[{"data":1,"prerenderedAt":240},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"svc-\u002Fen\u002Fservices\u002Fpenetration-testing":45,"svc-alt-\u002Fen\u002Fservices\u002Fpenetration-testing":218,"svc-others-\u002Fen\u002Fservices\u002Fpenetration-testing":220},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"deliverables":167,"description":174,"extension":175,"faq":176,"icon":189,"idealFor":190,"meta":195,"navTitle":10,"navigation":196,"order":11,"path":9,"price":189,"process":197,"rawbody":213,"seo":214,"stem":215,"tagline":216,"translationKey":189,"__hash__":217},"services_en\u002Fen\u002Fservices\u002Fpenetration-testing.md","Penetration Testing for SMBs in Montréal and Québec",{"type":49,"value":50,"toc":157},"minimark",[51,55,58,63,68,71,75,78,87,91,99,103,111,114,133,136,140,143,150],[52,53,54],"p",{},"A penetration test (or pentest) answers a simple question: if someone really wanted to get in, how far would they get? Our team thinks like an attacker and uses real techniques, within strict boundaries you approve in writing.",[52,56,57],{},"Unlike an automated tool, we exploit weaknesses manually, chain them together and measure their concrete impact: access to the CEO's mailbox, client files, the accounting system. You finally know what is serious and what can wait.",[59,60,62],"h2",{"id":61},"three-types-of-tests-depending-on-your-needs","Three types of tests, depending on your needs",[64,65,67],"h3",{"id":66},"external-penetration-test","External penetration test",[52,69,70],{},"We attack from the internet, just as anyone in the world could: your website, portals, email, remote access (VPN, Remote Desktop), firewall and forgotten services. This is the first surface an attacker explores.",[64,72,74],{"id":73},"internal-penetration-test","Internal penetration test",[52,76,77],{},"We start from a compromised workstation or a network jack in your office, the scenario where an employee clicked the wrong link. We then assess what an attacker could reach next: Active Directory, file servers, backups, privileged accounts. Testing is done on site anywhere in Quebec, or remotely through secure access set up with your IT team.",[52,79,80,81,86],{},"Not sure which one you need? Our article on ",[82,83,85],"a",{"href":84},"\u002Fen\u002Fblog\u002Fexternal-vs-internal-penetration-test","external vs. internal penetration tests"," will help you decide.",[64,88,90],{"id":89},"web-application-test","Web application test",[52,92,93,94,98],{},"For your client portal, online store or line-of-business application. We follow OWASP methodology (the Top 10 and the Web Security Testing Guide): access control, authentication, session management, injection and business logic. Testing uses dedicated test accounts, ideally in a staging environment. For more detail, read our article on ",[82,95,97],{"href":96},"\u002Fen\u002Fblog\u002Fweb-application-penetration-test-owasp-top-10","web application pentesting and the OWASP Top 10",".",[59,100,102],{"id":101},"clear-rules-before-the-first-test","Clear rules before the first test",[104,105,108],"callout",{"title":106,"type":107},"No testing without written authorization","warning",[52,109,110],{},"In Canada, using a computer without authorization is an offence under the Criminal Code (s. 342.1). We never begin without an authorization signed by someone with the authority to grant it. If your systems are hosted by a third party, their consent may also be required.",[52,112,113],{},"Before we start, we draft the rules of engagement with you. This document sets out:",[115,116,117,121,124,127,130],"ul",{},[118,119,120],"li",{},"the domains, IP addresses and applications in scope, and those excluded;",[118,122,123],{},"the testing dates and time windows;",[118,125,126],{},"permitted and prohibited techniques (for example, no denial of service);",[118,128,129],{},"emergency contacts on both sides;",[118,131,132],{},"how we protect any data we come across during the engagement.",[52,134,135],{},"Scope and price are locked in a quote before any work begins. No surprise overruns.",[59,137,139],{"id":138},"a-prioritized-readable-report","A prioritized, readable report",[52,141,142],{},"The report speaks to two audiences. Leadership gets a plain-language executive summary: the risk level, the attack scenarios we demonstrated and the priorities. The technical team gets, for each vulnerability, a description, a severity rating, the evidence (screenshots, requests), steps to reproduce it and the recommended fix.",[52,144,145,146,98],{},"Once your fixes are in place, we retest to confirm the gaps are closed, and you receive an attestation letter to share with clients or your insurer. To get the most out of the document, see our guide on ",[82,147,149],{"href":148},"\u002Fen\u002Fblog\u002Fhow-to-read-penetration-test-report","how to read a penetration test report",[52,151,152,153,156],{},"Not ready for a pentest yet? A ",[82,154,155],{"href":5},"cybersecurity audit"," is often the better first step: it lets you fix the obvious issues before paying someone to find them.",{"title":158,"searchDepth":11,"depth":15,"links":159},"",[160,165,166],{"id":61,"depth":11,"text":62,"children":161},[162,163,164],{"id":66,"depth":15,"text":67},{"id":73,"depth":15,"text":74},{"id":89,"depth":15,"text":90},{"id":101,"depth":11,"text":102},{"id":138,"depth":11,"text":139},[168,169,170,171,172,173],"Rules of engagement and a signed authorization letter before