Get in touch.

A question, a second opinion, or something you would rather talk through. Email us or use the form — both land in the same inbox.

We reply by email.

Write to contact@cyberlegionnaire.com, or use the form — they arrive in the same place.

If a call would be more useful than an exchange of emails, say so and we will find a time that suits you.

Looking for the free Security Snapshot?

A short, external look at what an attacker sees when they look at your firm.

Get the Snapshot →

Security researchers: please use our disclosure address rather than this form.

Send us a message

Three fields. We reply by email.

Cyber Legionnaire

The security team for small regulated professional firms.

Company

Who we protect

Proof

Where our claims come from

8 statements on this site describe the market rather than our own clients. Each is sourced here — a claim we cannot show you is a claim we should not be making.

Claim	Figure	Basis
Most small firms have no security budget at all	84.5%	of Canadian businesses with 5–19 employees had no dedicated cybersecurity budget (92.0% at 1–4 employees; 69.8% at 20–99). Separately, most businesses (54.4%) had no plans to take any new or additional cybersecurity action in the following 12 months, and the most common reason given was not needing cybersecurity measures (57.1%).
Most small Canadian professional firms can be impersonated by email	77%	of small Canadian professional firms with a website have no enforced DMARC — meaning anyone can send email that appears to come from them, and the receiving server has not been told to reject it. We measured this ourselves across 3,821 firm domains, because no independent source publishes it.
Recovery spending doubled in two years	$1.2 billion	is what Canadian businesses spent recovering from cyber security incidents in 2023, double the roughly $600 million spent in 2021 — while total spending on prevention and detection rose only from $9.7 billion to $11.0 billion. Small businesses accounted for about $300 million of the recovery bill.
For most small firms, the IT provider IS the security plan	50%	of Canadian businesses had any employees responsible for cyber security in 2023 — down from 61% in 2021. Among those without, the most common reason given was that they use consultants or contractors instead (47%).
Your CCO personally certified your cybersecurity answers to the OSC	G10	Every OSC-registered firm answers the Risk Assessment Questionnaire, and from 2026 the Chief Compliance Officer must personally certify each section — including Question G10 on cybersecurity. CIRO Dealer Members additionally have three days from discovering an incident to report it. Neither the certification nor the deadline can be satisfied by a firm that would not notice an incident in the first place.
Clients and partners now require security measures in writing	44%	of Canadian businesses were required to implement cyber security measures by suppliers, customers, partners or regulators, or to meet the requirements of security standards or certification programs — up from 29% two years earlier. Statistics Canada, 2019 and 2017. Inside the legal profession the ABA measures the same pressure directly, and finds it concentrated in larger firms: 15% at 2–9 lawyers against 59% at 50–99.
Your insurer asks whether you enforce MFA before it will quote you	MFA	is the control insurers ask about first, in writing, on their own application forms — Coalition's Canadian questionnaire and Beazley's US one both ask whether it is enforced on email and remote access, alongside tested backups and patching. Aon's 2025 report still calls it "an underwriting requirement" in a buyer-friendly market. Travelers rescinded a policy after a ransomware claim where the MFA represented on the application did not exist.
Corporate clients hand law firms a security schedule — their own association wrote one	24 hours	is the breach-notification window in the Association of Corporate Counsel's model security schedule — a ready-made set of controls written for in-house counsel to impose on the outside firms they retain. 27% of US law firms have been asked for their security requirements document; at 2–9 lawyers it is 15%.

Read the source

How we source and verify every figure →

Most small firms have no security budget at all

The figures behind this claim, and where they come from.

Figure	What it measures
84.5%	of Canadian businesses with 5–19 employees had NO dedicated cybersecurity budget, Q3 2024. By size: 92.0% at 1–4 employees, 84.5% at 5–19, 69.8% at 20–99, 43.2% at 100+. Statistics Canada table 33-10-0875-01, vector v1594328208; StatCan rates this estimate's quality "excellent".
54.4%	of businesses had no plans to take new or additional cybersecurity actions over the next 12 months — and among the reasons given, the most common was not needing cybersecurity measures (57.1%). That is the "hope" in the sentence above. Canadian Survey on Business Conditions, Q3 2024.
37.0%	of Canadian legal-services businesses had no employee whose regular responsibilities include cyber security in 2023 — 38.6% of accounting, tax and bookkeeping practices, and 37.6% of ambulatory health care. Statistics Canada table 22-10-0129-01, vectors v1212389881 / v1212389887 / v1212390001.

Read the source

Most small Canadian professional firms can be impersonated by email

Our own measurement of 3,821 Canadian firm domains, 3,313 of which receive email. Sector rates are combined by weighting each sector by how many small firms Statistics Canada counts in it — not by how many we happened to sample.

