Serious cybersecurity audits for Québec businesses
Audits, penetration testing and Law 25 compliance, carried out by experts you actually meet. A clear report, a fixed price before we start, and remediation on quote.
Greater Montréal: we come to you, free of charge, to talk it through. Book a visitStrict SPF
v=spf1 include:_spf.google.com -all
DMARC in monitor-only mode
p=none: spoofed email gets through
Valid certificate
TLS 1.3 · expires in 74 days
No Content-Security-Policy
No protection against script injection
Our work is grounded in recognized frameworks
Our method- Loi 25
- OWASP Top 10
- NIST CSF 2.0
- CIS Controls
- ISO/IEC 27001
- SOC 2
- CPCSC
- MITRE ATT&CK
- CVSS 4.0
- Microsoft 365
- Google Workspace
- CAN/DGSI 104
Tools make us fast. Judgment comes from a person who takes the time to understand your business. You talk to the expert who performs your audit, from the first call to the retest.
Tuesday · 10:00 – 11:00 a.m.
Your office, Montréal
- 1.Understand your business and your tools
- 2.Walk-through: network, Wi-Fi, workstations, backups
- 3.Leave with your top three priorities
Free in Greater Montréal
A meeting at your office
In Montréal and the surrounding area, we come to you: that’s often where you see what no tool can detect.
One point of contact
The person you meet is the one who performs the audit and presents the results.
Results explained in person
We walk your leadership and your IT provider through the report and answer their questions.
Your team trained on-site
Short sessions on phishing and good habits, tailored to your reality.
See what you get, before you decide
No vague promises: a complete sample report and concrete scenarios, freely available.
Audit report · sample
Example CPA Firm Inc.
Sample report
A complete report written for a fictional company: summary, findings, evidence, roadmap.
Case studies
Three typical scenarios: what the audit reveals and what we fix.
Founding clients program
10 spots, on preferential terms
We are starting out and want to build our reputation on real results. The first businesses that trust us get preferential terms. In return, if you are satisfied once the engagement is over, you agree to provide a testimonial and let us show your logo on our site. No obligation if you are not.
Discuss it for freeInterviews, configuration review and technical checks. Within days you get a picture of your risks and a roadmap ranked by priority and effort.
Organizational and technical audit
Governance, access, email, backups, endpoints, network perimeter and Law 25 controls.
Executive summary
- 1Enable MFA on administrator accountsCritical
- 2Test a full backup restoreHigh
- 3Move DMARC from p=none to p=rejectMedium
Executive summary
One page, three priorities, a cost ballpark. Everything else lives in the technical appendix.
Accounts and access
MFA, admin accounts, employee offboarding, vendor access.
SPF, DKIM, DMARC, forwarding rules and phishing protection.
Backups
Offline or immutable copies, and a real restore test.
Endpoints and network
Patching, EDR, Internet-facing services, segmentation.
Manual exploitation within a signed framework: rules of engagement, written authorization and an agreed test window. Every test includes a retest after remediation.
External test
What the whole Internet sees: website, portals, email, remote access, forgotten services.
port service finding 443 https TLS 1.0 accepted 3389 rdp exposed to the Internet 8443 admin-panel default login page
Web application
Customer portal, store, line-of-business app. OWASP method: access control, sessions, injection, business logic.
GET /api/invoices/1043 Authorization: Bearer <customer B> HTTP/1.1 200 OK ← customer A’s invoice
Internal test
The compromised-laptop scenario: how far can an attacker get inside your network? Performed on-site.
laptop-042 → share \\files\accounting
→ service account (clear-text password)
→ domain administratorCompliance
Law 25, cyber insurance and federal requirements
We cover the security side of the obligations affecting local businesses, working alongside your legal counsel or broker.
A controlled method
Passive first
The flash audit only reads public information. No active testing without a mandate.
Written authorization
Signed rules of engagement before any penetration test (Criminal Code, s. 342.1).
Retest
After your fixes, we verify again. The engagement ends when it’s resolved.
The Québec context
All statisticsA Québec company
From here, for businesses here
A team of enthusiasts based in downtown Montréal. We work French-first (English too), within Québec’s legal framework: on-site in Greater Montréal, remotely everywhere else in Québec. Our reports are written to be read by leadership, not just technicians.
Montréal · Laval · Longueuil · Brossard · Boucherville · Terrebonne · Blainville · Repentigny · Vaudreuil-Dorion · Saint-Jean-sur-Richelieu
Latest articles
Small Business Cybersecurity Audit: Steps, Timeline and Cost
What a cybersecurity audit for a Quebec small business involves: the five steps, a realistic timeline, what drives the cost and how to prepare for it.
6 min read
Quebec Law 25 Compliance Checklist: The Cybersecurity Side
A practical Quebec Law 25 compliance checklist for SMBs: governance, access control, technical safeguards, incident handling and vendors, mapped to the Act.
6 min read
SPF, DKIM and DMARC Explained for Small Businesses
SPF, DKIM and DMARC explained in plain English, with real DNS record examples, the Gmail, Yahoo and Outlook sender rules, and a rollout plan for your domain.
5 min read
Frequently asked questions
How much does a cybersecurity audit cost for a small business?+
Price depends on headcount, systems and depth. After a free scoping meeting, you get a fixed-price quote.
Can you come to our office?+
Yes. In Montréal, Laval, Longueuil, Brossard and the surrounding area, an expert comes to you free of charge for a first meeting of about 60 minutes. Elsewhere in Québec, we work remotely or on-site on quote.
Is the flash audit really free?+
Yes. It’s an automated passive scan of your domain (email, HTTPS, headers, DNS) plus a maturity self-assessment. No commitment.
Do we need to give you access to our systems?+
Not for the flash audit. For a full audit, read-only access is usually enough. A penetration test always requires written authorization and signed rules of engagement.
Are you lawyers for Law 25?+
No. We cover the information-security side and concrete measures, and work alongside your legal counsel for interpretation.
What happens after the audit?+
We walk you through the report in person. Fix it yourself, with your IT provider, or have us handle remediation on quote. A retest then confirms everything is resolved.
Start with a free audit
Thirty seconds to see what your domain exposes publicly. Then we talk, by phone or at your office.