any testing begins","A report with an executive summary for leadership and reproducible technical details","Vulnerabilities ranked by severity, with proof of exploitation and a recommended fix","A results walkthrough with your team, your IT provider or your developers","A retest of the vulnerabilities you have fixed","An attestation letter you can share with clients or your insurer","External, internal and web application penetration testing (OWASP) with manual exploitation, a prioritized report and a retest once fixes are in place.","md",[177,180,183,186],{"q":178,"a":179},"Can a penetration test take our systems down?","The risk is low and controlled. Permitted techniques, testing windows and systems to avoid are agreed in advance. The most sensitive tests can be run outside business hours or against a staging environment.",{"q":181,"a":182},"How is a pentest different from a vulnerability scan?","An automated scan produces a list of potential weaknesses, with its share of false positives. A penetration test goes further: a human verifies each weakness, chains them together and shows what an attacker could actually obtain.",{"q":184,"a":185},"Should we tell our employees and our IT provider?","Your IT provider and, where applicable, your hosting provider need to know. Employees don't have to: keeping them unaware lets you see whether the attack gets noticed. We settle this with you during scoping.",{"q":187,"a":188},"How often should we run a penetration test?","Once a year is common practice, along with after any significant change: a new application, a migration, a new remote access service. Some contracts and insurers set their own frequency.","pentest",[191,192,193,194],"A company launching or rebuilding a web application or client portal","An SMB whose client, prime contractor or insurer is asking for a penetration test","An organization that has completed an audit and wants to validate its most critical systems","A business with remote access (VPN, Remote Desktop) exposed to the internet",{},true,[198,201,204,207,210],{"title":199,"text":200},"Scoping and authorization","Together we define the targets, the testing window and the limits. Nothing starts until your written authorization is signed.",{"title":202,"text":203},"Reconnaissance","We map what an attacker would see: exposed services, technologies in use, accounts and entry points.",{"title":205,"text":206},"Manual exploitation","We attempt to exploit the weaknesses we find, by hand, to measure their real impact without disrupting your operations.",{"title":208,"text":209},"Report and walkthrough","You receive a prioritized report, and we review it with your team to plan the fixes.",{"title":211,"text":212},"Retest","Once fixes are applied, we test the vulnerabilities again to confirm they are properly closed.","---\ntitle: \"Penetration Testing for SMBs in Montréal and Québec\"\nnavTitle: \"Penetration Testing\"\ndescription: \"External, internal and web application penetration testing (OWASP) with manual exploitation, a prioritized report and a retest once fixes are in place.\"\ntranslationKey: pentest\norder: 2\nicon: pentest\nprice: pentest\ntagline: \"We attack your systems the way a real adversary would, with your written permission, so you can fix the gaps first.\"\ndeliverables:\n  - \"Rules of engagement and a signed authorization letter before any testing begins\"\n  - \"A report with an executive summary for leadership and reproducible technical details\"\n  - \"Vulnerabilities ranked by severity, with proof of exploitation and a recommended fix\"\n  - \"A results walkthrough with your team, your IT provider or your developers\"\n  - \"A retest of the vulnerabilities you have fixed\"\n  - \"An attestation letter you can share with clients or your insurer\"\nprocess:\n  - title: \"Scoping and authorization\"\n    text: \"Together we define the targets, the testing window and the limits. Nothing starts until your written authorization is signed.\"\n  - title: \"Reconnaissance\"\n    text: \"We map what an attacker would see: exposed services, technologies in use, accounts and entry points.\"\n  - title: \"Manual exploitation\"\n    text: \"We attempt to exploit the weaknesses we find, by hand, to measure their real impact without disrupting your operations.\"\n  - title: \"Report and walkthrough\"\n    text: \"You receive a prioritized report, and we review it with your team to plan the fixes.\"\n  - title: \"Retest\"\n    text: \"Once fixes are applied, we test the vulnerabilities again to confirm they are properly closed.\"\nidealFor:\n  - \"A company launching or rebuilding a web application or client portal\"\n  - \"An SMB whose client, prime contractor or insurer is asking for a penetration test\"\n  - \"An organization that has completed an audit and wants to validate its most critical systems\"\n  - \"A business with remote access (VPN, Remote Desktop) exposed to the internet\"\nfaq:\n  - q: \"Can a penetration test take our systems down?\"\n    a: \"The risk is low and controlled. Permitted techniques, testing windows and systems to avoid are agreed in advance. The most sensitive tests can be run outside business hours or against a staging environment.\"\n  - q: \"How is a pentest different from a vulnerability scan?\"\n    a: \"An automated scan produces a list of potential weaknesses, with its share of false positives. A penetration test goes further: a human verifies each weakness, chains them together and shows what an attacker could actually obtain.