Blog
Cybersecurity, explained for local businesses
Practical guides on audits, Law 25, threats and good practices. Sourced, without needless jargon.
Bill C-8 and the CCSPA: What It Means for Canadian Suppliers
Bill C-8 is law, and the CCSPA will push cyber security obligations down the supply chain. What telecom, bank and transport suppliers should prepare now.
6 min read
Brand Impersonation: How to Spot and Take Down a Fake Website
Look-alike domains, cloned websites, fake Facebook pages: how to detect brand impersonation targeting your business and get a fake site taken down.
5 min read
Business Continuity Plan After a Cyberattack: A Template
Critical processes, RTO and RPO, manual workarounds: a practical business continuity plan template so your small business keeps serving clients after an attack.
6 min read
Business Email Compromise and CEO Fraud: How to Stop It
Fake CEO, fake supplier, diverted payroll: how business email compromise works, what it costs Canadian small businesses and the simple controls that stop it.
5 min read
Business IoT Security: Cameras, Alarms and Smart Devices
Cameras, alarms, thermostats: default passwords, firmware, network segmentation, cloud accounts and vendor remote access. A practical small business guide.
5 min read
Business Travel Cybersecurity: What to Do Before You Leave
Public Wi-Fi, border device searches, MFA abroad, lost laptops: the cybersecurity rules to follow before, during and after every business trip.
5 min read
Business Wi-Fi Security: WPA3, Guest Networks and 802.1X
WPA2 or WPA3, Personal or Enterprise mode, guest networks and smart devices: a step-by-step guide to business Wi-Fi security for Canadian small businesses.
5 min read
CPCSC Certification: A Practical Guide for Defence Suppliers
CPCSC certification explained: the 3 levels, the 13 Level 1 controls and a practical plan for Montréal aerospace suppliers bidding on Canadian defence work.
5 min read
Clicked a Phishing Link? What to Do in the Next 15 Minutes
Clicked on a phishing link? The steps to take right now, depending on what happened next: a click, a typed password, an opened attachment or bank details.
5 min read
Confidentiality Incident Register: A Law 25 Template
The confidentiality incident register Québec’s Law 25 requires: the 8 mandatory fields, a copy-ready template, filled-in examples and retention rules.
5 min read
Construction Company Cybersecurity: Payment Fraud and Job Sites
Payment redirection, hacked email, job site tablets and bid documents: how a Canadian construction company can stop the fraud that targets it most.
5 min read
Cyber Insurance Questionnaire: How to Answer It Right
Cyber insurance questionnaire: the controls insurers check (MFA, EDR, backups), the traps that put coverage at risk and the evidence to gather before you sign.
5 min read
CyberSecure Canada Certification: Is It Worth It for an SMB?
CyberSecure Canada certification explained: what the CAN/DGSI 104 standard requires, how the audit works, its limits, and which businesses actually benefit.
5 min read
Cyberattack: Who to Notify in Canada, and in What Order
Hit by a cyberattack? Who to notify in Canada (insurer, bank, police, CAI, OPC, clients, Cyber Centre), in what order and under which law, step by step.
5 min read
Cybersecurity Statistics for Quebec and Canada (2026)
Cyberattacks on small businesses, costs, privacy incidents reported to the CAI, fraud losses, recovery times: verified, sourced figures for Quebec and Canada.
7 min read
Cybersecurity for Accounting Firms: Surviving Tax Season
Fake CRA messages, targeted EFILE accounts, tax slips sent by email: what CPA rules require and the security measures an accounting firm should put in place.
6 min read
Cybersecurity for Healthcare Clinics in Quebec: What to Do First
Quebec's health information act, Law 25, EMRs and ransomware: the legal duties and the priority cybersecurity measures for a private healthcare clinic.
5 min read
Cybersecurity for Law Firms and Notaries in Quebec
Codes of conduct, record-keeping rules, trust accounts and Law 25: what Quebec's professional orders expect from lawyers and notaries on cybersecurity.
