# Cyberphore

> Cyberphore brings enterprise-grade cybersecurity to Canadian businesses of every size: 24/7 managed detection and response, penetration testing, vCISO and compliance, built on the world's leading security platforms and delivered at a fraction of traditional security firm pricing.

Cyberphore is a Canadian managed cybersecurity provider headquartered in Vancouver, British Columbia, serving small and mid-sized organizations in all 13 Canadian provinces and territories. Its model is human-led and AI-powered: AI correlates and triages security events, and human analysts investigate and approve every response action, 24/7/365.

Head office: CF Pacific Centre, 701 West Georgia Street, Vancouver, BC V7Y 1G5, Canada. Sales and 24/7 incident line: +1 236 665 1165. Founded 2020.

## Team and commitments
- Every Cyberphore employee, from analysts to leadership, holds recognized security certifications, including: CISSP, CISM, OSCP, OSCE, GIAC GCIH, GIAC GCIA, GIAC GPEN, Microsoft SC-200, Microsoft AZ-500, CrowdStrike, Palo Alto Networks, Fortinet NSE.
- 24/7/365 monitoring by certified analysts, with human approval of every response action.
- Critical alerts are triaged and response begins within 15 minutes; incident response retainer clients get remote engagement within 1 hour of their call, 24/7.
- Most clients fully onboarded and protected within 1 to 2 weeks.
- Penetration test reports delivered within 5 business days of testing.
- Service across Canada by default; United States on request. Pricing is quoted per client after a free assessment.

## Services
- [Managed Detection and Response](https://cyberphore.com/services/managed-detection-response/): 24/7 monitoring of endpoints, identities, email and cloud, with analysts who investigate and contain threats for you.
- [SOC as a Service](https://cyberphore.com/services/soc-as-a-service/): An outsourced security operations centre with managed SIEM, log retention, correlation and analyst coverage on every shift.
- [Threat Hunting and Intelligence](https://cyberphore.com/services/threat-hunting-intelligence/): Analyst-led hunts for hidden attacker activity, threat intelligence focused on Canadian businesses and monitoring for leaked staff credentials.
- [Incident Response](https://cyberphore.com/services/incident-response/): Emergency response, retainers, tested plans and tabletop exercises for ransomware, business email compromise and data breaches.
- [Microsoft 365 and Email Security](https://cyberphore.com/services/microsoft-365-email-security/): Hardening, monitoring and phishing defence for Microsoft 365, Entra ID and business email, so account takeover and invoice fraud stop early.
- [Identity and Access Management](https://cyberphore.com/services/identity-access-management/): MFA, single sign-on, conditional access and privileged access controls on Microsoft Entra ID and Okta, plus clean joiner, mover and leaver processes.
- [Endpoint Security](https://cyberphore.com/services/endpoint-security/): Managed EDR, hardening and device controls for laptops, desktops, servers and mobile devices, monitored around the clock.
- [Backup and Ransomware Recovery](https://cyberphore.com/services/backup-ransomware-recovery/): Immutable and offline backups, Microsoft 365 backup, regular restore testing and recovery plans built around how long you can afford to be down.
- [Cloud Security](https://cyberphore.com/services/cloud-security/): Configuration reviews, posture management and monitoring for Azure, AWS, Google Cloud and the SaaS applications your business depends on.
- [Network and Firewall Security](https://cyberphore.com/services/network-firewall-security/): Firewall management, secure remote access, segmentation and network monitoring for offices, plants, clinics and job sites.
- [Zero Trust and Secure Access](https://cyberphore.com/services/zero-trust-secure-access/): Legacy VPN replaced with zero trust network access and SASE, so remote and hybrid staff reach only the applications they need, from devices that pass a health check.
- [Website and Application Security](https://cyberphore.com/services/website-application-security/): Protection, monitoring and repair for business websites, online stores and web applications, from WAF and DDoS defence to hacked site cleanup.
