Services

Our services

Cybersecurity expertise to protect your business. For each service: what is covered, how the engagement runs and what you receive.

Artificial intelligence security

Your AI assistants, agents and applications read your data and can act on your behalf. We test them the way an attacker would, put the right guardrails around them and train your teams to use them safely.

What is covered

  • AI penetration testing: prompt injection, jailbreaks, data leakage
  • Security of agents, their tools and their permissions
  • Retrieval-augmented generation (RAG) and document access
  • Governance: usage policy, NIST AI RMF, ISO/IEC 42001, Law 25
  • AI security training and awareness

How it works

  1. Inventory of AI uses and scoping
  2. Threat modelling and control review
  3. Controlled adversarial testing
  4. Report, fixes and retest

Deliverables

  • Executive summary
  • Findings backed by reproducible evidence
  • Remediation plan and recommended guardrails
  • Training material for your teams

To learn more, read our methodology or test your AI security knowledge.

Pentest and penetration testing

A full analysis of your systems to detect vulnerabilities. We take the attacker’s point of view to find the flaws before they are exploited.

What is covered

  • Internet-facing systems
  • Internal network
  • Web applications
  • Risky configurations and access

How it works

  1. Scoping: scope, rules and schedule
  2. Reconnaissance and vulnerability discovery
  3. Controlled validation of the flaws
  4. Report and presentation of results

Deliverables

  • Executive summary
  • Technical detail for each vulnerability
  • Clear report with prioritized fixes

Microsoft 365 and Azure security

Identity hardening, MFA, Conditional Access, Zero Trust. We cut down the paths an attacker could take through your cloud environment.

What is covered

  • Multi-factor authentication (MFA)
  • Conditional Access policies
  • Privileged accounts and legacy protocols
  • Logging and a Zero Trust approach

How it works

  1. Review of the current configuration
  2. Prioritized hardening plan
  3. Implementation with your team
  4. Validation of the applied settings

Deliverables

  • Current state of your environment
  • Prioritized recommendations
  • Documented configurations

Incident response

Immediate assistance in the event of an attack, ransomware or compromise. The goal: limit the damage, understand what happened and get back on a stronger footing.

What is covered

  • Compromised accounts and mailboxes
  • Ransomware
  • Intrusions into your cloud environment

How it works

  1. Containment of the threat
  2. Analysis of the compromise
  3. Recovery
  4. Hardening to prevent a repeat

Deliverables

  • Timeline of the incident
  • Findings and identified causes
  • Recommended hardening measures

An incident in progress? Read what to do in the first hour, then write to us.

Audit and compliance

An assessment of your practices against modern security standards. You know where you stand, what is missing and in what order to act.

What is covered

  • Review of configurations and practices
  • Identity and access management
  • Data protection and backups

How it works

  1. Information gathering and interviews
  2. Gap analysis against the standards
  3. Prioritization based on real risk
  4. Presentation of the roadmap

Deliverables

  • Picture of your security posture
  • Gaps against the standards
  • Prioritized roadmap

Virtual CISO

An experienced security leader, a few days a month. For organizations that need security leadership without creating a full-time position.

What is covered

  • Security strategy and roadmap
  • Risk management and priorities
  • Policies, standards and vendor oversight
  • Reporting to management and the board

How it works

  1. Starting point and objectives
  2. 12-month roadmap
  3. Monthly follow-up meetings
  4. Quarterly review and adjustment

Deliverables

  • Security roadmap
  • Dashboard for management
  • Up-to-date policies and risk register

Security awareness and phishing simulations

Your employees are attackers’ first target. We train them to spot the traps and measure progress with realistic simulations.

What is covered

  • Safe use of generative AI at work
  • Short training sessions tailored to your reality
  • Phishing simulations adapted to your industry
  • CEO fraud and impersonation
  • Good reporting habits

How it works

  1. Baseline measurement
  2. Team training
  3. Periodic simulation campaigns
  4. Results tracking and targeted reminders

Deliverables

  • Click and reporting rates per campaign
  • Progress report for management
  • Quick-reference guide for employees

Cybersecurity training

Practical training for your IT teams, managers and leadership. Delivered in French or English, online or in person, by certified instructors who practice cybersecurity every day.

