Monitored 24/7
Analysts on watch every night, weekend and holiday. Critical alerts are triaged and response begins within 15 minutes, 24/7/365.
Managed security for Canadian business
Enterprise Security.Small-Business Price.
The world's leading security platforms, run around the clock by our analysts and AI. So no business has to choose between safe and affordable.
- Analysts on watch
- 24/7
- Provinces and territories
- 13
- Leading platforms
- 17+
CONSOLEDemo tenantSOC online00:00:00 ET3MTOverview / All sources
Live operations
Events / second
26
Streaming
Events today
1,240,512
14 log sources
AI-correlated cases
296
from all events today
With an analyst
3
1 P1 · 2 P2
Event rate, last 10 minutes
now
Detections
Live- CRITCredential dumping via LSASSFIN-LT-014
- HIGHInbox rule forwarding externallypayables@
- HIGHImpossible travel sign-inm.chen@
- MEDEncoded PowerShellOPS-WS-022
- MEDRDP brute force blockedfw-edge-01
- LOWUnsigned driver loadedENG-WS-007
- CRITCredential dumping via LSASSFIN-LT-014
- HIGHInbox rule forwarding externallypayables@
- HIGHImpossible travel sign-inm.chen@
- MEDEncoded PowerShellOPS-WS-022
- MEDRDP brute force blockedfw-edge-01
- LOWUnsigned driver loadedENG-WS-007
Certified partner of
Find your path
Start with What You Need Today
Choose by the outcome you need, your sector or your role. Every path leads to the same certified team.
Tested
Find what attackers would use before they do. Penetration test reports arrive within 5 business days of testing.
Compliant or Insured
CyberSecure Canada, SOC 2 and ISO 27001 evidence, collected as we go, and the controls insurers ask about.
Under Attack Now
Call the 24/7 line. Incident response retainer clients get remote engagement within 1 hour.
24/7 line+1 236 665 1165Your Sector. Your Rules. Covered
Trust accounts, health records, SOC 2 questionnaires, CPCSC. Built in from day one.
All industriesOwners and executives
Can We Have Enterprise-Grade Security Without Building a Team?
A security operations centre watching around the clock, endpoint detection and response, threat hunting, regular penetration testing and an experienced security leader, delivered as one managed service sized for 10 to 1,000 employees. Reporting is one page, written for the board.
IT managers and IT providers
Does This Replace Us?
No. Most IT providers are excellent at keeping systems running but do not staff a security operation overnight. We work alongside your internal IT or managed service provider and focus only on security: detection, response, testing and compliance.
Compliance, finance and insurance
Can We Answer the Insurer and the Auditor?
Canadian insurers commonly ask about MFA, endpoint detection and response, 24/7 monitoring, tested backups, an incident response plan and staff training. We put those controls in place and give you the evidence to answer accurately.
How Exposed Is Your Business Right Now?
Tick what is true today. Be honest; nobody sees this but you.
Services
An Entire Security Team. One Partner
20 services in five groups, delivered by one certified team on the platforms you already use or the ones that fit you best.
01
Detect and Respond
4 services
- Managed Detection and Response24/7 monitoring of endpoints, identities, email and cloud, with analysts who investigate and contain threats for you.
- SOC as a ServiceAn outsourced security operations centre with managed SIEM, log retention, correlation and analyst coverage on every shift.
- Threat Hunting and IntelligenceAnalyst-led hunts for hidden attacker activity, threat intelligence focused on Canadian businesses and monitoring for leaked staff credentials.
- Incident ResponseEmergency response, retainers, tested plans and tabletop exercises for ransomware, business email compromise and data breaches.
02
Protect Users and Data
4 services
- Microsoft 365 and Email SecurityHardening, monitoring and phishing defence for Microsoft 365, Entra ID and business email, so account takeover and invoice fraud stop early.
- Identity and Access ManagementMFA, single sign-on, conditional access and privileged access controls on Microsoft Entra ID and Okta, plus clean joiner, mover and leaver processes.
- Endpoint SecurityManaged EDR, hardening and device controls for laptops, desktops, servers and mobile devices, monitored around the clock.
- Backup and Ransomware RecoveryImmutable and offline backups, Microsoft 365 backup, regular restore testing and recovery plans built around how long you can afford to be down.
03
Protect Infrastructure
4 services
- Cloud SecurityConfiguration reviews, posture management and monitoring for Azure, AWS, Google Cloud and the SaaS applications your business depends on.
- Network and Firewall SecurityFirewall management, secure remote access, segmentation and network monitoring for offices, plants, clinics and job sites.