- [Penetration Testing](https://cyberphore.com/services/penetration-testing/): Manual, scoped testing of networks, web applications, APIs, cloud and people, with reports your executives and engineers can both use.
- [Vulnerability Management](https://cyberphore.com/services/vulnerability-management/): Continuous scanning, asset discovery and risk-based prioritization, so your team patches what matters instead of drowning in findings.
- [Attack Surface Management](https://cyberphore.com/services/attack-surface-management/): Continuous discovery of internet-facing systems, with alerts on exposed remote access, forgotten subdomains, shadow IT and expiring certificates.
- [Cyber Risk Assessment](https://cyberphore.com/services/cyber-risk-assessment/): A baseline review of your security against NIST CSF 2.0, CIS Controls or CyberSecure Canada, with a prioritized roadmap and a summary your board can read.
- [Virtual CISO (vCISO)](https://cyberphore.com/services/vciso/): Experienced security leadership on a part-time basis: strategy, risk, policies, board reporting and customer assurance.
- [Compliance Readiness](https://cyberphore.com/services/compliance-readiness/): Readiness for SOC 2, ISO 27001, CyberSecure Canada, CPCSC and PCI DSS: gap assessment, remediation, evidence and audit support.
- [Privacy Compliance](https://cyberphore.com/services/privacy-compliance/): Practical privacy programs and breach readiness for PIPEDA, Quebec Law 25, Alberta and BC PIPA and provincial health privacy laws.
- [Security Awareness Training](https://cyberphore.com/services/security-awareness-training/): Short, relevant training and realistic phishing simulations that change behaviour, with reporting for leadership, insurers and auditors.

## Industries
- [Healthcare](https://cyberphore.com/industries/healthcare/): Protect patient records, keep your EMR running and meet provincial health privacy duties.
- [Legal](https://cyberphore.com/industries/legal/): Stop trust account fraud, protect privileged files and meet your professional duties.
- [Financial services](https://cyberphore.com/industries/financial-services/): Protect client assets, pass bank and regulator due diligence and stop payment fraud.
- [Accounting](https://cyberphore.com/industries/accounting/): Protect client tax data, stop tax season phishing and keep CRA access out of attackers' hands.
- [Construction](https://cyberphore.com/industries/construction/): Stop invoice fraud on progress payments and keep projects running when attackers strike.
- [Manufacturing](https://cyberphore.com/industries/manufacturing/): Keep lines running, secure plant systems and answer your customers' security questions.
- [Retail and ecommerce](https://cyberphore.com/industries/retail-ecommerce/): Protect card payments, stop checkout skimming and meet PCI DSS without overspending.
- [Technology and SaaS](https://cyberphore.com/industries/technology-saas/): Win enterprise deals, get SOC 2 ready and secure your cloud without slowing engineering.
- [Non-profit](https://cyberphore.com/industries/non-profit/): Protect donors and clients, stop payment fraud and get strong security on a non-profit budget.
- [Real estate](https://cyberphore.com/industries/real-estate/): Stop deposit and closing fraud, protect client records and meet FINTRAC and regulator expectations.
- [Professional services](https://cyberphore.com/industries/professional-services/): Protect client information, answer client security questionnaires and stop email fraud.
- [Education](https://cyberphore.com/industries/education/): Protect student and family records, keep learning platforms running and meet privacy duties.
- [Government and defence suppliers](https://cyberphore.com/industries/government-defence-suppliers/): Get ready for CPCSC, protect sensitive contract information and keep winning federal work.

