Security expertise, without the full-time hire.
We help Canadian small and mid-sized organizations understand their real risk, fix what matters first, and prove to customers, insurers and regulators that security is under control.
Services
Start with one engagement or combine them into an ongoing security program. Everything is scoped to what a lean team can realistically operate.
Cybersecurity Posture Assessment
A structured review of where you actually stand — mapped to a recognized framework, scored, and prioritized by risk and effort.
- Interviews, config review and evidence gathering
- Gap analysis vs. CIS Controls / NIST CSF
- Risk-ranked findings with owners and effort estimates
- Executive summary plus a 12-month roadmap
Security Policies & Documentation
Policies your team will actually follow — written for your environment, not copied from a template pack.
- Information security, acceptable use, access control
- Incident response and business continuity plans
- Data classification, retention and privacy (PIPEDA)
- Vendor / third-party risk management
Virtual CISO (vCISO)
Senior security leadership on a fractional basis — a few days a month instead of a six-figure salary.
- Security strategy, budget and roadmap ownership
- Board and executive reporting
- Customer security questionnaires and RFP support
- Oversight of MSPs, vendors and internal IT
Security Best Practices & Hardening
Practical implementation guidance for the controls that stop the majority of real-world incidents.
- Microsoft 365 / Google Workspace hardening
- MFA, identity and privileged access
- Backup, patching and endpoint baselines
- Network segmentation and remote access review
Incident Readiness & Response Planning
Know who does what before something goes wrong — and practise it while the stakes are low.
- Incident response plan and contact tree
- Tabletop exercises (ransomware, BEC, data loss)
- Breach notification and reporting obligations
- Post-incident review and lessons learned
Security Awareness & Compliance Support
Build the habits and the evidence trail that auditors, insurers and enterprise clients ask for.
- Staff awareness sessions and phishing simulations
- SOC 2 / ISO 27001 readiness gap assessments
- Cyber insurance application support
- Evidence collection and control documentation
How it works
No lengthy sales process. Most engagements move from first call to delivered report in three to five weeks.
Discovery call
Thirty minutes to understand your environment, your obligations and what's driving the conversation.
Fixed-scope proposal
A clear statement of work with deliverables, timeline and a fixed price. No open-ended hourly billing.
Assess & document
We gather evidence, interview your people, review configurations and write everything up in plain language.
Roadmap & support
You get a prioritized plan you can execute. Ongoing vCISO support is available if you want help driving it.
Why work with us
Most security advice aimed at smaller organizations is either a sales pitch for a product or a 200-page report nobody reads. We do neither.
Our work is vendor-neutral: we don't resell tools, so the recommendations you get are the ones that fit your budget and your team's capacity. Findings come with an owner, an effort estimate and a reason it matters to your business — not a CVSS score in isolation.
We work with Canadian organizations that have real obligations — PIPEDA, provincial privacy law, client security reviews, cyber insurance requirements — but not the headcount to run a security function on their own.
Typical clients
- Professional services firms handling client data
- Healthcare and clinic operators under PHIPA
- SaaS companies facing enterprise security reviews
- Manufacturers and logistics with OT/IT exposure
- Non-profits and associations with limited IT staff
- Companies renewing or applying for cyber insurance
Book a free consult
Tell us a little about your situation and we'll get back to you within one business day. There's no charge for the first conversation and no obligation afterward.
We serve clients across Canada, remotely and on-site where practical. Your details are used only to respond to your enquiry.
info@cybersecurityhelp.ca
To speed things up, include:
- Roughly how many staff and locations you have
- Whether you run Microsoft 365, Google Workspace, or both
- What's prompting this — a client questionnaire, an insurance renewal, an audit, or a recent scare
- Any deadline you're working against