- Zero Trust and Secure AccessLegacy VPN replaced with zero trust network access and SASE, so remote and hybrid staff reach only the applications they need, from devices that pass a health check.
- Website and Application SecurityProtection, monitoring and repair for business websites, online stores and web applications, from WAF and DDoS defence to hacked site cleanup.
04
Test and Assess
4 services
- Penetration TestingManual, scoped testing of networks, web applications, APIs, cloud and people, with reports your executives and engineers can both use.
- Vulnerability ManagementContinuous scanning, asset discovery and risk-based prioritization, so your team patches what matters instead of drowning in findings.
- Attack Surface ManagementContinuous discovery of internet-facing systems, with alerts on exposed remote access, forgotten subdomains, shadow IT and expiring certificates.
- Cyber Risk AssessmentA baseline review of your security against NIST CSF 2.0, CIS Controls or CyberSecure Canada, with a prioritized roadmap and a summary your board can read.
05
Govern and Comply
4 services
- Virtual CISO (vCISO)Experienced security leadership on a part-time basis: strategy, risk, policies, board reporting and customer assurance.
- Compliance ReadinessReadiness for SOC 2, ISO 27001, CyberSecure Canada, CPCSC and PCI DSS: gap assessment, remediation, evidence and audit support.
- Privacy CompliancePractical privacy programs and breach readiness for PIPEDA, Quebec Law 25, Alberta and BC PIPA and provincial health privacy laws.
- Security Awareness TrainingShort, relevant training and realistic phishing simulations that change behaviour, with reporting for leadership, insurers and auditors.
Solutions that combine several services: Ransomware protection and Cyber insurance readiness.
Human-led. AI-powered.
From First Signal to Board Report
AI does the triage. People make the decisions. Every time.
Millions of Signals. A Handful of Real Threats
AI correlates the noise. Analysts review what matters.
Managed detection and responseProduct screen shown with sample data.
Events analyzed (24h)
1.84M
+6.2%
Escalated to analysts
17
0.0009% of events
Median time to contain
11m 40s
−2m vs 30d
Protected assets
412
398 healthy
Alerts by severity, 14 days
LowMediumHighCritical
Alert queue
Auto-refresh · Pacific Time
| Time | Sev | Detection | Status | Owner |
|---|---|---|---|---|
| 09:42:17 | CRIT | Credential dumping via LSASS access | Contained | AK |
| 09:38:02 | HIGH | Impossible travel: Toronto → Lagos in 22 min | Investigating | JR |
| 09:21:55 | HIGH | New inbox rule forwards to external address | Investigating | JR |
| 08:57:40 | MED | Encoded PowerShell from Office child process | Triaged by AI | AI |
Stopped Fast. Explained Plainly
Isolate, revoke, purge, block. Then we call you.
Incident responseProduct screen shown with sample data.
P1 · CRITICALContained in 1m 32s after analyst review
Macro-enabled invoice leads to loader execution on finance laptop
FIN-LT-014 · accounts payable · Windows 11 · owner: payables team
Process tree
- OUTLOOK.EXEuser opened attachment "Invoice_44817.docm"
- WINWORD.EXEmacro executed
- powershell.exe -nop -w hidden -enc SQBFAFgA…T1059.001
- rundll32.exe C:\Users\Public\upd.dll,StartT1218.011
- outbound 443 → 91.215.x.x (newly registered)C2 beacon
Host
Isolated
Identity
Sessions revoked
6 purged
Timeline
- 09:41:52EDR
Behavioural detection on FIN-LT-014: Office spawning encoded PowerShell.
- 09:41:58AI
Correlated with phishing email delivered 09:37 to 6 recipients. Similarity to known loader: high. Escalated as P1.
- 09:43:10Analyst
Confirmed malicious. Process tree and network beacon reviewed. Approved containment per playbook IR-03.
- 09:43:24Action
Host isolated. User sessions revoked. Hash and domain blocked tenant-wide. Email purged from 6 mailboxes.
- 09:51:05Analyst
Client contact notified by phone. No lateral movement found. Evidence package preserved.
Fix What Attackers Actually Use
Vulnerabilities ranked by real-world exploitation, not just severity.
Vulnerability managementProduct screen shown with sample data.
