# Cybersecurity Audit on the North Shore for SMBs

Source : https://cybercaribou.com/en/cybersecurity-audit/north-shore · Cyber Caribou

> Cybersecurity audits for North Shore SMBs in Terrebonne, Blainville, Repentigny and Mirabel: construction, manufacturing, aerospace and a free on-site visit.

Montréal's North Shore, the fast-growing suburbs north of Laval and of the island of Montréal, has a very different economy from downtown. Canada Economic Development describes the southern Laurentides as an area of commercial and industrial growth driven by strong population growth, mixing traditional sectors (metal products, transportation equipment, agri-food) with technology sectors (aerospace, life sciences). According to Québec's statistics institute, manufacturing is the largest sector in both the Laurentides and Lanaudière, and construction ranks among the top three in each (2022 GDP, ranking excludes finance and real estate).

Mirabel adds a major aerospace hub. The Québec government says the Airbus A220 program employs 3,500 people at its Mirabel decision and development centre, and Bell Textron Canada marked its 6,000th commercial helicopter built at Mirabel in 2025.

What does that mean for cybersecurity? Many North Shore businesses are family-owned companies that have doubled in size within a few years, with crews on the road or on job sites and IT that grew one need at a time rather than by design.

## Manufacturing: grown fast, wired fast

A metal fabricator in Blainville or a transportation equipment supplier in Boisbriand often runs office and shop-floor computers on the same network, with a few shared logins on the floor because "it's faster." That works until ransomware hits the office and spreads to the PCs that drive production. Our guide to [manufacturing and OT security](https://cybercaribou.com/en/blog/manufacturing-ot-cybersecurity) shows how to separate the two without stopping the plant.

Aerospace suppliers around Mirabel have one more item on the list: customer requirements. Level 1 of the [CPCSC](https://cybercaribou.com/en/blog/cpcsc-cyber-certification-defence-suppliers), an annual self-assessment available since April 2026, has appeared in some defence contracts since summer 2026.

## Construction and retail: money moves by email

Contractors handle large payments, many subcontractors and tight schedules, which is exactly what fraudsters look for. Hack a subcontractor's mailbox, wait for the next invoice, announce a "new bank account": our article on [vendor banking change fraud](https://cybercaribou.com/en/blog/vendor-banking-change-fraud) walks through the playbook, and our [construction cybersecurity](https://cybercaribou.com/en/blog/construction-company-cybersecurity) guide also covers job sites, tenders and shared devices. Retailers, for their part, need to protect payment terminals and online stores; see our [retail and e-commerce](https://cybercaribou.com/en/blog/retail-ecommerce-cybersecurity) guide.

A quick self-check for a growing North Shore business:

- [ ] Every mailbox, including site supervisors' and shared ones, has multi-factor authentication
- [ ] Changes to supplier or employee banking details are confirmed by phone at a known number
- [ ] Nobody uses an administrator account for everyday work
- [ ] Shop-floor or site computers are on a separate network from the office
- [ ] At least one backup copy is offline or immutable, and a restore was tested this year

## How the on-site visit works on the North Shore

The [on-site visit](https://cybercaribou.com/en/on-site-visit) is free in Terrebonne, Blainville and Repentigny. For Mirabel, Saint-Jérôme and other municipalities, we offer a video meeting or travel on quote. After a short call, we spend an hour with you and whoever manages your IT. We look at how invoices and payroll changes are approved, how crews reach email and files from the field, and how the office and the plant are connected. You get a written summary of your three priorities. Nothing is actively tested and we don't touch your systems.

## Our services for North Shore businesses

Most growing businesses run on Microsoft 365 or Google Workspace, so our [Microsoft 365 and Google Workspace audit](https://cybercaribou.com/en/services/microsoft-365-google-workspace-audit) is often the best value: MFA, suspicious forwarding rules, personal device access and external sharing. If no one in-house owns security, our [ongoing security partner](https://cybercaribou.com/en/services/ongoing-security-partner) service gives you a part-time CISO who follows the action plan month after month, alongside your IT provider.

A 50-person metal fabricator receives an email, apparently from a welder, asking payroll to deposit his pay into a new account. The payroll clerk mentions it to him on the floor, and the fraud is caught. The on-site visit traces it back: the welder's company mailbox had no MFA and was opened from abroad, every office user is a local administrator, and the shop-floor PCs share a single password. Within six weeks the company turns on MFA for every account, removes everyday admin rights, moves the floor PCs to their own network and writes a two-step check for any banking change. This scenario is made up for illustration.

## FAQ

**Do you travel to Mirabel or Saint-Jérôme?**
The on-site visit is free in Terrebonne, Blainville and Repentigny. For Mirabel, Saint-Jérôme and other North Shore municipalities, we offer a video meeting or travel on quote. The current service area is listed on our on-site visit page.

**An employee emailed asking us to change their direct deposit details. Could it be a scam?**
It could be. Payroll diversion is a common variant of business email compromise: a fraudster takes over or imitates an employee's email and asks HR or payroll to send the next pay to a new account. Confirm every banking change in person or by phone at a number already on file, never by replying to the email.

**Our site supervisors use their personal phones for work. Is that a risk?**
Yes, if company email and documents are on those phones without protection. Require multi-factor authentication, a screen lock and automatic updates. With Microsoft 365, app protection policies can protect company data inside apps without taking full control of the employee's phone.

## Sources

- [Institut de la statistique du Québec: Coup d'œil sur les Laurentides (in French)](https://statistique.quebec.ca/en/produit/publication/laurentides-panorama)
- [Institut de la statistique du Québec: Coup d'œil sur Lanaudière (in French)](https://statistique.quebec.ca/en/produit/publication/lanaudiere-panorama)
- [Canada Economic Development for Quebec Regions: Laurentides region (in French)](https://www.canada.ca/fr/developpement-economique-regions-quebec/a-propos/informations-regionales/laurentides.html)
- [Gouvernement du Québec: Québec and Airbus extend their A220 partnership (July 2024, in French)](https://www.quebec.ca/nouvelles/actualites/details/secteur-aerospatial-quebec-et-airbus-prolongent-leur-partenariat-dans-lavion-a220-57425)
- [Bell Textron Canada celebrates its 6,000th helicopter built at Mirabel facility (May 2025)](https://news.bellflight.com/en-CA/249869-bell-textron-canada-celebrates-its-6-000th-helicopter-built-at-mirabel-facility/)