Different Industries.Different Defences.

Fake invoices, changed banking details and redirected funds.

• Legal

  RiskTrust account fraud through email compromise. An attacker reads a lawyer's or client's mailbox, waits for a closing, then sends revised wire instructions that look completely legitimate.

  RiskImpersonation of clients and opposing counsel. Lookalike domains and spoofed addresses are used to redirect settlement funds or request sensitive documents.

• Financial services

  RiskClient account takeover and fraudulent withdrawals. Attackers phish an advisor or client, then request transfers or redemptions using details from the compromised mailbox.

  RiskPayment instruction fraud. Fake vendor invoices and altered wire details target finance teams, often timed with month-end or quarter-end processing.

• Accounting

  RiskBusiness email compromise in client payments. Attackers impersonate the firm to send clients fake payment instructions, or impersonate clients to request changes.

• Construction

  RiskProgress-payment and invoice fraud. Attackers compromise a subcontractor or supplier mailbox and send a real-looking invoice with new banking details right when a draw is due.

• Retail and ecommerce

  RiskCheckout skimming. Malicious JavaScript added to a payment page or a third-party script silently copies card data as customers type it.

• Non-profit

  RiskBusiness email compromise and payment fraud. Fake vendor invoices, gift card requests from an impersonated executive director and redirected grant payments.

• Real estate

  RiskDeposit and closing wire fraud. Attackers watch a realtor's or client's mailbox, then send fake deposit or closing instructions that look completely legitimate.

  RiskSeller and title impersonation. Fraudsters pose as property owners using forged ID to sell or mortgage property they do not own.

• Professional services

  RiskBusiness email compromise. Attackers impersonate the firm to redirect client payments, or impersonate clients and suppliers to redirect yours.

• Education

  RiskTuition and payment fraud. Families and international agents receive fake tuition invoices and banking change requests from compromised or spoofed school accounts.

Encrypted systems, stopped operations and data held for extortion.

• Healthcare

  RiskRansomware on EMR and imaging systems. Attackers encrypt the EMR, practice management server or imaging archive, then threaten to publish patient data. Clinics often cannot see patients until systems are restored.

• Legal

  RiskRansomware and data extortion. Groups steal client files before encrypting systems, then threaten to publish privileged material. The confidentiality damage outlasts the downtime.

• Financial services

  RiskRansomware and data extortion. Client financial records, SIN numbers and account details are high-value extortion material.

• Construction

  RiskRansomware on estimating and project systems. Encrypted estimating, scheduling and accounting systems stall bids, payroll and site coordination.

• Manufacturing

  RiskRansomware causing production downtime. Attacks on ERP, MES or file servers stop scheduling and shipping. If IT and OT networks are flat, plant systems can be hit directly.

• Non-profit

  RiskRansomware with no recovery plan. Many organizations discover their backups do not work only after an attack.

• Education

  RiskRansomware during the school year. Encrypted student information systems, file servers and learning platforms disrupt classes, report cards and admissions.

• Government and defence suppliers

  RiskRansomware and supply chain disruption. An attack on a small supplier can delay delivery on a larger defence program and damage the relationship with the prime.

Stolen logins, standing remote access and devices outside IT’s view.

• Healthcare

  RiskMicrosoft 365 account takeover. A phished front-desk or physician mailbox exposes referral letters, lab results and patient correspondence, and becomes a launch point for phishing other clinics.

  RiskThird-party and vendor access. EMR vendors, IT providers and billing services often hold standing remote access. One compromised vendor account can reach every clinic they support.

• Legal

  RiskRemote access and personal devices. Lawyers working from home or court on unmanaged laptops and phones create access paths that are hard to see and harder to revoke.

• Financial services

  RiskClient account takeover and fraudulent withdrawals. Attackers phish an advisor or client, then request transfers or redemptions using details from the compromised mailbox.

• Accounting

  RiskCompromised represent-a-client and portal access. An attacker with a staff member's credentials can view or change client information and redirect refunds.

• Construction

  RiskUnmanaged field devices and site networks. Shared tablets, site trailer Wi-Fi and personal phones are often outside IT's view and easy to compromise.

• Manufacturing

  RiskVendor and integrator remote access. Machine builders and integrators often keep always-on remote access to PLCs and HMIs, sometimes with shared or default passwords.

• Retail and ecommerce

  RiskAdmin account takeover. Stolen logins to Shopify, WooCommerce, Magento or payment gateways are used to change payout accounts, add scripts or export customer data.