## Locations (Canada)
- [British Columbia](https://cyberphore.com/locations/british-columbia/): privacy laws: Personal Information Protection Act (BC PIPA); Personal Information Protection and Electronic Documents Act (PIPEDA); Freedom of Information and Protection of Privacy Act (FIPPA); E-Health (Personal Health Information Access and Protection of Privacy) Act
- [Alberta](https://cyberphore.com/locations/alberta/): privacy laws: Personal Information Protection Act (Alberta PIPA); Health Information Act (HIA); Protection of Privacy Act (POPA); Personal Information Protection and Electronic Documents Act (PIPEDA)
- [Saskatchewan](https://cyberphore.com/locations/saskatchewan/): privacy laws: Personal Information Protection and Electronic Documents Act (PIPEDA); The Health Information Protection Act (HIPA); The Freedom of Information and Protection of Privacy Act (FOIP) and The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP)
- [Manitoba](https://cyberphore.com/locations/manitoba/): privacy laws: Personal Information Protection and Electronic Documents Act (PIPEDA); The Personal Health Information Act (PHIA); The Freedom of Information and Protection of Privacy Act (FIPPA)
- [Ontario](https://cyberphore.com/locations/ontario/): privacy laws: Personal Information Protection and Electronic Documents Act (PIPEDA); Personal Health Information Protection Act, 2004 (PHIPA); Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (Bill 194); Employment Standards Act, 2000 (electronic monitoring policy)
- [Quebec](https://cyberphore.com/locations/quebec/): privacy laws: Act respecting the protection of personal information in the private sector, as amended by Law 25; Act respecting health and social services information (formerly Bill 3); Act respecting Access to documents held by public bodies and the Protection of personal information; Charter of the French Language, as amended by Bill 96
- [New Brunswick](https://cyberphore.com/locations/new-brunswick/): privacy laws: Personal Information Protection and Electronic Documents Act (PIPEDA); Personal Health Information Privacy and Access Act (PHIPAA); Right to Information and Protection of Privacy Act (RTIPPA)
- [Nova Scotia](https://cyberphore.com/locations/nova-scotia/): privacy laws: Personal Information Protection and Electronic Documents Act (PIPEDA); Personal Health Information Act (PHIA); Personal Information International Disclosure Protection Act (PIIDPA); Freedom of Information and Protection of Privacy Act (FOIPOP)
- [Prince Edward Island](https://cyberphore.com/locations/prince-edward-island/): privacy laws: Personal Information Protection and Electronic Documents Act (PIPEDA); Health Information Act; Freedom of Information and Protection of Privacy Act (FOIPP)
- [Newfoundland and Labrador](https://cyberphore.com/locations/newfoundland-and-labrador/): privacy laws: Personal Information Protection and Electronic Documents Act (PIPEDA); Personal Health Information Act (PHIA); Access to Information and Protection of Privacy Act, 2015 (ATIPPA, 2015)
- [Yukon](https://cyberphore.com/locations/yukon/): privacy laws: Personal Information Protection and Electronic Documents Act (PIPEDA); Health Information Privacy and Management Act (HIPMA); Access to Information and Protection of Privacy Act (ATIPP Act)
- [Northwest Territories](https://cyberphore.com/locations/northwest-territories/): privacy laws: Personal Information Protection and Electronic Documents Act (PIPEDA); Health Information Act (HIA); Access to Information and Protection of Privacy Act (ATIPP Act)
- [Nunavut](https://cyberphore.com/locations/nunavut/): privacy laws: Personal Information Protection and Electronic Documents Act (PIPEDA); Access to Information and Protection of Privacy Act (ATIPPA); Proposed health information legislation

## Guides
- [Business Email Compromise in Canada: Stop Payment Fraud](https://cyberphore.com/guides/business-email-compromise-canada/): Business email compromise is a fraud in which criminals use a compromised or impersonated email account to trick staff into sending money or sensitive data. This guide explains the common Canadian scenarios, why technology alone does not stop them, and the payment controls, email security and response steps that do.
- [Cyber Insurance Requirements in Canada: What Insurers Ask](https://cyberphore.com/guides/cyber-insurance-requirements-canada/): Canadian cyber insurers now expect a set of baseline controls, led by multi-factor authentication, endpoint detection and response, tested backups and staff training, before they will quote or renew. This guide explains what underwriters ask, why, and how to collect evidence that keeps your answers accurate when you make a claim.
