Cybersecurity funding for Canadian SMBs and non-profits: active options in B.C.

There is currently no broad Canadian or B.C. grant that simply reimburses any small business or non-profit for a security review, Microsoft 365 hardening, backups, or new security software. There are active programs that can support particular parts of a well-defined project: employee training, cohort-based workforce development, eligible software or working-capital costs, and genuinely innovative technology development.

That distinction matters. “We need better cybersecurity” is a valid business concern, but it is not yet a fundable project. A stronger application connects a specific cost to the program’s actual purpose and shows a measurable outcome: staff earning a recognized skill, a lender-financed software asset, a community training cohort, or a new technology with commercialization potential.

The program statuses below were checked against official sources on September 10, 2026. Funding, intake dates, and eligibility can change; confirm them with the program before signing a contract or incurring a cost.

Active options for B.C. employers and individuals

B.C. Employer Training Grant

Best fit: A B.C. small business or non-profit training named employees in practical cybersecurity skills.

The B.C. Employer Training Grant is open for 2026/27 training. It reimburses up to 80% of eligible training expenses, to a maximum of $10,000 per participant and $300,000 per employer per fiscal year. Eligible employers include B.C.-operating non-profit organizations, and small businesses are one of the program’s priority factors.

A structured third-party course in security administration, incident response, cloud security, or an applicable certification may fit if it meets the program rules. A consultant performing a security assessment or configuring your systems is not employee training and should not be presented as such.

Apply before training begins—WorkBC recommends at least 60 days in advance—and plan for reimbursement after the employer has paid the trainer. The employer must submit its own application; a grant writer, trainer, or fee-based provider cannot apply on its behalf or use its BCeID.

StrongerBC future skills grant

Best fit: A B.C. resident aged 19 or older building their own cybersecurity capability through an eligible short course.

Applications are open for the 2026/27 StrongerBC future skills grant. It provides up to $3,500 toward eligible short-term training at B.C. public post-secondary institutions. The current catalogue includes security-related study, including a post-quantum cybersecurity micro-credential.

This is funding for an individual learner, not a reimbursement to an organization for tools or consulting. It can still be useful when an owner, administrator, or staff member will become the internal security lead. The $3,500 is a lifetime maximum and the institution confirms registration and eligibility.

Active options for larger training initiatives

B.C. Community Workforce Response Grant

Best fit: An eligible local non-profit, industry association, Indigenous organization, or other listed applicant proposing cohort-based training in response to a demonstrated community or sector workforce need.

The Community Workforce Response Grant can provide up to $300,000 per project. Its third 2026/27 intake is open from July 20 to October 23, 2026, for training beginning from January 4 to February 26, 2027. A fourth intake is listed but not yet dated.

This is not designed to secure one applicant’s own office. A cybersecurity proposal would need to be a credible workforce project: a defined participant group, evidence of employment or skills need, eligible training, community or employer connections, and outcomes that fit the selected stream.

Federal Sectoral Workforce Innovation Fund

Best fit: An organization with partners and the capacity to deliver a substantial workforce solution across a sector or region.

The federal Sectoral Workforce Innovation Fund opened continuous intake on August 25, 2026, until funds are exhausted. Eligible applicants include non-profits, for-profits, Indigenous organizations, training institutions, and municipal governments; projects can request up to $10 million for as long as 36 months.

Its scale and purpose put it beyond a normal internal security upgrade. It may be relevant to an association or consortium addressing a documented cybersecurity skills shortage, especially where employers and training partners are already committed.

Active financing and innovation support for businesses

Canada Small Business Financing Program

Best fit: A Canadian small business that needs financing—not a grant—for eligible technology costs.

The Canada Small Business Financing Program shares lending risk with participating financial institutions. Small businesses and start-ups operating in Canada with gross annual revenue of $10 million or less can approach a bank, credit union, or caisse populaire. The lender, not the government, makes the credit decision.

Eligible term-loan classes include equipment, intangible assets, and working capital. The detailed program guidance includes computer software and capitalized installation by a specialized contractor; a line of credit can support working-capital costs. That can make a defined security-software or infrastructure project financeable, but it remains repayable debt, program rules apply to each cost, and approval is not automatic. Confirm the proposed invoice and accounting treatment with the lender before purchase.

NRC IRAP

Best fit: An incorporated, for-profit Canadian SME developing and commercializing an innovative technology-driven product or service.

NRC IRAP offers advice, connections, and—in selected cases—project funding. An eligible company must have up to 500 employees and a credible innovation and commercialization plan. A company developing a novel security product may fit; a company buying ordinary security software or paying routine operating costs will not. The first step is a call with NRC IRAP, and neither an advisory relationship nor an invitation to propose guarantees funding.

Programs commonly mistaken for current options

Old articles and consultant pages still promote the Canada Digital Adoption Program (CDAP). The Government of Canada records that CDAP concluded on March 31, 2025. The 2025 Cyber Security Cooperation Program also closed its proposal window on September 25, 2025. Neither should appear in a 2026 funding plan as an open application route.

Use the federal Business Benefits Finder to catch new or sector-specific opportunities. Complete the profile in detail, select grants, loans, wage subsidies, and expert advice, then filter for programs currently accepting applications. Recheck immediately before relying on any result.

Turn a security need into a fundable project

Before choosing a program, prepare a short project brief:

1. Define the business problem. Name the affected systems, people, or service—not just “cyber risk.”
2. Establish the current state. Record what exists today, the material gaps, and evidence supporting them.
3. Separate the costs. Training, software, equipment, assessment, configuration, and ongoing subscriptions may be treated differently.
4. Choose measurable outcomes. Examples include trained staff, MFA coverage, tested recovery, reduced privileged access, or a documented response plan.
5. Match the program before writing the application. Reuse the facts, not a generic proposal, and do not reshape an ineligible consulting project to look like training or R&D.
6. Wait for written approval where required. Many programs will not reimburse costs incurred before approval or the eligible project date.

How Jeyki can help

Jeyki can help define the technical side of the project: assess the current state, prioritize gaps, separate one-time implementation from recurring costs, build a staged scope, provide a quote, and document measurable security outcomes. If funding is approved and the work is eligible, Jeyki can carry out an agreed Microsoft 365 Security Review & Hardening, Internal Security Review, or Custom Security Project, then provide implementation and handover evidence for your records.

The applicant must remain responsible for eligibility, representations, submission, financial information, and the funding agreement. Where a program prohibits third parties from applying—as the B.C. Employer Training Grant does—Jeyki can supply an accurate scope and technical details but cannot submit or control the application. Jeyki does not guarantee approval and does not replace legal, accounting, or program-officer advice. That boundary protects both the application and the security work it is meant to fund.