Figure	What it measures
77%	of small Canadian professional firms WITH A WEBSITE have no enforced DMARC — anyone can send email that appears to come from them. The frame is firms we could find a domain for, so the figure describes firms with a web presence.
81.7%	clinics and health practices
73.1%	law firms
72.4%	accounting practices

Read the source

Method and full results →

Recovery spending doubled in two years

Statistics Canada's 2023 survey of Canadian businesses. That $1.2B is money already out the door after an incident — it does not include lost clients, lost time or reputational damage, so treat it as a floor rather than a total.

Figure	What it measures
$1.2 billion	"Total spending on recovery from cyber security incidents also increased in 2023, doubling from approximately $600 million in 2021 to $1.2 billion in 2023." Prevention and detection spending over the same period went from $9.7 billion to $11.0 billion — recovery is the line that doubled.
$300 million	"Large businesses accounted for almost half of total spending on recovery from cyber security incidents in 2023 (about $500 million), while medium-sized and small businesses each spent approximately $300 million." Small businesses carry a quarter of the national recovery bill.
≈ $12,600	OUR ARITHMETIC, shown so you can check it: $300 million ÷ ≈23,800 small businesses impacted in 2023 (170,000 × 14%, the same calculation as the "1 in 7" table on this page). It is an average, and a skewed one — among small businesses actually impacted in 2023, 35.5% described the incident's effect as minor (Statistics Canada table 22-10-0133-01), so most sit below this figure and a few sit far above it.
Not in this number	Lost clients, lost billable hours, the cost of notifying everyone whose data was in a mailbox, and reputational damage. StatCan measures money spent recovering, not total harm. For a professional firm the uncounted half is usually the larger one, and no Canadian source quantifies it at this size — which is why we do not put a figure on it here.

Read the source

Statistics Canada — Impact of cybercrime, 2023

For most small firms, the IT provider IS the security plan

The figures behind this claim, and where they come from.

Figure	What it measures
50%	of Canadian businesses reported having cyber security employees in 2023, "down from 61% in 2021" — so the share with nobody in-house is growing, not shrinking.
47%	of businesses without cyber security employees said the reason was that they "used consultants or contractors to monitor cyber security". For most small firms the outsourced IT relationship IS the security plan.
26%	of Canadian businesses had written policies for cyber security in place in 2023 — unchanged from 2021. Three in four have none.
46%	of Canadian businesses monitored their network and business systems in 2023 — the most common cyber security activity, and still a minority. "The most common cyber security activity in 2023 was monitoring network and business systems (46%), followed by monitoring insider threat risk behaviours (22%)."
Why this matters	Outsourcing is sensible; we are not arguing otherwise, and we work alongside incumbent IT providers. The distinction is one of discipline: keeping systems running and keeping a motivated attacker out are different jobs requiring different skills. We do not publish a figure rating anyone else's competence, because no independent body measures it — only vendors selling to that market do.

Read the source

Statistics Canada — Impact of cybercrime on Canadian businesses, 2023 (The Daily, 2024-10-21)

Your CCO personally certified your cybersecurity answers to the OSC

The figures behind this claim, and where they come from.

Figure	What it measures
Everyone registered: you signed it	The OSC's Risk Assessment Questionnaire carries "QUESTION G10 – CYBERSECURITY", and the OSC's advance notice states: "New for the 2026 RAQ, your CCO must now certify within each section of the RAQ that they have reviewed all of the responses, including the pre-populated information." A named officer at the firm has personally certified its cybersecurity answers. The only question left is whether the evidence behind them exists.
Dealers: also a hard rule	CIRO amendments "require Dealers to report to IIROC any cybersecurity incidents within three days of discovery of the cybersecurity incident, require Dealers to provide IIROC with an incident investigation report within 30 days of discovery of the cybersecurity incident, and list the information Dealers must report."
Advisers: an expectation	Firms registered as advisers rather than CIRO Dealer Members are not caught by that rule. We checked NI 31-103 and its companion policy and found no cyber obligation on advisers — the CSA addresses them through staff notices reviewing cybersecurity practices, which set expectations rather than requirements. We say so rather than implying otherwise.
Insurance is not required either	CSA staff notice, verbatim: "Though cybersecurity insurance is not required, Staff are of the view that obtaining this insurance coverage can be beneficial, as it can help reduce financial harm to a firm when faced with a cybersecurity incident."
Why the distinction does not weaken it	A three-day deadline measured from discovery is only meetable if you discover things. A firm with no monitoring does not start the clock late — it never starts it, and the first notice arrives from somebody else. That is true of a rule and an expectation alike.

Read the source

How we source and verify every figure →

Clients and partners now require security measures in writing

What buyers require of the firms they engage — measured by Statistics Canada across the economy, and by the ABA inside the legal profession. Both are quoted in full, including the parts that cut against us.