5 min read
Cybersecurity for Quebec Municipalities: Access Act and Law 25
Quebec municipalities fall under the Access Act, as modernized by Law 25, not the private-sector law: security duties, incident rules and practical priorities.
5 min read
Cybersecurity for Real Estate and Mortgage Brokers in Quebec
Wire fraud before closing, ID documents, OACIQ and AMF rules: the cybersecurity measures that matter most for real estate and mortgage brokers in Quebec.
6 min read
Cybersecurity for Trucking and Logistics Companies
Telematics and ELD accounts, dispatch email fraud, fuel cards, connected warehouses: the cyber risks for carriers and logistics firms, and what to do first.
5 min read
Cybersecurity for Web and Marketing Agencies: Client Access
Pages, ad accounts, CMS, DNS: how a web or marketing agency protects its clients' access with least privilege, shared vaults and a clean offboarding process.
5 min read
Deepfake Voice Fraud: How to Protect Your Business
A call from the 'CEO' demanding an urgent wire transfer? Call-backs to known numbers, code words and dual approval: how to stop deepfake voice fraud at work.
5 min read
Does Microsoft 365 Back Up Your Data? What Businesses Should Know
Recycle bins of 14 to 93 days, retention, Microsoft 365 Backup: what Microsoft actually protects, and when your business needs a real Microsoft 365 backup.
5 min read
Employee Offboarding Checklist: Revoking Access Properly
Accounts, sessions, devices, shared passwords and vendor portals: a complete employee offboarding checklist so no access outlives an employee's last day.
5 min read
External vs Internal Penetration Test: Which Comes First?
External vs internal penetration test: what each reveals, typical cost ranges and which to start with for your small business, plus a prep checklist.
5 min read
Generative AI Data Leaks: A Business Guide to ChatGPT and Copilot
How generative AI data leaks really happen with ChatGPT and Copilot, what Quebec's Law 25 requires, and a usage policy checklist your business can adopt.
5 min read
Google Workspace Security Audit: 12 Settings to Check
A Google Workspace security audit checklist for small businesses: super admins, 2-Step Verification, Gmail, Drive sharing and third-party app access.
6 min read
How to Choose a Cybersecurity Audit Firm in Quebec: 12 Criteria
Written authorization, methodology, sample report, retest, fixed price, independence: 12 vendor-neutral criteria for choosing a cybersecurity audit firm.
6 min read
How to Deploy a Business Password Manager, Step by Step
Selection criteria, shared vaults, a pilot group, the master passphrase and employee offboarding: a practical plan to deploy a business password manager.
5 min read
How to Evaluate Your IT Provider's Security: 12 Questions
Your managed IT provider holds the keys to your business. Here are 12 questions to ask, what a good answer looks like, and what to put in the contract.
5 min read
How to Read a Penetration Test Report (Without Being Technical)
How to read a penetration test report: the executive summary, CVSS severity, attack chains, and how to turn findings into an action plan your team will follow.
5 min read
How to Secure Your Business Social Media Accounts
Hijacked Facebook page, an ex-employee still on LinkedIn, an agency with too much access: how to secure your small business's social media accounts.
5 min read
How to Secure Your Business WordPress Site: The Checklist
Plugin updates, two-factor authentication, a web application firewall, tested backups: a practical checklist to secure your small business WordPress site.
6 min read
How to Spot a Phishing Email: 5 Canadian Examples Decoded
Fake CRA e-Transfers, Canada Post parcel fees, Hydro-Québec refunds: five phishing examples broken down, plus the warning signs to check before you click.
6 min read
ISO 27001 vs SOC 2: Which One Should Your SMB Choose?
ISO 27001 vs SOC 2: certification versus attestation report, the real effort for an SMB, what buyers in Canada, the U.S. and Europe expect, and where to start.
