The numbers Canada publishes, and the one nobody collects.

Statistics Canada's cyber survey asks businesses about penetration testing. It asks nothing about tabletop exercises, simulations, drills or incident response plan testing (Statistics Canada, Canadian Survey of Cyber Security and Cybercrime questionnaire, survey 5244). Every figure here about testing comes from a carrier, a regulator or a standard, because no national statistic exists.

Why the middle column is the useful one

Most of these figures are quoted wrongly somewhere. Every line names what it measures and, where it matters, what it does not. A figure about written cyber security policies is not a figure about incident response plans. A figure about staff training is not an exercise participation rate. Both mistakes are in circulation, and a broker or an underwriter will know.

Before you cite one, read the middle column, then open the source. Each figure here was checked against the primary document rather than against an article about it.

The gap, in one line

Question 28 of the Statistics Canada instrument lists the activities a business undertakes to identify cyber security risks, and penetration testing appears twice, once by an employee and once by an external party. Tabletop exercises appear nowhere in the instrument, and neither does testing an incident response plan. If somebody quotes you a Canadian statistic on exercise frequency, ask them where it came from.

What the national statistics say

All from the Canadian Survey of Cyber Security and Cybercrime, released 21 October 2024, reference year 2023.

Six national figures, what each one measures, and what it does not

Figure	What it measures	What it does not measure
16%	Canadian businesses impacted by a cyber security incident. Down from 18% in 2021 and 21% in 2019.	Severity. An impact here ranges from an hour lost to a shutdown.
30%	The same measure for large businesses, 250 employees and over. Nearly double the national rate.	Mid-market firms specifically. The survey's size bands do not isolate 50 to 300.
$1.2B	Total recovery spending by Canadian businesses in 2023, roughly double the 2021 figure.	Losses. This is money spent recovering, not revenue or data lost.
22%	Businesses holding cyber risk insurance in 2023, up six points from 16% in 2021.	Limits, coverage or whether a claim would be paid.
26%	Businesses with written cyber security policies in 2023, unchanged from 2021.	Incident response plans, plan testing or business continuity. The release measures none of the three. This figure is widely quoted as if it did.
22%	Businesses that gave formal cyber security training to non-IT employees in 2023.	Exercise participation. It is a training rate and must never be presented as one for drills or tabletops.

What Canada's Cyber Centre asks of you

Two Cyber Centre documents, and what each one says about testing

Source	What it says
Baseline Cyber Security Controls, v1.2	Written for organisations with fewer than 500 employees. Section 3.1 asks you to have a plan to respond and recover. It does not ask you to test it.
ITSM.10.014, January 2026	Newer guidance, and it does: Run a tabletop exercise with the key employees identified in the plan. No kit, scenario pack or template is published with it.

Claims data

Coalition's figures cover its own policyholders in Canada, the United States, the United Kingdom, Australia and Germany, full-year 2025. They are a book of business, not a Canadian population.

Six claims and survey figures, what each measures, and why it matters here

Figure	What it measures	Why it matters here
58%	Share of incidents that were email compromise or funds transfer fraud.	The majority of incidents are a finance problem. A renewal checklist that only covers IT misses them.
39%	Funds transfer fraud events with no confirmed email compromise behind them.	Email security alone does not stop payment fraud. Payment verification is a separate control.
86%	Policyholders hit by ransomware who refused to pay. A record, which Coalition attributes to viable backups and response plans.	Refusing is now normal. The rehearsed question is what happens next, not whether to pay.
70%	Ransomware claims involving data theft as well as encryption, at an average USD 302,000.	A clean restore ends the outage and not the incident.
USD 1.7M	Average ransomware recovery cost per incident, excluding any ransom. Up 11% year over year.	Sophos, across surveyed organisations worldwide rather than Canada alone.
34% vs 46%	Organisations of 100 to 250 employees that stopped an attack before encryption or extortion, against those of 3,001 to 5,000.	The gap is the mid-market exposure argument, stated with its own numbers.

Sources for this table. Coalition, 2026 Cyber Claims Report, published March 2026. Sophos, State of Ransomware 2026, for the last two rows.

