuals in the 2020 Canadian Internet Use Survey, where the percentage of individuals impacted by cyber security incidents increased by six percentage points to 58% from 2018 to 2020.^Note These trends may reflect a change in the strategies of cyber criminals, but could also be the result of businesses having more tools at their disposal to identify and intercept malicious cyber activities when compared with individuals.

Although the previous sections presented evidence that businesses are becoming more cyber-aware, those that were impacted by cyber security incidents in 2021 faced worse financial consequences when compared with 2019. On average in 2021, businesses paid $19,000 to recover from cyber security incidents, $8,000 more than 2019 ($11,000). This increase was largely driven by a substantial rise in costs incurred by large businesses from 2019 ($73,000) to 2021 ($172,000).

Businesses that had written policies in place related cyber security were also found to be more likely to be impacted by cyber security incidents (25%) than those without policies (16%) in 2021. This finding could be the result of cyber-aware businesses being better positioned to notice cyber security incidents compared with those that don’t have monitoring procedures in place. Businesses that are more frequently targeted by cyber security incidents may also be more likely to adopt written policies related cyber security. Additionally, although businesses with written policies were impacted by cyber security incidents at a higher rate than those without, there were still more businesses without written policies impacted by incidents (22,000) than ones with written policies (12,000) in 2021. This was due, in part, to the fact that 74% of businesses did not have written policies in place.

Among businesses impacted by cyber security incidents, identity theft had the largest increase in 2021 compared with 2019 (up six percentage points to 20%). Conversely, the proportions of businesses reporting being impacted by hacking or password cracking (-3 percentage points) and exploiting software, hardware, or network vulnerabilities (-3 percentage points) decreased in 2021. Measured for the first time in 2021 as its own category, 11% of Canadian businesses that were impacted by a cyber security incident reported being impacted by ransomware.^Note

Data table for Chart 2



Data table for chart 2
Table summary
This table displays the results of Data table for chart 2. The information is grouped by Methods (appearing as row headers), 2021 and 2019, calculated using percentage of businesses impacted by cyber security incidents units of measure (appearing as column headers).

Methods	2021	2019
	percentage of businesses impacted by cyber security incidents
Scams and fraud	44	41
Hacking or password cracking	23	26
Malicious software (excluding ransomware)	21	Note ..: not available for a specific reference period
Identity theft	20	14
Exploiting software, hardware, or network vulnerabilities	19	22
Ransomware	11	Note ..: not available for a specific reference period
.. not available for a specific reference period Source: Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2019 and 2021.

Start of text box

Digital economy and society statistics portal

Visit the Digital economy and society statistics portal to find data, publications, and interactive tools related to the digital economy and society in one convenient location.

End of text box

Methodology

Data in this article are from the Canadian Survey of Cyber Security and Cybercrime (CSCSC), unless otherwise indicated.

Data for the 2021 iteration of the CSCSC were collected from January to March, 2022. The target population of this survey was derived from Statistics Canada's Business Register (BR). The BR is an information database on the Canadian business population and serves as a frame for all Statistics Canada business surveys. It is a structured list of businesses engaged in the production of goods and services in Canada. This survey covers enterprises operating in Canada in almost all industrial sectors. Businesses with less than 10 employees were excluded from the sample. The final sample size was 12,158 enterprises and the response rate was 65%.

To create the sample for this survey, enterprises were stratified by industry and size categories. The size category is based on the number of employees of the enterprise. Three size categories were built: small (10-49 employees), medium (50-249 employees) and large (250 or more employees).

Percentages published in this article represent a percentage of businesses, unless otherwise indicated. Survey weights were used in all calculations to ensure the results were reflective of the target population. Percentage point changes from the CSCSC are only given for proportions with a quality of “A” (standard error up to 2.5%).

Acknowledgments

The CSCSC is conducted on behalf of Public Safety Canada. The authors would like to thank colleagues from Public Safety Canada for their advice and comments on an earlier version of this paper.

External references

European Commission (2021). Guide to statistics in European Commission development cooperation, Volume 2: Social statistics . Retrieved March 16, 2023.

World Economic Forum (2022). The Global Risks Report 2022, 17th Edition, Insight Report . Retrieved March 16, 2023.