Exposure score
41 −37 in 12 weeks
Lower is better
Open findings
- Critical3
- High12
- Medium29
- Low32
Fix first: exploited in the wild
| CVE | Product | Assets | CISA KEV | Status |
|---|---|---|---|---|
| CVE-2024-3400 | PAN-OS GlobalProtect | 1 | Listed | Patched |
| CVE-2024-21762 | FortiOS SSL VPN | 2 | Listed | Due in 2 days |
| CVE-2023-4966 | Citrix NetScaler | 1 | Listed | Mitigated |
| CVE-2024-38063 | Windows TCP/IP IPv6 | 37 | No | Due in 9 days |
| CVE-2024-6387 | OpenSSH regreSSHion | 4 | No | Due in 14 days |
Audit-Ready, All Year
CyberSecure Canada, SOC 2 and ISO 27001 evidence, collected as we go.
Compliance readinessProduct screen shown with sample data.
92%
ready
CyberSecure Canada
12 of 13 controls
78%
ready
SOC 2 Type II
Audit window opens Feb 1
61%
ready
ISO/IEC 27001:2022
57 of 93 Annex A
88%
ready
PIPEDA safeguards
Breach log current
Controls needing attention
Evidence synced 06:00
| CC6.1 | MFA enforced for all workforce identities | Auto-collected daily | Passing |
| CC7.2 | Security events monitored 24/7 | SOC monthly report | Passing |
| A.5.24 | Incident response plan tested in last 12 months | Tabletop booked | Due |
| CC8.1 | Change management for production systems | Policy drafted | Gap |
| A.8.13 | Backups encrypted and restore tested quarterly | Restore test Oct 28 | Passing |
One Page. Read by the Board
What happened, what we did, what to fix next.
vCISO and reportingProduct screen shown with sample data.
Monthly Security Report
October 2026 · Prepared for the leadership team
Security posture
B+
Up from B− in March
MarMayJulSep
Threats stopped
23
Incidents
1 (contained)
Phish report rate
64%
What happened
A phishing email with a macro-enabled invoice reached six staff. One device ran the attachment; we isolated it within two minutes of analyst confirmation. No data left the network.
Top three actions for next month
- 1Block Office macros from internet files across the tenant (1 hour, IT provider)
- 2Replace SMS codes with phishing-resistant MFA for finance and executives
- 3Run the ransomware tabletop exercise booked for November 19
Why Cyberphore
Attackers Don’t Care How Big You Are
The crews that hit hospitals also hit 40-person firms in Mississauga and dental clinics in Halifax. Enterprises have a SOC and a CISO. Most SMBs have one busy IT lead.
We close that gap. The security operation an enterprise would build, shared so you pay a fraction. Without the hiring.
Attack path · found during an external and internal test
- 1Exposed VPNCVE, no MFABroken byAttack Surface ManagementVulnerability Management
- 2Staff laptopPhished userBroken byMicrosoft 365 and Email SecuritySecurity Awareness Training
- 3Admin credentialsCached in memoryBroken byEndpoint SecurityManaged Detection and Response
- 4Domain adminKerberoastingBroken byIdentity and Access ManagementThreat Hunting and Intelligence
- 5Finance dataThe crown jewelsBroken byBackup and Ransomware RecoveryIncident Response
Enterprise Results. A Fraction of the Price
24/7 monitoring by human analysts
- Build in-house
- Five or more hires to cover every shift
- Traditional security firm
- Yes, at enterprise pricing
- Cyberphore
- Included
Leading platforms (Microsoft, CrowdStrike, SentinelOne, Fortinet and more)
- Build in-house
- You buy, run and tune them
- Traditional security firm
- Usually locked to one vendor
- Cyberphore
- Best fit for you, managed
Active containment of attacks
- Build in-house
- Yes, if fully staffed
- Traditional security firm
- Yes
- Cyberphore
- Included
Penetration testing and vCISO
- Build in-house
- Separate vendors
- Traditional security firm
- Separate engagements
- Cyberphore
- Same team
Canadian privacy and insurance expertise
- Build in-house
- Hire for it
- Traditional security firm
- Varies
- Cyberphore
- Built in
Who it is priced for
- Build in-house
- Large budgets
- Traditional security firm
- Enterprises
- Cyberphore
- Every business, even the smallest
Proof
Commitments You Can Hold Us To
Specific commitments on response, onboarding, testing and data retention, from a team in which every employee is certified.
Confirmed commitments
- Critical alerts are triaged and response begins, 24/7/365
- 15 minutes
- Critical alerts are triaged and response begins, 24/7/365
- Remote engagement for incident response retainer clients
- 1 hour
- Remote engagement for incident response retainer clients
- Onboarding time for most clients
- 1 to 2 weeks
- Onboarding time for most clients
- From the end of testing to your penetration test report
- 5 business days
- From the end of testing to your penetration test report
- Monitoring data searchable, then archived, in Canadian data centres by default
- 90 days, 1 year
- Monitoring data searchable, then archived, in Canadian data centres by default
Pricing is quote only, in CAD, after a free scoping call. How pricing works
Every team member is certified
From analysts to leadership, every employee holds industry certifications.
