Cybersecurity · Québec

Protect your business against modern threats.

CyberBay is your partner in cybersecurity, data protection and cloud security. We secure your Microsoft 365 and Azure environments, test your defences and step in when an incident happens.

See our services Request an audit
  • Based in Boucherville, Québec
  • SMBs and large organizations
  • Microsoft 365 and Azure
Our expertise Microsoft 365 Azure Identity and access Zero Trust AI security Penetration testing Incident response Law 25
What we do

Security built around your reality

Simple, effective solutions that fit what organizations actually need.

Business protection

Security solutions for SMBs and large organizations: audits, hardening and penetration testing.

Audit and compliance

Cloud expertise

Securing Microsoft 365, Azure, identities and access: MFA, Conditional Access and a Zero Trust approach.

Cloud security

Incident response

Fast intervention when you are attacked or compromised: containment, analysis and recovery.

Incident response
AI security

Are your AI tools secure?

Assistants, agents, chatbots: AI reads your data and can act on your behalf. We test it the way an attacker would, put guardrails around it and train your teams to use it safely.

Explore the service
  • Prompt injection and guardrail bypass testing
  • Security of agents, their tools and their data access
  • AI governance: NIST AI RMF, ISO/IEC 42001 and Law 25
  • Training and awareness for your teams
The threats

What we help you defend against

Attacks now target organizations of every size. These are the four situations we see most often.

Targeted attacks

Phishing, CEO fraud, impersonation: attacks designed to fool your employees.

Cloud compromise

Hijacked Microsoft 365 accounts, misconfigured access, over-permissive third-party apps.

Ransomware

Your data encrypted and your operations halted, often after information has already been stolen.

Data leaks

Personal or confidential information exposed by mistake, negligence or malice.

Our approach

Four steps, no unnecessary complexity

  1. Assess

    We map your security posture and pinpoint the risks that matter most.

  2. Secure

    We harden your identities, your access and your cloud environments.

  3. Test

    We validate your defences with penetration tests and fix the flaws we find.

  4. Support

    We stay by your side, including when you are attacked or compromised.

Law 25

Personal information: are you ready?

Since September 2023, most of Québec’s Law 25 applies to businesses that hold personal information. We help you cover the security side of it.

Understand Law 25
  • Security measures that match the sensitivity of the data
  • Register and reporting of confidentiality incidents
  • Person in charge of protecting personal information
  • Penalties of up to $25 million or 4% of worldwide turnover
Insights

Practical steps you can take right now

Short guides to strengthen your security, without the jargon.

Microsoft 365

Five settings to check today

MFA, legacy protocols, admin accounts, audit logging and email protection.

Read the guide Incident

What to do in the first hour

What to do, and above all what to avoid, when you suspect an attack.

Read the guide Ransomware

Five measures to reduce the risk

Backups, patching, remote access: the basics that make the difference.

Read the guide

All insights

FAQ

Frequently asked questions

Where do we start if we have never had a security audit?

With an assessment. We map your security posture, then pinpoint the risks that matter most. You get a clear roadmap, ordered by what has the greatest effect.

How long does an audit or a penetration test take?

It depends on the scope: the size of your organization, the number of systems and the applications to test. Scope and schedule are agreed with you before we begin.

Can a penetration test disrupt our operations?

A test follows rules agreed in advance: systems in scope, time windows, exclusions. Flaws are validated in a controlled way, to demonstrate the risk without harming your activities.

We think we are under attack. What should we do?

Disconnect the affected devices from the network without turning them off, delete nothing, then change the passwords involved from a clean device. Then write to us through our contact form. Our guide What to do in the first hour walks through these steps.

Do you only work with Microsoft 365 and Azure?

Our cloud expertise is focused on Microsoft 365 and Azure. Our penetration tests and audits also cover your internet-facing systems, your internal network and your web applications.

Does Law 25 apply to my business?

It covers businesses that collect, use or disclose personal information in Québec, whatever their size. See our Law 25 summary for the main obligations.

Do you work with small businesses?

Yes. We support SMBs as well as large organizations, with recommendations that fit your size, your tools and your constraints.

Need help or a security audit?

Tell us about your environment and we will tell you where to start.

Contact us