5 min read
Incident Response Plan Template for Small Businesses
An incident response plan template for small businesses: roles, response phases, a call tree and privacy obligations under Law 25 and PIPEDA, ready to use.
5 min read
Information Security Policy Template for Small Business
A 12-section information security policy template you can adapt, who should sign it, how it ties into Quebec's Law 25 and PIPEDA, and the mistakes to avoid.
5 min read
Law 25 Breach Notification: Reporting an Incident to the CAI
When and how to report a confidentiality incident to Québec’s CAI under Law 25, minus the 72-hour myth: harm assessment, notice content and next steps.
5 min read
Law 25 Privacy Policy: Required Content and a Template
Quebec Law 25 privacy policy: who must publish one, what it must contain under ss. 8, 8.1 and 8.2, a template outline to adapt, and the mistakes to avoid.
6 min read
Manufacturing OT Cybersecurity: A Practical IEC 62443 Plan
Purdue model, IEC 62443 zones and conduits, integrator remote access: a realistic manufacturing OT cybersecurity plan for small and mid-sized plants.
5 min read
Microsoft 365 Security Audit: 15 Settings to Check
A Microsoft 365 security audit checklist: 15 settings to verify (MFA, admin roles, forwarding, external sharing, audit logs) to stop phishing and payment fraud.
5 min read
Microsoft Copilot Oversharing: What to Fix Before You Deploy
Copilot respects your permissions, even overly broad ones. SharePoint reports, Restricted Content Discovery, sensitivity labels, Law 25: 8 steps before rollout.
5 min read
NIST CSF 2.0 for Small Business: The Six Functions Explained
NIST CSF 2.0 explained for Canadian small businesses: the six functions including Govern, the NIST quick-start guide and how to build a target profile.
5 min read
Nonprofit Cybersecurity in Quebec: Small Budgets, Real Risks
Volunteers, shared accounts, online donations and Law 25: the cybersecurity priorities for a Quebec nonprofit, with a checklist built for tight budgets.
5 min read
PCI DSS 4.0.1 for Small Businesses That Accept Cards
PCI DSS 4.0.1 for Canadian small businesses: which SAQ to fill out, what became mandatory on March 31, 2025, and how to shrink your compliance scope.
6 min read
Passkeys for Business: A Practical Deployment Guide
Microsoft 365 or Google Workspace: how to roll out passkeys in your small business step by step, from pilot group to recovery, without locking anyone out.
5 min read
Patch Management Policy for Small Businesses: SLAs That Work
Patch deadlines by severity, how to prioritize exploited flaws, handling exceptions and tracking results: a practical patch management policy for SMBs.
5 min read
Penetration Test Authorization Letter: What It Must Include
Criminal Code, scope, dates, permitted techniques, emergency contacts, data, cloud rules: what a penetration test authorization letter must include in Canada.
5 min read
Penetration Testing Cost in Canada: A Plain-English Guide
What a penetration test is, the main types, indicative Canadian price ranges and the red flags to watch for when comparing pentest quotes for your business.
5 min read
Phishing Simulation for Employees: Train Without Trapping
Phishing simulation for employees: plan a campaign, pick realistic scenarios, track the report rate and train staff without shaming them. A practical SMB guide.
5 min read
Phishing-Resistant MFA: Why SMS Codes Are No Longer Enough
Text codes, push prompts, FIDO2 keys or passkeys? Compare multi-factor authentication methods and choose phishing-resistant MFA that attackers can't relay.
5 min read
Privacy Impact Assessment in Québec: Adding the Security Lens
Privacy impact assessments under Québec’s Law 25: when a PIA is mandatory, how to build security into it and how to score risks, with an SMB example.
5 min read
QR Code Phishing (Quishing): How to Spot It and Stay Safe
Fake QR codes on parking machines, emails that say 'scan to reactivate your MFA': how to recognize quishing and protect your small business and your staff.
5 min read
Quebec Law 25 Compliance Checklist: The Cybersecurity Side
A practical Quebec Law 25 compliance checklist for SMBs: governance, access control, technical safeguards, incident handling and vendors, mapped to the Act.
