Small Business Cybersecurity Budget: What to Fund First

November is budget season. The managing partner of a 25-person architecture firm in Montréal’s Mile End has three documents on her desk. A product list from her IT provider. The insurer’s renewal questionnaire, which now requires multi-factor authentication. And an email from a large client asking about her “cybersecurity measures.”

Her question is simple: “What’s a reasonable amount to spend on this?”

You will find percentage-of-IT-budget rules online. They rest on very different methods and company profiles, and they say nothing about your own risks. We suggest a method instead: start from your risks, then fund in tiers.

Start from risk, not a percentage

The risk is real for Canadian small businesses. According to a 2025 Coalition study, 86% of small Canadian businesses had experienced a cybersecurity event in the last five years, yet 77% believed they were too small to be targeted. In Québec, a KPMG survey published in October 2023 found that more than six in ten SMEs had been hit by a cyberattack in the previous year, and 65% lacked qualified staff to manage the risk.

The cost of an incident gives you a first order of magnitude. Here are the average costs for Canadian SMEs, according to industry data cited by Insurance Business Canada (October 2025):

Before you pick a single product, answer three questions with your leadership team:

1. Which system outage would cripple the business within a week?
2. Which data would do the most damage if it leaked: client records, employee files, project plans?
3. What do your insurers, your clients and the law already require?

The answers set your priorities. A clinic protects patient records first; a manufacturer protects production.

Tier 0: turn on what you already pay for

The first tier costs mostly time. Many small businesses pay for Microsoft 365 or Google Workspace licences whose security features sit unused.

• Turn on multi-factor authentication for every account, starting with administrators.
• Set up SPF, DKIM and DMARC to make it harder to spoof your domain.
• Enable automatic updates for workstations, browsers and software.
• Remove administrator rights from everyday accounts.
• Disable former employees’ accounts and unused access.

The Canadian Centre for Cyber Security publishes its baseline controls for small and medium organizations for free. They are designed around the 80/20 rule: get 80% of the benefit with 20% of the effort. It is an excellent starting list for this tier.

Tier 1: the recurring essentials

This tier becomes a fixed budget line, often billed per user per month.

• A business password manager, to put an end to reused passwords.
• Endpoint detection and response (EDR), which flags suspicious behaviour, not just known viruses.
• Backups following the 3-2-1-1-0 rule, including for Microsoft 365 or Google Workspace, with an offline or immutable copy.
• Email filtering against phishing and malicious attachments.
• Staff training, short and repeated, rather than one annual presentation.

Ask your IT provider what is already included in your licences before buying a separate tool. Sometimes a licence upgrade costs less than two separate products. And count your users carefully: contractors, shared mailboxes and seasonal staff are often forgotten in the estimate, then show up on the invoice.

Tier 2: verify that it holds

Buying tools does not prove they are configured properly. This tier is made of one-time expenses, planned across the year.

• A cybersecurity audit every year or two, to measure the gap between what is planned and what is actually in place.
• A penetration test when you expose services to the internet or a client asks for one. Canadian vendors publish very wide ranges, from a few thousand to several tens of thousands of dollars depending on scope (for example, Packetlabs, August 2026); a small external test sits at the low end. Our article on penetration testing costs explains what drives the price. Every test requires the business’s written authorization (Criminal Code, s. 342.1).
• A phishing simulation, to measure whether the training is working.

Schedule these ahead of your insurance renewal or a major client review, so the results are in hand when the questions arrive.

Tier 3: govern and prepare

The last tier keeps you on course and helps you react fast on the day everything else fails.

• A written incident response plan, with the numbers to call, tested once a year.
• Cyber insurance that fits your activities. Read the exclusions and the notice conditions.
• Governance support, such as a part-time vCISO, to track the plan, handle client security questionnaires and report to leadership. Our ongoing security partner service is built for this. To compare options, see MSP vs MSSP vs vCISO vs in-house.

In summary:

What can usually wait? Tools that nobody has time to watch. A log platform that generates alerts no one reads, or a formal certification pursued before multi-factor authentication is even turned on, consumes budget without lowering risk much. The same goes for overlapping products: two antivirus tools or three backup services usually mean gaps in configuration, not extra protection. Fund the lower tiers first, then climb.

Presenting the budget to leadership

Leadership approves a budget tied to a business risk far more easily than a product list.

• Name your top three risks in business terms: production shutdown, client data leak, wire fraud
• Tie each expense to a risk and a tier
• Compare the total with the cost of a realistic incident, plus the days of downtime
• Show what your insurers and clients already require
• Lay out a 12-month calendar with a quarterly check-in
• Pick two or three simple indicators: MFA coverage, tested backups, patches up to date

Time is a cost too. According to a CDW study published in 2025, small Canadian organizations took an average of 6.8 days to detect an incident and 25.7 days to recover. Nearly a month of disruption is an argument every leadership team understands.

If you want a prioritized, costed list for your own business, a detailed quote is the simplest place to start.