- [CyberSecure Canada Certification: A Practical Guide for SMBs](https://cyberphore.com/guides/cybersecure-canada-certification-guide/): CyberSecure Canada is a voluntary federal certification program for small and medium organizations, run by Innovation, Science and Economic Development Canada and based on baseline controls from the Canadian Centre for Cyber Security. This guide explains what the controls are, how certification works, how long it takes, and when it is worth pursuing.
- [MDR vs MSSP vs SOC as a Service: Which Do You Need?](https://cyberphore.com/guides/mdr-vs-mssp-vs-soc-as-a-service/): MDR, MSSP and SOC as a service all promise security monitoring, but they differ in who responds, how much they do for you and what technology is included. This guide explains each model in plain language, compares them side by side and gives a practical way for Canadian SMBs to choose.
- [Penetration Testing Cost in Canada: What Drives the Price](https://cyberphore.com/guides/penetration-testing-cost-canada/): Penetration testing cost in Canada is driven mainly by scope: how many systems, applications and user roles are tested, which test types you need, and how much manual effort the work requires. This guide explains how tests are priced, what makes quotes differ, and how to scope a test that answers your real questions without paying for the wrong thing.
- [Privacy Breach Response in Canada: Who to Notify and When](https://cyberphore.com/guides/privacy-breach-response-canada/): After a privacy breach in Canada, you need to contain it, assess the risk of harm, and decide quickly who must be notified under PIPEDA, Quebec Law 25, Alberta PIPA or another applicable law. This guide sets out the steps, the legal tests, the people to call and the records you must keep.
- [SOC 2 Readiness for Canadian SaaS: A Practical Guide](https://cyberphore.com/guides/soc-2-readiness-canadian-saas/): SOC 2 readiness for a Canadian SaaS company means scoping the right systems and Trust Services Criteria, putting controls in place and operating them long enough for an independent CPA firm to test. This guide covers Type I vs Type II, realistic timelines, common gaps, auditor selection and the Canadian privacy issues buyers ask about.
- [vCISO Cost in Canada: How Virtual CISO Services Are Priced](https://cyberphore.com/guides/vciso-cost-canada/): The cost of a vCISO in Canada depends mostly on how many hours of senior time you need, what compliance work is involved and how much hands-on delivery is bundled in. This guide explains the common pricing models, the factors that drive cost, and how to compare proposals so you pay for outcomes rather than hours.

## Blog (analysis and briefings, newest first)
- [AI-Powered Phishing and Deepfake Payment Fraud in Canada](https://cyberphore.com/blog/ai-phishing-deepfake-payment-fraud-canada/): Generative AI lets fraudsters write flawless, personalized phishing at scale, clone an executive's voice and even stage live deepfake video calls. Canadian Anti-Fraud Centre data show spear phishing losses rising sharply in 2026. Because people cannot reliably spot synthetic voices or faces, finance teams should rely on process: call-backs to known numbers, dual approval and strict rules for banking changes. (AI and emerging threats; published 2026-11-14, last reviewed 2026-11-14)
- [Bill C-8 and Critical Cyber Systems: What Suppliers Must Do](https://cyberphore.com/blog/bill-c-8-critical-cyber-systems-suppliers/): Bill C-8 received royal assent on June 15, 2026. Its telecommunications amendments are in force, but the Critical Cyber Systems Protection Act is not yet in force and no operators are designated. Once they are, banks, telecoms, energy and transport operators must manage supply chain risk and report incidents within 72 hours, so their suppliers should expect tighter contracts, questionnaires and notice clauses. (Compliance and certification; published 2026-11-14, last reviewed 2026-11-14)
- [Canada's Cyber Threats for SMBs in 2026: What Matters Most](https://cyberphore.com/blog/canada-cyber-threats-small-business-2026/): For most Canadian small and mid-sized businesses, the threats that matter in 2026 are financially motivated: ransomware and data extortion, payment fraud through spoofed or compromised email, and AI-assisted impersonation, often entering through suppliers or unpatched edge devices. State actors matter mainly to firms in research, defence and government supply chains. The response starts with MFA, patching, tested backups and payment verification. (Threat landscape; published 2026-11-14, last reviewed 2026-11-14)
