What Canadian brokers learned about cyber insurance at Coalition’s first Canada Broker Summit

How did Coalition build its Canadian business?

George Bozanin, Coalition’s head of Canada, opened the afternoon with a hockey line that fit the room. When Coalition launched in Canada in May 2020, he said, the business was “a blank sheet of ice.” There were no broker contracts, no premium and very little brand recognition. Today Coalition works with brokers in every province and territory, from national firms to small independent shops.

He also wanted brokers to understand how the company is built. Coalition operates as a managing general agent with delegated authority, but it also has its own admitted carrier, Coalition Insurance Company, so it has its own capital at risk. One of its mottos, he said, is that it is only one percent of the way there.

What is active cyber insurance?

Michael Phillips, head of global cyber portfolio underwriting, explained the thinking. Most insurance is priced at one point in time and pays out after the loss. Cyber risk does not sit still. Technology changes, criminals change their tactics, and privacy rules keep moving. A policy checked once a year can leave gaps nobody sees.

He compared it to crashing a new car. With most insurance, you call the tow truck, find the mechanic and sort it out yourself, then send the bill and hope. Active insurance means someone is on your side from the first minute, helping you respond and get back to work. He also pointed out that risk managers, IT heads and security chiefs often think about cyber risk in very different ways, and that bringing them together is part of the job.

What changed in Coalition’s Active Cyber Policy?

Thomas Orofino, Coalition’s director of cyber product counsel, walked brokers through the policy. He started his career as an underwriter before becoming a lawyer, and it showed in how practical his points were.

He also described a deepfake response cover built into the policy. It pays for a forensic expert to confirm a deepfake, legal work to get it taken down, and crisis communications support to protect the client’s reputation.

Why do so many small businesses still go without cyber insurance?

Sarah Woods, a product leader at Coalition, told the story of Bob, the owner of a coffee shop in her small town. Bob was sure he did not need cyber insurance. He was in a people business, not tech. He only used outside software. Nobody would bother hacking a small shop like his. After six months of friendly pressure, he finally agreed to call his broker, mostly so she would stop talking about it.

The point was serious. Coalition’s research found that only about one in five small businesses carries cyber insurance. Brokers told her they hear the same excuses Bob gave, but unlike her, they have minutes, not months, to make the case. Cyber specialists know the product deeply, while frontline brokers juggle many lines and may not feel confident. So her team builds tools to close that gap: very short applications for smaller clients, peer benchmarks, a suggested limit, and a client-ready presentation made for every quote. Their research found that the best way to get a client to say yes is to present one recommended quote, not a long menu.

She ended with a second story. On her way to Toronto, a panicked local business owner called her after being hacked. Three hours later the same woman sounded calm. She had cyber insurance and a team of experts in her corner. That change in her voice, Woods said, is what every business owner deserves.

What do cyber claims look like in Canada right now?

Raffaella Rullo, counsel at DWF, one of Coalition’s panel law firms, introduced the claims team. A cyber incident, she said, is often one of the worst days of a client’s life, and what makes the difference is having the right team, people who pick up the phone late on a Friday or on Christmas Eve.

Anne Juntunen, senior claims manager, said Coalition has built its Canadian claims team so that Canadian claims are handled in Canada, by people who understand the client’s world, with licences across every province and territory and French-language service. Her headline was that ransomware gets the attention, but the growth is in email-driven fraud: funds transfer fraud and business email compromise. In some cases criminals are not just sending fake invoices. They get into the client’s online banking and move money out in many small amounts, which makes it harder to trace.

If you tell us within 72 hours, we have a pretty good shot at getting that money back.

Anne Juntunen, Coalition, on funds transfer fraud (as told to the room)

She shared one Canadian case where a policyholder lost nine million dollars after a criminal got into its banking portal. Working through the night with breach counsel at DWF, the team went to court, froze the funds and traced what had moved through a crypto exchange. All nine million dollars was recovered within 13 days, at a cost of under twenty thousand dollars.

Jodi Buck, claims manager, and Eric Griffi, Canada claims lead, then showed how AI is supercharging scams. In one case, criminals got hold of a client’s contact list and used an automated script to message the whole list in a staff member’s name. In another, a criminal used an AI-generated video call and an AI-written legal document to impersonate a senior executive and trigger a payment overseas. The lesson for brokers was clear: these attacks look routine until it is too late, so clients should call the moment something feels wrong.

What is the simplest way for clients to reduce cyber risk?

Jake Reynolds, head of engineering and product for Coalition Security, spent his early career breaking into large systems to test them, and now defends businesses of every size. He said the cyber security industry loves complex dashboards, but complexity is where things go wrong. His team built the simplest product it could, focused on the few signals that actually lead to claims, with alerts written in one plain sentence.

He told brokers that policyholders who log in to Coalition Control and act on it are four times less likely to have a claim. He also shared a painful example: a client ignored an alert about an exposed system a month before it was breached, because the only person who had ever logged in was the executive who signed the policy. His advice for every client came down to three steps:

Topics