- CISSP
- CISM
- OSCP
- OSCE
- GIAC GCIH
- GIAC GCIA
- GIAC GPEN
- Microsoft SC-200
- Microsoft AZ-500
- CrowdStrike
- Palo Alto Networks
- Fortinet NSE
17 technology partners
Already have Microsoft, CrowdStrike or SentinelOne? We run what fits you best, not a single vendor's stack.
- Microsoft
- CrowdStrike
- Palo Alto Networks
- Fortinet
- Check Point
- Zscaler
- SentinelOne
- Cisco
- Cloudflare
- Okta
- Proofpoint
- Splunk
- Tenable
- Qualys
- Sophos
- Trend Micro
- CyberArk
Coast to coast to coast
Built for Canada. Province by Province
Law 25 in Quebec. PIPA in Alberta. Health acts everywhere. We know the differences.
Western Canada
Central Canada
Atlantic Canada
Northern Canada
Your Monitoring Data Stays in Canada
Stored in Canadian data centres by default: searchable for 90 days and archived for 1 year.
Headquartered in Vancouver, Serving Every Province
Monitoring, response, testing and vCISO work are delivered remotely, in all 13 provinces and territories. All cities we serve
FAQ
What Owners Ask First
What does enterprise-grade security mean for a small business?
It means the same building blocks large companies rely on: a security operations centre watching around the clock, endpoint detection and response, threat hunting, regular penetration testing and an experienced security leader. Cyberphore delivers them as one managed service, sized and priced for businesses with 10 to 1,000 employees.
How does Cyberphore use AI, and who makes the decisions?
AI does the volume work: correlating events, removing duplicates and ranking what looks dangerous. People make the decisions. A Cyberphore analyst investigates every alert that reaches the escalation threshold and approves every containment action, following a playbook you agreed to in advance.
Do you work with businesses outside British Columbia?
Yes. We are headquartered in Vancouver and protect businesses in every province and territory. Monitoring, response, testing and vCISO work are delivered remotely, and our team understands the privacy laws that differ by province, such as Quebec Law 25 and Alberta PIPA.
We already have an IT provider. Why would we need you?
Most IT providers are excellent at keeping systems running but do not staff a security operation overnight. We work alongside your internal IT or managed service provider and focus only on security: detection, response, testing and compliance.
Will this help us get or keep cyber insurance?
Usually, yes. Canadian insurers commonly ask about multi-factor authentication, endpoint detection and response, 24/7 monitoring, tested backups, an incident response plan and staff training. We put those controls in place and give you the evidence to answer the questionnaire accurately.
Get started
Attackers Do Not Wait for Budget Season
In 30 minutes, a certified Cyberphore specialist shows you your three biggest risks and exactly how to close them. Free, no obligation.
- 1Free security assessment30 minutesYour three biggest risks, and an honest view of which services you need and which you do not.
- 2Written quote in CADAfter the callQuote only, scoped to your environment. No prices to decode.
- 3Onboarding1 to 2 weeks for most clientsAgents deployed, sources connected, contacts and playbook agreed.
- 4ProtectedOngoingAnalysts on watch 24/7/365, with one-page reporting your board will read.
Resources
Straight Answers. No Jargon
Guide · Threats and attacksBusiness Email Compromise in Canada: Stop Payment FraudBusiness email compromise is a fraud in which criminals use a compromised or impersonated email account to trick staff into sending money or sensitive data. This guide explains the common Canadian scenarios, why technology alone does not stop them, and the payment controls, email security and response steps that do.Read the guide Guide · Cyber insuranceCyber Insurance Requirements in Canada: What Insurers AskCanadian cyber insurers now expect a set of baseline controls, led by multi-factor authentication, endpoint detection and response, tested backups and staff training, before they will quote or renew. This guide explains what underwriters ask, why, and how to collect evidence that keeps your answers accurate when you make a claim.Read the guide Guide · Compliance and privacyCyberSecure Canada Certification: A Practical Guide for SMBsCyberSecure Canada is a voluntary federal certification program for small and medium organizations, run by Innovation, Science and Economic Development Canada and based on baseline controls from the Canadian Centre for Cyber Security. This guide explains what the controls are, how certification works, how long it takes, and when it is worth pursuing.Read the guide