Figure	What it measures
44%	of Canadian businesses, verbatim: "In 2019, 44% of businesses reported that they were required to implement cyber security measures by suppliers, customers, partners or regulators, or to meet the requirements of cyber security standards or certification programs." Note what that sentence includes — regulators and certification schemes sit inside the 44% alongside customers, so this is the breadth of the requirement, not a count of demanding clients. Highest in "the finance and insurance sector (70%)", which is where a firm's institutional clients live.
29%	the same measure two years earlier: "Approximately one-third (29%) of Canadian businesses were required to implement cyber security measures by their suppliers, customers, partners or regulators in 2017." Two independent cycles of the same national survey, 29% → 44%. The direction is the claim; neither figure on its own is.
22%	of US law firms of every size had been asked to complete a client security questionnaire: "The 2023 Survey reported that 22% of respondents answered that a client or potential client had asked their firm to complete a security questionnaire." American Bar Association, 2023 — a US survey, and that qualifier travels with the figure.
15%	— and here is the part that does not flatter the claim. Broken out by firm size, the ABA found "requests for security requirements documents/guidelines were made to 50% of firms with over 100 lawyers, 59% for 50-99 lawyers, 41% for 10-49 lawyers and 15% for firms of 2-9 lawyers", with the questionnaire figures "27% for 10-49 lawyers and 14% for firms of 2-9 lawyers". So roughly one small firm in seven has been asked so far. The honest reading is a gradient that starts with the largest clients and moves down-market, not a wave that has already arrived.
Why it keeps growing	Because the buyer is now obliged to ask. OSFI's Guideline B-10, in force 1 May 2024, binds every federally regulated bank and insurer to an outcome stated verbatim as "Technology and cyber operations carried out by third parties are transparent, reliable and secure" — and a professional firm holding that institution's files IS one of those third parties. The questionnaire arriving in your inbox usually starts as somebody else's regulatory obligation.

Read the source

The requirements that already apply to your firm →

Your insurer asks whether you enforce MFA before it will quote you

Not a broker's characterisation of the market — the questions insurers actually put on their own application forms, and what happened to one policyholder whose answers were not true.

Figure	What it measures
On the Canadian form	Coalition's Canadian cyber questionnaire states plainly that "Responses to the questions below are necessary to obtain a quotation for Cyber insurance from Coalition", then asks: "For which of the following services do you enforce Multi-Factor Authentication (MFA)?" — email, VPN/remote access, and privileged accounts, each ticked separately. It also requires "at least weekly backups of all sensitive or otherwise critical data".
On the US form	Beazley's application asks the same things in its own words: "Do you require Multi-Factor Authentication (MFA) for remote access to your network", "Do you require MFA for access to web-based email?", "Do you regularly back up your business critical data?", and whether you "actively manage and install critical patches across your internet-facing systems". Two unrelated insurers, one list of controls.
Still true in a soft market	The obvious objection is that this was a 2022 hard-market spasm. Aon's 2025 report — the one describing conditions as buyer-friendly — still says: "While a well-known topic, multi-factor authentication is still an underwriting requirement, as is a tested IR plan." Marsh puts it as controls that "are now a minimum requirement for insurers", with insurers "requiring specific cybersecurity controls and placing insurability at stake."
And in Canada, from the industry body	The Insurance Bureau of Canada publishes a self-assessment covering "the cyber security protocols and best practices that most cyber insurers look for when assessing risk". Softer wording than the forms themselves, and Canadian.
When the answers are not true	Travelers sued to rescind a cyber policy after a ransomware claim, alleging the insured had represented MFA it did not have: "Had Travelers been made aware that ICS was not using MFA to the extent represented in the Application Documents, Travelers would not have issued the Policy." The parties stipulated and the court ordered that "no insurance coverage shall be available" under it. It was AGREED, not adjudicated — the insured conceded rather than fight — so it shows what an insurer will do, not what a court has ruled. The Canadian case on this site, where an insurer refused about $5 million in claims because MFA was started but never finished, is the City of Hamilton.

Read the source

The Canadian case: claims refused after a breach →

Corporate clients hand law firms a security schedule — their own association wrote one

Evidence that the security questionnaire sent to a law firm is a standard instrument rather than one nervous client, and what it typically demands.

Figure	What it measures
Who wrote it, and why	The Association of Corporate Counsel published Model Information Protection and Security Controls for Outside Counsel "to help in-house counsel as they set expectations with their outside vendors, including outside counsel, regarding the types of data security controls these vendors should employ". The people who hire law firms have a model contract schedule ready to send.
24 hours	is the reporting window it sets: on discovering a breach, "Upon discovering any suspected or actual unauthorized disclosure, loss, or theft of Company Confidential Information" outside counsel must notify the client within 24 hours. A firm that would not detect the incident cannot meet a deadline measured from discovering it — the same structural point the OSC and CIRO deadlines make.
27%	of US law firms had been asked by clients for their security requirements document: "The survey reported that 27% of respondents had been asked by clients for the firm's security requirements document/guidelines." At 2–9 lawyers that falls to 15%, and 14% for the security questionnaire — small firms are where this is arriving last, not where it is absent. US data.

Read the source

What LawPRO requires of you →