6 min read
Quebec Law 25 Fines and Penalties: How the CAI Enforces It
Quebec Law 25 fines: up to $10M in administrative penalties and $25M in penal fines. How the CAI sets amounts, its other powers and how to reduce your risk.
6 min read
Quebec Law 25 and Cookies: What Your Website Must Do
Quebec Law 25 cookie rules explained: what section 8.1 and the CAI require, which cookies must be off by default, and how to set up a fair consent banner.
6 min read
Quebec Law 25 for Small Business: Where to Start (30-Day Plan)
Quebec Law 25 for small business: a 30-day plan to name your privacy officer, prepare for incidents, fix your website and adopt your governance policies.
5 min read
Québec Privacy Officer Under Law 25: The Security Role
The privacy officer role under Québec’s Law 25, from a security angle: default holder, written delegation, security duties, a quarterly dashboard and template.
5 min read
Ransomware Attack on a Small Business: Anatomy, Step by Step
From a forgotten VPN account to Friday-night encryption: how a ransomware attack on a small business really unfolds, and where to stop it at each stage.
6 min read
Ransomware: What to Do in the First 24 Hours, Hour by Hour
Hit by ransomware? What to do in the first 24 hours: isolate, call your insurer, preserve evidence and notify the right people, in the right order.
5 min read
Remote Work Security for Businesses: A Practical Guide
Devices, remote access, home Wi-Fi, fraud and Quebec's Law 25: the concrete steps that keep remote work security tight in a hybrid small business.
5 min read
Retail and E-commerce Cybersecurity: Securing Store and Site
Payment terminals, online stores, PCI DSS 4.0.1, gift card fraud and customer data: a practical retail cybersecurity plan for Canadian small businesses.
6 min read
SPF, DKIM and DMARC Explained for Small Businesses
SPF, DKIM and DMARC explained in plain English, with real DNS record examples, the Gmail, Yahoo and Outlook sender rules, and a rollout plan for your domain.
5 min read
Security Audit vs Pentest vs Vulnerability Scan: Which One?
Security audit, penetration test or vulnerability scan? The real differences, what each one delivers and the order that makes sense for a growing business.
5 min read
Small Business Cybersecurity Audit: Steps, Timeline and Cost
What a cybersecurity audit for a Quebec small business involves: the five steps, a realistic timeline, what drives the cost and how to prepare for it.
6 min read
Small Business Cybersecurity Budget: What to Fund First
How much should a small business spend on cybersecurity? A tiered method to build a realistic budget, prioritize spending and get buy-in from leadership.
5 min read
Tabletop Exercise for Small Business: A Ready-to-Run Script
A ready-to-run ransomware tabletop exercise for your small business: roles, a two-hour agenda, timed injects, questions to ask and the after-action report.
6 min read
The 3-2-1-1-0 Backup Rule: Backups That Survive Ransomware
Three copies, two media, one offsite, one immutable, zero errors: the 3-2-1-1-0 backup rule explained for small businesses that need to survive ransomware.
5 min read
Vendor Banking Change Fraud: How It Works and How to Stop It
A supplier emails new banking details? What to do if the payment already went out, how vendor banking change fraud works and the simple process that stops it.
5 min read
Web Application Penetration Test and the OWASP Top 10 (2025)
Web application penetration testing explained: the OWASP Top 10 2025 in plain English, how a test runs and how to prepare your customer portal or online store.
5 min read
Windows 10 End of Support: What Businesses Should Do in 2026
Windows 10 support ended on October 14, 2025. Extended Security Updates, real costs and the move to Windows 11: a practical 2026 plan for small businesses.
5 min read
Zero Trust for Small Business, Explained Without the Jargon
What zero trust really means for a small business: the NIST and Cyber Centre principles in plain English, plus a five-step roadmap you can start this quarter.
5 min read