The CyberBay blog
How we work, explained in detail, with the commands to check for yourself.
Security alert
Our take on the news that directly affects your systems, explained in plain language.
Series: AI security
A four-part series on securing your AI assistants, agents and applications: our methodology, the top ten risks, governance in Québec and Canada, and AI penetration testing. To wrap up, a quiz to test your knowledge.
Our methodology for securing an AI system
How we assess the security of a generative AI assistant, agent or application: inventory, threat modelling, controls, testing and deliverables.
Read the article Risks · 2/4The top ten risks of generative AI applications
The OWASP Top 10 for LLM Applications 2026 explained in plain language, with concrete examples and the measures that actually reduce the risk.
Read the article Governance · 3/4AI governance: frameworks and obligations in Québec and Canada
NIST AI RMF, ISO/IEC 42001, Law 25, Bill C-36 and the EU AI Act: what applies to your organization and where to start.
Read the article Penetration testing · 4/4Penetration testing an AI system, step by step
Prompt injection, jailbreaks, data exfiltration and tool abuse: how an AI penetration test runs, what gets tested and what you receive.
Read the article Quiz · 5 questionsTest your AI security knowledge
Five questions on AI security: prompt injection, agents, poisoning, governance and Law 25, with explained answers.
Take the quizSeries: Microsoft 365 audit
A four-part series on our Microsoft 365 tenant audit methodology: the principles, then identity, the email domain and logging, with read-only commands to run in your own environment.
Our Microsoft 365 tenant audit methodology
How we audit a Microsoft 365 tenant: principles, scope, read-only data collection, finding prioritization and deliverables.
Read the article Identity · 2/4Microsoft 365 audit: identity and access
Check global administrators, MFA, legacy authentication, guest accounts and application consent in Microsoft 365 yourself.
Read the article Email · 3/4Microsoft 365 audit: protecting your email domain
Check SPF, DKIM and DMARC from the command line, interpret the results and protect domains that never send email.
Read the article Logging · 4/4Microsoft 365 audit: logging
Check that the unified audit log and mailbox auditing are on, know the retention periods and spot suspicious forwarding rules.
Read the articleWant your Microsoft 365 tenant audited?
We apply this methodology in your environment, read-only, and hand you a prioritized action plan.