Case studies
Three situations we see often
These typical scenarios describe fictional companies, built from situations common among Québec SMBs. They show concretely what we look for, what we find and what we fix.
Typical scenarios: the companies are fictional. As soon as our founding clients allow it, real case studies will be added here.
01 · Accounting firm Typical scenario
A fake invoice sent from the firm’s real address
Laval · 18 employees · Microsoft 365
Go further
The situation
In the middle of tax season, a client receives a payment request that appears to come from the firm’s exact address. They call before paying. The partner wants to understand how this is possible, and make sure it doesn’t happen again.
What the audit reveals
- DMARC in monitor mode: anyone can send “from” the domain.
- Four accounts without multi-factor authentication, including an admin.
- An automatic forwarding rule to an external address, left over from a former employee.
What we do
- Flash audit, then a read-only Microsoft 365 audit (2 days).
- MFA for everyone, separate admin accounts, legacy authentication blocked.
- DKIM for every sender, then DMARC all the way to reject.
- A short payment-fraud training for the team.
The intended result
The domain can no longer be spoofed, accounts are protected, and the firm answers its insurance questionnaire accurately.
02 · Clinic Typical scenario
Patient files and a single backup copy
Montréal · 12 employees · clinic management software
Go further
The situation
The clinic is switching booking software and wonders what the law requires for health information. The manager wants a clear picture, without jargon.
What the audit reveals
- Backups on a device plugged into the same network, never tested.
- Reception workstations shared with one common password.
- No confidentiality incident register.
- No privacy impact assessment for the new software.
What we do
- A one-hour on-site visit, then an organizational and technical audit.
- Individual accounts and automatic screen locking.
- An immutable backup copy and a restore test.
- Incident register and assessment support, with the clinic’s legal counsel.
The intended result
The clinic knows what applies to it, can resume operations after an incident, and documents its decisions.
03 · Manufacturer Typical scenario
A prime contractor requires a cybersecurity certification
South Shore · 85 employees · shop floor and offices
Go further
The situation
An aerospace client announces that suppliers will have to demonstrate their cybersecurity level in upcoming contracts. The operations director wants to know where they stand and what to do first.
What the audit reveals
- Shop-floor and office networks not separated.
- An equipment vendor’s remote access still open.
- Security policies missing or undocumented.
What we do
- Gap analysis against the targeted certification program requirements.
- External penetration test with written authorization, then a retest.
- A segmentation plan between business IT and industrial equipment.
- Baseline policies and monthly support.
The intended result
A realistic roadmap to meet the client’s requirements, with documented evidence at every step.
Does your situation look like one of these? Let’s talk.