- [Choosing an MDR Provider in Canada: Questions and Red Flags](https://cyberphore.com/blog/mdr-provider-canada-how-to-choose/): Choose an MDR provider on five things: what it is allowed to contain without waiting for you, how it defines and reports response time, who staffs nights and weekends, where your logs and telemetry are stored, and how cleanly you can exit. Under PIPEDA you stay accountable for data a provider processes, and Quebec requires a privacy impact assessment before personal information leaves the province. (Choosing security services; published 2026-11-14, last reviewed 2026-11-14)
- [CPCSC for Defence Suppliers: Levels, Timeline, Preparation](https://cyberphore.com/blog/cpcsc-defence-suppliers-levels-timeline/): The Canadian Program for Cyber Security Certification (CPCSC) sets cyber security requirements for suppliers handling specified information on Canadian defence contracts. Level 1, an annual self-assessment of 13 controls from ITSP.10.171, has been available since April 1, 2026 and appears in select contracts. Levels 2 and 3 are still under development, with phased introduction signalled from spring 2027. (Government and defence suppliers; published 2026-11-14, last reviewed 2026-11-14)
- [Cyber Insurance Renewals in 2026: What Insurers Now Ask For](https://cyberphore.com/blog/cyber-insurance-renewal-canada-2026/): Canadian cyber insurance is a buyer's market heading into 2027: rates kept falling through 2026 and capacity is ample. Insurers still price on controls. Underwriters expect multi-factor authentication, endpoint detection, secure and tested backups, patching and an incident response plan, plus staff training and third-party risk management. The best terms go to organizations that can show evidence, not just tick boxes. (Cyber insurance; published 2026-11-14, last reviewed 2026-11-14)
- [Microsoft 365 Account Takeover: Attack Chain and Defences](https://cyberphore.com/blog/microsoft-365-account-takeover-controls/): Most Microsoft 365 account takeovers now get around multifactor authentication rather than break it: attackers steal session tokens through adversary-in-the-middle phishing, abuse device code sign-in, wear users down with push prompts or trick them into approving malicious apps. Phishing-resistant MFA enforced by conditional access, blocked device code flow, restricted app consent and monitoring for inbox rules close most of those paths. (Email, identity and Microsoft 365; published 2026-11-14, last reviewed 2026-11-14)
- [Quebec Law 25 in 2026: What the CAI's Enforcement Shows](https://cyberphore.com/blog/quebec-law-25-enforcement-guidance-2026/): All of Quebec Law 25 has been in force since September 22, 2024. The Commission d'accès à l'information reported no administrative monetary penalties and no penal fines for its 2025 to 2026 fiscal year, but confidentiality incident notices and complaints keep rising, and its recent published decisions have ended in binding orders. The CAI says the law covers any business handling Quebecers' personal information. (Privacy law and breach response; published 2026-11-14, last reviewed 2026-11-14)
- [Ransomware in Canada: Attacks, Recovery and Whether to Pay](https://cyberphore.com/blog/ransomware-canada-attacks-recovery-paying/): Ransomware remains one of the most disruptive cyber threats facing Canadian organizations. Most attacks start with phishing, stolen credentials or unpatched edge devices, and encryption usually lands outside business hours. Many organizations recover within weeks, but some take months. The Cyber Centre leaves payment to the victim, warns it guarantees nothing and notes it may breach sanctions or other laws. Preparation decides the outcome. (Ransomware and extortion; published 2026-11-14, last reviewed 2026-11-14)
- [SMB Security Baseline: 12 Controls That Stop Most Attacks](https://cyberphore.com/blog/small-business-security-baseline-12-controls/): A practical security baseline for a Canadian small business is 12 controls drawn from the Canadian Centre for Cyber Security's baseline for small and medium organizations, the same control areas behind CyberSecure Canada certification. Start with MFA, automatic patching, tested offline backups and an incident response plan, then add access control, email, network, supplier and device controls. Verify each with evidence, not assurances. (Small business security; published 2026-11-14, last reviewed 2026-11-14)

## Knowledge base
- [Do I have to report a data breach in Canada?](https://cyberphore.com/knowledge-base/do-i-have-to-report-a-data-breach-in-canada/): Yes, in many cases. Under PIPEDA, private-sector organizations must report a breach of security safeguards involving personal information to the Office of the Privacy Commissioner of Canada and notify affected individuals when it creates a real risk of significant harm, and must keep records of all breaches for 24 months. Quebec (Law 25) and Alberta (PIPA) have their own mandatory reporting rules, and sector rules may add more.