Whether exercising changes anything

Two figures on whether exercising changes outcomes, and what each does not measure

Figure	What it measures	What it does not measure
13%	Marsh found organisations that regularly run tabletop exercises and breach drills less likely to have a material cyber event, and ranked incident response planning in its top five most effective controls.	Causation, and Marsh's word is "material cyber event" rather than incident. The report body sits behind a form, so never cite a page.
52%	Organisations with a response plan that had never reviewed it or had no set period for reviewing or testing it.	Two things merged into one figure. Do not shorten it to "no set period".

Sources for this table. Marsh McLennan, Incident response planning emerges as key cybersecurity control, press release, 27 August 2025. IBM Security, Cyber Resilient Organization Report, with the Ponemon Institute, 2020.

Carriers, regulators and Canadian law

What carriers, regulators and Canadian law ask or require, and the catch in each

Source	What it asks or requires	The catch
Beazley, Canadian cyber application	Question 1.7 carries two separate tick boxes, Have a plan and Tested in last year.	The split is printed on a form written for Canadian applicants. Having and testing are different answers.
Cowbell, Prime 250 renewal	Asks whether the organisation has an incident response plan, tested and in-effect.	Three words doing the work, and no definition of tested anywhere on the form.
Beazley, form F00657	Asks for a plan and asks nothing about testing.	A large-account form, well above the mid-market. Carrier questions differ by form, not just by carrier.
NYDFS, Part 500	Covered entities test incident response and recovery plans periodically, but at a minimum annually, with the staff critical to the response.	New York, not Canada. It matters because it is where the annual expectation many carriers now assume came from.
PIPEDA	Report to the Privacy Commissioner where a breach creates a real risk of significant harm. Keep a record of every breach for 24 months (SOR/2018-64, section 6).	No fixed day count, unlike the GDPR's 72 hours. The record duty covers every breach, not only reportable ones.
Quebec, Law 25	Confidentiality incident register entries kept a minimum of 5 years.	The clock runs from when the organisation became aware, not from the incident.
Bill C-8	Assented 15 June 2026. The Critical Cyber Systems Protection Act would make designated operators identify and manage (paragraph 9(1)(a)) supply chain and third-party risk.	Part 2 is not in force, no operator has been designated, and no coming-into-force order has been identified. It binds nobody today.

Four of these are routinely quoted wrongly

Each of the four appears in circulation in the wrong form. If you are citing one in a board pack or a questionnaire, this is the version that survives being checked.

1. The 26% is written policies, not plans. Statistics Canada measured written cyber security policies. It did not measure incident response plans, plan testing or business continuity, and the release says nothing about any of them.
2. The 22% is training, not exercising. It counts businesses that gave formal cyber security training to employees outside IT. It is not a rate of drills, simulations or tabletop exercises, and there is no Canadian figure for those.
3. The IBM 52% is two answers added together. Never reviewed the plan, plus no set period for reviewing or testing it. Shortening it to "no set review period" drops half of what it counted.
4. Marsh ranked incident response planning fifth, not fourth. Marsh's own release puts network hardening, endpoint detection and response, logging and monitoring, and awareness training ahead of it. The fourth-place version traces to a secondary outlet that omitted one control. Top five is safe either way.

One more worth getting right. New York's rule reads periodically, but at a minimum annually. The common paraphrase "at least annually" changes the emphasis and drops the word carriers borrowed.

About MyTabletops

The offer is the Carrier-Ready Tabletop. A facilitator who does not work for you runs a 3-hour exercise with your leadership team, writes the after-action report inside 15 days, and signs the attestation page. Fixed price. If your carrier does not accept the report, we revise it until they do, at no cost and with no time limit.

Nobody publishes a Canadian number for this. Your carrier still asks the question. Book a 20-minute scoping call on the contact page, or write to [email protected].

Every figure was checked against the primary document rather than an article about it. Where a source sits behind a form or a paywall and could not be opened, this page says so rather than citing it anyway. No wording on this page is quoted from any standard whose text is copyrighted. Nothing here is insurance, legal or accounting advice.