computertechnician.net Practical Computer Care

Statistics

Small Business Cybersecurity Spending Statistics: Costs, Budgets, and Priorities

Canadian spending benchmarks and survey findings on small business cybersecurity costs, budgets, purchasing choices, and planned investment.

November 12, 2026 7 min read computertechnician.net Editorial Team

Contents

Small business cybersecurity spending statistics: Canadian average spending by business size

Cybersecurity spending figures depend on what is counted. Prevention and detection budgets cover efforts to reduce the chance or impact of an incident; recovery spending follows incidents. National totals, per-business averages, and survey responses are also different measures. Keeping those distinctions clear makes the figures more useful for small-business planning.

In Statistics Canada’s 2019 and 2021 comparison, small businesses—enterprises with 10 to 49 employees—averaged $10,000 in prevention and detection spending in 2019 and $19,000 in 2021. Medium-sized businesses, with 50 to 249 employees, averaged $68,000 and $83,000, respectively. Large businesses, with at least 250 employees, averaged $667,000 in 2019 and $1,008,000 in 2021.

Canadian enterprise sizeAverage prevention and detection spending, 2019Average prevention and detection spending, 2021
Small, 10–49 employees$10,000$19,000
Medium, 50–249 employees$68,000$83,000
Large, 250 or more employees$667,000$1,008,000

These are averages by enterprise-size group, not recommended budgets or amounts every business spent. Statistics Canada reported that average prevention and detection spending across Canadian businesses was $52,000 in 2021, up 46% from 2019. The same report said small businesses spent about $9,000 more in 2021 than in 2019. That dollar change is consistent with the rounded small-business averages in the chart. The overall 46% change applies to businesses collectively; it should not be read as the small-business growth rate.

Source: Statistics Canada, The changing landscape of cyber security following the COVID-19 pandemic.

Small business cybersecurity spending statistics: prevention and recovery totals

National totals provide a second view. Canadian small businesses accounted for $2.6 billion of prevention and detection spending in 2023. Medium-sized businesses accounted for $3.6 billion and large businesses for $4.8 billion, adding to the national total of $11.0 billion. The comparable national prevention and detection total in 2021 was $9.7 billion.

A smaller share of businesses reported spending anything on prevention or detection in 2023 than in 2021: 56%, down from 61%. This share measures whether businesses reported spending money; it does not indicate how much they spent. The aggregate total can rise while the share of businesses reporting any spending falls, because the measures describe different things and the totals may be concentrated among businesses that did spend.

Recovery costs followed a different pattern. Canadian businesses spent approximately $600 million recovering from cyber incidents in 2021 and $1.2 billion in 2023. Small businesses accounted for approximately $300 million of the 2023 recovery total; medium-sized businesses also accounted for approximately $300 million, while large businesses accounted for about $500 million. The rounded size-group amounts sum to roughly $1.1 billion, so they should be treated as approximate breakdowns rather than an exact reconciliation of the $1.2 billion national figure.

The prevention and recovery totals are not directly interchangeable: they cover different activities and periods. For a small firm, the distinction is practical. Prevention costs may be planned in advance, while recovery costs represent spending after incidents. The national figures show that both categories are substantial, but they do not predict an individual company’s likely loss or appropriate budget.

Source: Statistics Canada, Impact of cybercrime on Canadian businesses, 2023.

Spending is not limited to software subscriptions. In Canada in 2023, employee salaries related to prevention or detection were the largest reported business cybersecurity cost category, totaling $3.8 billion. Software costs totaled $2.9 billion, followed by consultant or contractor expenses at $1.9 billion. Businesses also spent more than $300 million on training for employees, suppliers, customers, or partners.

These are national business totals, not small-business-only figures. Still, they illustrate why a security budget can include staff time, external support, and training alongside purchased tools. A software-only view would miss much of the spending captured in these categories.