- [Does my small business need cyber insurance in Canada?](https://cyberphore.com/knowledge-base/does-a-small-business-need-cyber-insurance/): Most Canadian small businesses that rely on email, hold client or employee personal information, or move money electronically benefit from cyber insurance. It pays for incident response, legal advice, breach notification, business interruption and liability claims that general liability policies usually exclude. It does not replace security controls, and insurers increasingly require MFA, EDR and backups before offering coverage. Some contracts also require it.
- [Does security awareness training work?](https://cyberphore.com/knowledge-base/does-security-awareness-training-work/): Security awareness training works when it is short, frequent, relevant to people's actual jobs and paired with easy reporting of suspicious messages. It reduces risky behaviour and speeds up detection, but it will never get mistakes to zero, so it must be combined with technical controls such as MFA and email filtering. Measure success by how quickly staff report phishing, not just by simulation click rates.
- [What is the difference between EDR, XDR and MDR?](https://cyberphore.com/knowledge-base/edr-vs-xdr-vs-mdr/): EDR (endpoint detection and response) monitors laptops and servers for suspicious behaviour and allows remote response. XDR (extended detection and response) applies the same idea across endpoints, email, identity, cloud and network, correlating signals in one place. MDR (managed detection and response) is a service in which a provider's analysts run these tools for you 24/7 and respond to threats. EDR and XDR are tools; MDR is people.
- [How are criminals using AI deepfakes to scam businesses?](https://cyberphore.com/knowledge-base/how-do-deepfakes-target-businesses/): Criminals use AI deepfakes to impersonate executives, suppliers or job candidates with cloned voices, fake video calls and synthetic documents. The usual goal is an urgent payment, a change of banking details or access to systems. Seconds of public audio can be enough to clone a voice. The defence is process: verify any money or access request through a separate, pre-agreed channel, regardless of how real the caller seems.
- [How do I secure Microsoft 365?](https://cyberphore.com/knowledge-base/how-do-i-secure-microsoft-365/): To secure Microsoft 365, enforce MFA for every account, use phishing-resistant MFA for administrators, block legacy authentication, apply conditional access policies, separate admin accounts from daily accounts, enable Defender for Office 365 email protections, publish SPF, DKIM and DMARC, restrict third-party app consent, confirm audit logging is on, and have someone monitor sign-in and mailbox alerts. Business Premium licensing includes most of these controls.
- [How do I spot a phishing email?](https://cyberphore.com/knowledge-base/how-do-i-spot-a-phishing-email/): Spot a phishing email by checking for an unexpected request, pressure to act quickly, a sender address or link domain that does not match the real organization, a login page reached from an email link, or requests to change payment details. Modern phishing is often well written and may come from a real but hacked account, so verify unusual requests through a separate channel before acting.
- [How does ransomware get into a business network?](https://cyberphore.com/knowledge-base/how-does-ransomware-get-into-a-business/): Ransomware usually gets into a business through stolen or guessed passwords on remote access, unpatched internet-facing systems such as VPNs and firewalls, phishing emails that install malware, or a compromised IT supplier. Attackers then spend days or weeks moving through the network, stealing data and disabling backups before encrypting files. Closing those entry points and detecting the activity in between is what prevents most attacks.