  RiskCustomer account takeover. Credential stuffing with passwords leaked elsewhere lets attackers use stored gift cards, loyalty points and saved addresses.

• Technology and SaaS

  RiskDeveloper and admin account takeover. A phished engineer with production or source code access is the shortest path to a breach of every customer.

• Non-profit

  RiskShared accounts and volunteer access. Shared passwords, personal devices and volunteers who never get removed from systems create access nobody tracks.

• Real estate

  RiskIndependent agents on personal devices. Agents often use personal phones, laptops and email accounts, so the brokerage has little visibility or control.

• Professional services

  RiskAccess to client systems. Consultants and IT service firms with credentials to client environments become a path into those clients.

• Education

  RiskAccount compromise across a large user base. Hundreds of student and staff accounts, often with weak or reused passwords, are a constant target for phishing and credential stuffing.

Client, patient, student and donor records, contract information and intellectual property.

• Healthcare

  RiskSnooping and insider misuse. Staff looking up records of people they are not treating is a recurring theme in Canadian health privacy decisions.

• Legal

  RiskRansomware and data extortion. Groups steal client files before encrypting systems, then threaten to publish privileged material. The confidentiality damage outlasts the downtime.

• Financial services

  RiskRansomware and data extortion. Client financial records, SIN numbers and account details are high-value extortion material.

• Accounting

  RiskTheft of client identity and tax data. SINs, T4s, notices of assessment and banking details enable tax refund fraud, account takeovers and identity theft.

• Construction

  RiskBid and design data theft. Tender pricing, drawings and owner security information can be valuable to competitors and to attackers targeting your clients.

• Manufacturing

  RiskIntellectual property and supply chain pressure. Designs, formulas and customer drawings are theft targets, and large customers now audit supplier security.

• Technology and SaaS

  RiskCloud misconfiguration and leaked secrets. Public storage buckets, over-permissioned roles and API keys committed to code repositories are common and fast to exploit.

• Non-profit

  RiskDonor and client data exposure. Donor databases and client case files are attractive to fraudsters and extortion groups, and a breach damages trust with funders.

• Real estate

  RiskExposure of client identity records. Driver's licences, passports and FINTRAC records stored in email or shared drives are valuable for identity fraud.

• Professional services

  RiskClient data exposure. Shared drives, email and collaboration tools hold client strategy, designs, HR files and personal information that attackers can steal and use for extortion.

• Education

  RiskStudent and family data exposure. Records about minors, health and learning accommodations, custody arrangements and international student documents are highly sensitive.

• Government and defence suppliers

  RiskTheft of sensitive contract information. State-sponsored and criminal actors target defence supply chains for designs, specifications and program information.

Customers, owners, funders and primes asking for proof of security before they sign.

• Financial services

  RiskThird-party due diligence failure. Banks and insurers that are federally regulated must manage the risk their suppliers create. Weak answers can cost you a contract or a distribution relationship.

• Construction

  RuleOwner and public-sector contract security clauses

  RuleFederal contract security requirements and CPCSC for defence-related work

• Manufacturing

  RiskIntellectual property and supply chain pressure. Designs, formulas and customer drawings are theft targets, and large customers now audit supplier security.

  RuleCustomer and OEM supply chain security requirements

  RuleCPCSC for suppliers on Canadian defence contracts

• Technology and SaaS

  RiskStalled enterprise deals. Security reviews, questionnaires and SOC 2 requests from enterprise buyers add months to sales cycles when you cannot answer them.

  RuleCustomer contract terms on data protection, breach notification and subprocessors

• Non-profit

  RuleFunder and government contract requirements on data protection

• Professional services

  RiskFailed client security reviews. Questionnaires and contract clauses require controls and evidence that many firms cannot produce on short notice.

  RuleClient contract clauses on confidentiality, security and breach notification

  RuleFederal contract security requirements for government work

• Government and defence suppliers

  RiskLosing contracts over certification. Suppliers that cannot attest to the required CPCSC level at contract award risk losing work to competitors who can.

  RuleContract Security Program requirements under PSPC

Taking card payments for sales, tuition or donations brings PCI DSS into scope.

• Retail and ecommerce

  RulePCI DSS v4.0.1, including requirements that became mandatory on March 31, 2025

  RuleCard brand and acquirer requirements set in your merchant agreement

• Non-profit

  RulePCI DSS when accepting card donations

• Education

  RulePCI DSS for card tuition payments