A separate Statistics Canada release reports average spending across Canadian enterprises with 10 or more employees in most sectors, excluding public administration. For all prevention measures, the average was $53,907 in 2023 and $54,772 in 2025. The 2025 average included $17,103 for employee salary related to cybersecurity and $16,287 for cybersecurity software. These are averages across the stated enterprise population, not small-business-specific estimates, and the category figures should not be mistaken for total cybersecurity spending by a typical small firm.

Source: Statistics Canada, Impact of cybercrime on Canadian businesses, 2023 and Impact of cybercrime on Canadian businesses, 2025.

Small business cybersecurity spending statistics: budgets and barriers

Survey findings add context about budget pressure, but they represent specific respondent groups rather than all small businesses. In Devolutions’ 2024–2025 survey of 445 SMB IT and security professionals, 63% said their cybersecurity budgets had increased in the preceding year. At the same time, 29% said security received less than 5% of their IT spending. These figures suggest that budget increases and a relatively small security share of IT spending can coexist; they do not establish a typical dollar budget.

In a CrowdStrike-commissioned survey of 291 U.S. small-business professionals at organizations with 1 to 249 employees, conducted in February and March 2025, just 7% considered their current cybersecurity budget fully sufficient. The result captures respondents’ assessment of adequacy, not the amount spent or the size of any budget shortfall. In that same survey, 70% said they relied on outside experts to guide security decisions, a sign that purchasing and planning support may come from beyond the organization’s own staff.

Allot reported an average of $1,400 per year in cybersecurity spending among SMBs in its survey of 450 businesses worldwide. The page does not state the field dates or a precise sampling frame, so this figure is best treated as a survey-specific benchmark, not a global average for all SMBs. It also should not be compared directly with Statistics Canada’s Canadian averages without accounting for differences in geography, population, definitions, and measurement.

Sources: Devolutions, State of IT security in SMBs; CrowdStrike, The CrowdStrike State of SMB Cybersecurity Survey; Allot, Insights for CSPs from The Cybersecurity Survey of SMBs.

Small business cybersecurity spending: purchase choices and intentions

Cost is one factor in security buying, but survey respondents also described preferences about performance, packaging, and planned upgrades. In Allot’s worldwide survey of 450 SMBs, 48% prioritized performance when choosing a cybersecurity solution and 43% focused on cost. Thirty-six percent reported using a security solution provided by a service provider, while 62% preferred purchasing cybersecurity as part of an IT or mobile service package rather than as a standalone product. These responses describe preferences and current use, not market-wide purchasing shares.

In the same survey, 65% said they were likely to upgrade or purchase new cybersecurity solutions in the next 12 months. That is stated intent, not confirmed future spending. The survey’s field dates are not stated on the cited page, so the 12-month period should be understood relative to the survey rather than assigned a calendar year.

Kinetic’s 2025 SMB technology report shows a gap between recognizing security as a priority and assigning it a place in new technology spending: 59% recognized cybersecurity and compliance as key priorities, while 49% prioritized those areas for new technology spending. These measures concern stated priorities, not realized expenditures. The report also found that 52% lacked confidence in their cybersecurity preparedness and resources, and 36% were interested in more advanced, hands-on, or AI-powered tools.

Among Kinetic respondents considering adoption or an upgrade in the next 12 months, 57% cited protecting business or customer data, 46% cited avoiding financial loss, and 44% cited improving customer confidence. Budget constraints affect the wider technology-purchasing environment: 66% said budget constrained new-technology adoption, and 48% selected cost or return on investment as a major factor influencing a technology purchase. Those last two measures are not cybersecurity-specific, so they provide context rather than a direct estimate of cybersecurity budget limits.

Taken together, the evidence points to several distinct planning questions: what a business spends on prevention, what it may need for recovery, which internal or external resources it pays for, and how budget limits shape buying choices. The available figures support comparisons within their stated populations and periods, but they do not establish one universal cybersecurity budget for small businesses.

Sources: Allot, Insights for CSPs from The Cybersecurity Survey of SMBs; Kinetic Business, Small and Medium-Sized Business Technology Report.

Sources

Written by

computertechnician.net Editorial Team

Editorial team

Independent editorial coverage of practical computer care.

More to Explore