Build your cyber security community: Who will you call when something goes wrong

This article was written by Cam Baker, Westland Insurance's Director of Small Business Solutions.

This is the last themed week of Cyber Security Awareness Month in Canada. Get Cyber Safe calls it "Build your cyber security community." The idea is simple: keep your good habits going after October, share what you've learned, and help the people around you become a stronger first line of defense. The national theme is "Your best defense is you," and this week it stretches to include everyone you work with.

Here's the part most business owners don't think about until it's too late. Nobody handles a cyber incident alone, and the middle of one is a bad time to figure out who's on your team.

Who's on your bench?

Picture the first hour after your systems go down or you find out customer information is out. Most owners can name one or two people they'd call. Very few can name all of them, and fewer still have the numbers somewhere they can reach without logging in to the systems that just stopped working.

Your first-hour list should include:

• The person inside your business who makes the decisions, plus a backup for when they're away.
• Your IT provider, including an after-hours number.
• A lawyer who knows privacy and breach notification law.
• Your insurance broker and your insurer's claims line.
• Your bank, in case a payment needs to be stopped or recalled.
• Someone who can speak to your customers and staff.

The Canadian Centre for Cyber Security recommends a backup contact for every person on your response team, plus a way to reach each other that doesn't depend on your company email.

What professional help looks like

If you have cyber insurance, a big part of the bench comes with the policy. When a serious incident is reported, the response team usually includes:

• A breach coach. A law firm that runs the investigation and protects legal privilege over what's found.
• Forensic specialists. They contain the attack, work out how it happened, and find out what was touched.
• A negotiator, if there's a ransom or extortion demand.
• Crisis communications support, for what to tell customers, staff, and the media.
• Restoration specialists, who get your systems and operations running again.

I've watched this play out on a ransomware file this year. I won't share details, but what stood out was the rhythm. The business owner, the breach coach, and the response team met on a regular call to work through containment, restoration, and what came next. Someone was always steering, and the owner wasn't figuring it out alone.

Some help shows up before anything breaks. A distribution company in Manitoba had a cyber policy with an insurer that runs its own threat monitoring. One of the insurer's analysts spotted a hacker in an online chat bragging about the companies he'd just broken into. The Manitoba company was on the list. The insurer alerted them through its app and walked them through clearing the threat before any ransomware was launched. No downtime, no data lost, no ransom paid.

Know who to call first

Every cyber policy handles that first call a little differently, and the difference matters more than people expect. Some give you free access to the insurer's own response team, any time. Others route you to an outside hotline that bills by the hour, and on some wordings, calling that hotline doesn't count as reporting a claim to your insurer.

Policies also differ on how long you can spend on response costs before the insurer has to approve them. Before you need it, find out:

• Who you call first.
• Whether that call counts as notice to your insurer.
• Who pays for the first hour of help.
• Where the number is written down, on paper.

Whatever your policy says, report quickly. Waiting rarely makes a cyber claim easier.

Write the plan down, then practice it

An incident response plan tells everyone what to do. The Cyber Centre says a good one names who's in charge, who talks to customers and regulators, how to isolate affected systems, how to recover from backups, and what you'll review afterward. Cybersecure Canada publishes a free fillable template, so you don't have to start from a blank page.

Then practice it. A tabletop exercise is a conversation, not a technical drill. Get the people on your bench in a room for half an hour and walk through one scenario. Ransomware locks your files on a Friday afternoon. Or someone in accounting pays a fake invoice. Who does what? Who gets called first? What do you tell customers? Where's the plan kept?

Keep a printed copy and one on your phone. A plan saved on a server that's down won't help anyone.

Why this matters now

Statistics Canada's latest survey of Canadian businesses, summarized by the Cyber Centre, found recovery costs from cyber incidents doubled to $1.2 billion. Only about 22% of businesses said they'd given non-IT staff any formal cyber security training.

The Cyber Centre also sent 336 early ransomware warnings to more than 300 Canadian organizations in one year. Those warnings only help if someone at the business knows what to do when one arrives.

Build the community around you

• Share what you've learned. Tell your team about one scam you saw or one habit you changed this month.
• Make it safe to speak up. An employee who clicked something should feel comfortable saying so right away. The sooner you know, the smaller the problem.
• Talk to your family. Parents and grandparents are frequent targets of fraud. A five-minute conversation helps.
• Forward scam texts to 7726. It helps phone carriers block them.
• Show new hires the plan on day one. The best time to learn who to call is before there's a reason to.

Report scams and fraud

The Canadian Anti-Fraud Centre estimates fewer than 5% of fraud victims report what happened. Every report helps police connect cases and warn others, including reports of scams you spotted and didn't fall for. If you've been targeted:

• Gather the details: who contacted you, how, and when, plus screenshots, emails, phone numbers, and receipts.
• If you lost money, call your bank right away, then your local police.
• Report it at reportcyberandfraud.canada.ca, anonymously if you prefer, or call the Canadian Anti-Fraud Centre at 1-888-495-8501.
• If it's a cyber incident at your business, call your broker and your insurer's claims line too.

Five minutes this week

• Write down your first-hour call list, with backups, and print it.
• Find your insurer's claims number and save it in your phone.
• Talk your team through one scenario for fifteen minutes.
• Tell one family member about a scam you heard about this month.
• Check whether you have cyber coverage, and what you'd need to do to start a claim.

If you'd like help with that last one, a Westland business insurance advisor can walk through your coverage with you.

Next: our month-end wrap-up pulls the series together with a closing checklist.

Sources: Get Cyber Safe, Cyber Security Awareness Month 2026; Canadian Centre for Cyber Security, Developing Your Incident Response Plan (ITSAP.40.003) and Ransomware Threat Outlook 2025 to 2027; Cybersecure Canada incident response plan template; Canadian Anti-Fraud Centre; Competition Bureau of Canada, How to report fraud and scams.