\"\n  - q: \"Should we tell our employees and our IT provider?\"\n    a: \"Your IT provider and, where applicable, your hosting provider need to know. Employees don't have to: keeping them unaware lets you see whether the attack gets noticed. We settle this with you during scoping.\"\n  - q: \"How often should we run a penetration test?\"\n    a: \"Once a year is common practice, along with after any significant change: a new application, a migration, a new remote access service. Some contracts and insurers set their own frequency.\"\n---\n\nA penetration test (or pentest) answers a simple question: if someone really wanted to get in, how far would they get? Our team thinks like an attacker and uses real techniques, within strict boundaries you approve in writing.\n\nUnlike an automated tool, we exploit weaknesses manually, chain them together and measure their concrete impact: access to the CEO's mailbox, client files, the accounting system. You finally know what is serious and what can wait.\n\n## Three types of tests, depending on your needs\n\n### External penetration test\n\nWe attack from the internet, just as anyone in the world could: your website, portals, email, remote access (VPN, Remote Desktop), firewall and forgotten services. This is the first surface an attacker explores.\n\n### Internal penetration test\n\nWe start from a compromised workstation or a network jack in your office, the scenario where an employee clicked the wrong link. We then assess what an attacker could reach next: Active Directory, file servers, backups, privileged accounts. Testing is done on site anywhere in Quebec, or remotely through secure access set up with your IT team.\n\nNot sure which one you need? Our article on [external vs. internal penetration tests](\u002Fen\u002Fblog\u002Fexternal-vs-internal-penetration-test) will help you decide.\n\n### Web application test\n\nFor your client portal, online store or line-of-business application. We follow OWASP methodology (the Top 10 and the Web Security Testing Guide): access control, authentication, session management, injection and business logic. Testing uses dedicated test accounts, ideally in a staging environment. For more detail, read our article on [web application pentesting and the OWASP Top 10](\u002Fen\u002Fblog\u002Fweb-application-penetration-test-owasp-top-10).\n\n## Clear rules before the first test\n\n::callout{type=\"warning\" title=\"No testing without written authorization\"}\nIn Canada, using a computer without authorization is an offence under the Criminal Code (s. 342.1). We never begin without an authorization signed by someone with the authority to grant it. If your systems are hosted by a third party, their consent may also be required.\n::\n\nBefore we start, we draft the rules of engagement with you. This document sets out:\n\n- the domains, IP addresses and applications in scope, and those excluded;\n- the testing dates and time windows;\n- permitted and prohibited techniques (for example, no denial of service);\n- emergency contacts on both sides;\n- how we protect any data we come across during the engagement.\n\nScope and price are locked in a quote before any work begins. No surprise overruns.\n\n## A prioritized, readable report\n\nThe report speaks to two audiences. Leadership gets a plain-language executive summary: the risk level, the attack scenarios we demonstrated and the priorities. The technical team gets, for each vulnerability, a description, a severity rating, the evidence (screenshots, requests), steps to reproduce it and the recommended fix.\n\nOnce your fixes are in place, we retest to confirm the gaps are closed, and you receive an attestation letter to share with clients or your insurer. To get the most out of the document, see our guide on [how to read a penetration test report](\u002Fen\u002Fblog\u002Fhow-to-read-penetration-test-report).\n\nNot ready for a pentest yet? A [cybersecurity audit](\u002Fen\u002Fservices\u002Fcybersecurity-audit) is often the better first step: it lets you fix the obvious issues before paying someone to find them.\n",{"title":47,"description":174},"en\u002Fservices\u002Fpenetration-testing","We attack your systems the way a real adversary would, with your written permission, so you can fix the gaps first.","jCFX_AkXqMnHRVdUbAU9RqIj4VFRUzHBA1kPJrR6f50",{"path":219},"\u002Fservices\u002Ftest-intrusion",[221,225,228,232,236],{"path":5,"navTitle":6,"tagline":222,"icon":223,"price":224,"order":7},"Find out where your business really stands, and get a clear, prioritized plan to fix what matters most.","audit","diagnostic",{"path":13,"navTitle":14,"tagline":226,"icon":227,"price":227,"order":15},"Your email and files live in the cloud. Let's make sure the right settings are actually protecting your business.","cloud",{"path":17,"navTitle":18,"tagline":229,"icon":230,"price":231,"order":19},"Turn Law 25 from a vague to-do into documented, working practices, starting with the security of your data.","law","loi25",{"path":21,"navTitle":22,"tagline":233,"icon":234,"price":235,"order":23},"A report protects no one until the fixes are done. We turn your findings list into action.","wrench",null,{"path":25,"navTitle":26,"tagline":237,"icon":238,"price":239,"order":27},"A part-time security lead who knows your business and keeps an eye on your risks, month after month.","partner","vciso",1792970120714]