You know cybersecurity matters, but you are not sure where your business actually stands. Do your backups really work? Does the employee who left last fall still have access to anything? Would your insurer take your answers at face value? A cybersecurity audit answers these questions with facts instead of guesswork.
Our team looks at both the organization (who decides, who is accountable, what rules exist) and the technology (configurations, accounts, devices, network). The result is a clear picture of what is working, what needs fixing, and in what order.
What we review
| Area | What we look at |
|---|---|
| Governance | Roles and responsibilities, existing policies, asset inventory, oversight of IT vendors |
| Accounts and access | Multi-factor authentication, admin accounts, employee offboarding, shared passwords |
| Email security | SPF, DKIM and DMARC, anti-phishing filtering, suspicious forwarding rules |
| Backups | Actual coverage, offline or immutable copy, real restore tests |
| Endpoints | Patching, antivirus or EDR, disk encryption, personal devices |
| Network perimeter | Firewall, remote access (VPN), internet-facing services, guest Wi-Fi |
| Law 25 | Safeguards for personal information, incident register, incident procedure |
Each area is assessed against recognized best practices, such as the baseline controls recommended by the Canadian Centre for Cyber Security, then scaled to the real size of your business. We won't recommend an enterprise-grade solution for a 15-person office in Laval.
For a closer look at how an engagement unfolds, read our guide to cybersecurity audits for small businesses.
The report you receive
A good report is one that actually gets read. Ours is written in plain English (or French, if your team prefers) and speaks to leadership first.
- An executive summary: your overall risk level and your top three to five priorities, in business terms.
- Ranked findings: for each one, the concrete risk ("a fraudster could pose as your accounts payable team"), the evidence we observed and the recommended fix.
- A roadmap: quick wins for this month, medium-term projects, and items to plan for in next year's budget.
- A technical appendix: the details your IT provider needs to get to work.
A fixed-price quote, before we start
After the scoping call, you receive a fixed-price quote that spells out the scope, timeline and deliverables. No open-ended hourly billing, no surprises at the end.
Why small businesses need one
According to a 2025 study by insurer Coalition, 77% of Canadian small businesses believe they are too small to be targeted, yet 86% had experienced a cybersecurity event in the last five years. Attackers don't pick victims by size; they look for open doors.
An audit also helps on three practical fronts:
- Cyber insurance: insurers are asking increasingly specific questions about multi-factor authentication, backups and patching. Better to know your answers before you sign.
- Law 25: Quebec's privacy law requires reasonable security measures to protect personal information. The audit documents where you stand.
- Your clients: more and more large customers ask their suppliers for evidence of good security practices.
Audit, pentest or scan: which one?
An audit gives you the big picture, covering people and processes as well as technology. A penetration test simulates a real attack against a specific target. For most small businesses, the audit is the right starting point; a pentest then validates the most critical systems. Our article on security audits vs. pentests vs. vulnerability scans breaks down the differences.
We work remotely or on site anywhere in Quebec, from Montréal to the Eastern Townships and beyond. And if you'd rather ease into it, the free quick audit gives you a first look at your internet exposure, with no commitment.