What is covered

  • AI security for IT teams and developers
  • Technical training for IT and security teams
  • Preparation for recognized certifications (e.g. CEH, CISSP)
  • Workshops for managers and boards of directors
  • Hands-on Microsoft 365 and Azure security

How it works

  1. Assessment of your needs and participants’ level
  2. Program tailored to your context
  3. Interactive training with hands-on exercises
  4. Evaluation and follow-up

Deliverables

  • Training materials for participants
  • Certificate of attendance
  • End-of-training report and recommendations

Express security assessment

A quick picture of your security, at a fixed price. The right starting point for a small business that wants to know where it stands without committing to a long engagement.

What is covered

  • Accounts, access and multi-factor authentication
  • Email and phishing protection
  • Workstations, updates and backups
  • Internet exposure

How it works

  1. Questionnaire and short interview
  2. Targeted technical checks
  3. Analysis and prioritization
  4. Presentation of results

Deliverables

  • Overview of your strengths and weaknesses
  • The ten priority actions
  • Effort estimate for each

Cyber insurance readiness

Insurers and large clients ask increasingly precise questions. We help you answer them accurately and close the gaps that hold up an application.

What is covered

  • Insurer questionnaires
  • Client security questionnaires
  • Common requirements: MFA, backups, response plan
  • Evidence to support your answers

How it works

  1. Review of the questionnaire and requirements
  2. Verification of your actual measures
  3. Correction of priority gaps
  4. Documented answers

Deliverables

  • Completed, substantiated questionnaire
  • Evidence file
  • Plan to close the remaining gaps

Incident response retainer

During an incident, every hour counts. With a retainer, access, contacts and the plan are agreed in advance, so we can act quickly when the time comes.

What is covered

  • Availability agreed by contract
  • Incident response plan
  • Tabletop exercise with your teams
  • Reserved response hours

How it works

  1. Preparation: contacts, access and roles
  2. Writing or updating the plan
  3. Annual tabletop exercise
  4. Response according to the plan if an incident occurs

Deliverables

  • Incident response plan
  • Exercise report and improvements
  • Report after each response

Outsourced privacy officer

Law 25 requires a designated person in charge. We take on that role for you, or support the person who holds it, so your obligations stay up to date.

What is covered

  • Role of person in charge, delegated in writing
  • Confidentiality incident register
  • Privacy impact assessments (PIA)
  • Access and correction requests

How it works

  1. Inventory of personal information
  2. Policies and registers put in place
  3. Handling of requests and incidents
  4. Annual review

Deliverables

  • Governance and privacy policies
  • Up-to-date registers
  • PIA reports

Continuous vulnerability management

New vulnerabilities are published every week. Regular scans find them in your environment, and follow-up makes sure the fixes are actually applied.

What is covered

  • Internet-facing systems
  • Servers and workstations
  • Microsoft 365 and Azure environment
  • Missing patches and risky configurations

How it works

  1. Inventory of assets to monitor
  2. Monthly scans
  3. Triage by actual risk
  4. Patch follow-up through to closure

Deliverables

  • Prioritized monthly report
  • Month-over-month trend
  • Alert when a critical vulnerability appears
Law 25 and compliance

Protecting personal information is an obligation

Québec’s Law 25 modernizes the protection of personal information. It covers businesses that collect, use or disclose that information, whatever their size. Its obligations came into force in three stages.

  1. September 22, 2022

    First obligations

    Designate a person in charge of the protection of personal information, keep a register of confidentiality incidents, and report incidents that present a risk of serious injury to the Commission d’accès à l’information (CAI) and to the people concerned.

  2. September 22, 2023

    Most of the reform

    Governance policies and practices, a confidentiality policy, consent rules, privacy impact assessments (PIAs) and the coming into force of penalties.

  3. September 22, 2024

    Right to data portability

    A person can ask to receive their computerized personal information in a structured, commonly used technological format.

Significant penalties

The law provides for administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4% of worldwide turnover.

What the law expects from you

The main requirements

  • A designated person in charge, with published contact information
  • Security measures that match the sensitivity of the information
  • A register of confidentiality incidents
  • Reporting of incidents that present a risk of serious injury
  • Governance and confidentiality policies
  • An assessment (PIA) for projects involving personal information
Our contribution

The security side, in practice

  • Assess the measures that protect your personal information
  • Secure Microsoft 365 and Azure, where that information is often stored
  • Check your defences with penetration tests
  • Respond to incidents and establish the facts you need for your reporting obligations

This summary is provided for information purposes and is not legal advice. For the interpretation of the law, consult the Commission d’accès à l’information or a legal advisor.

Need help or a security audit?

Tell us about your environment and we will tell you where to start.

Contact us