- [How long does it take to recover from a ransomware attack?](https://cyberphore.com/knowledge-base/how-long-does-it-take-to-recover-from-ransomware/): Recovery from ransomware usually takes days to weeks to restore core operations, and often months to finish rebuilding, investigating and hardening. The biggest factors are whether clean, immutable backups exist, how far the attackers spread, whether the insurer and incident responders are engaged quickly, and whether there is a tested incident response plan. Paying a ransom rarely makes recovery much faster, since decryption is slow and unreliable.
- [How much does a penetration test cost in Canada?](https://cyberphore.com/knowledge-base/how-much-does-a-penetration-test-cost-in-canada/): Penetration test pricing in Canada depends on scope: the number of external IP addresses, internal network size, web applications and their complexity, cloud environments, testing type and whether a retest is included. Tests are usually quoted as fixed-fee projects based on estimated tester days. A narrow external test costs far less than a combined internal, external and application assessment. Always compare quotes on scope and methodology, not price alone.
- [How much does cybersecurity cost for a small business in Canada?](https://cyberphore.com/knowledge-base/how-much-does-cybersecurity-cost-for-a-small-business-in-canada/): Cybersecurity costs for a Canadian small business depend mainly on headcount, number of devices and servers, cloud footprint, compliance requirements and whether you need 24/7 monitoring. Managed security services are usually priced per user or per device per month, while assessments like penetration tests are fixed-fee projects. Prioritize MFA, monitored EDR, email security and backups first, since they address the most common attacks.
- [How should a small business back up data to survive ransomware?](https://cyberphore.com/knowledge-base/how-should-a-small-business-back-up-data/): A small business should follow the 3-2-1 rule: keep three copies of important data, on two different types of storage, with one copy offsite. To survive ransomware, at least one copy must be immutable or offline so attackers cannot delete it, backup systems need separate credentials with MFA, Microsoft 365 data should be backed up separately, and restores must be tested regularly against agreed recovery time and recovery point objectives.
- [How do I fill out a cyber insurance application questionnaire accurately?](https://cyberphore.com/knowledge-base/how-to-answer-a-cyber-insurance-questionnaire/): Answer a cyber insurance questionnaire by verifying each control against your actual systems, not policies or assumptions. Read words like all, every and enforced literally, involve your IT provider, gather evidence such as MFA and EDR coverage reports, and disclose gaps with remediation dates rather than ticking yes. Inaccurate answers can lead to denied claims, so have someone with technical knowledge review the final application.
- [How can I lower my cyber insurance premiums?](https://cyberphore.com/knowledge-base/how-to-lower-cyber-insurance-premiums/): To lower cyber insurance premiums, implement the controls underwriters weigh most: MFA everywhere, EDR with 24/7 monitoring, immutable or offline backups that are tested, fast patching, removal of unsupported systems, email security and privileged access controls. Document them with evidence, start renewal early, answer applications precisely and work with a broker who knows the cyber market. Adjusting deductibles and limits can also change price.
- [Should a mid-sized business build an in-house SOC or outsource to a SOC as a service provider?](https://cyberphore.com/knowledge-base/in-house-soc-vs-outsourced-soc/): Most Canadian businesses under about 1,000 employees should outsource their security operations centre. Running a 24/7 in-house SOC requires several analysts to cover every shift, vacation and sick day, plus a SIEM, EDR, threat intelligence and management, which costs far more than SOC as a service. An in-house SOC makes sense for large or highly regulated organizations; many mid-sized firms use a hybrid with internal staff and outsourced 24/7 coverage.
- [Is antivirus enough for a small business?](https://cyberphore.com/knowledge-base/is-antivirus-enough-for-a-small-business/): No, antivirus alone is not enough for a small business. Traditional antivirus blocks known malicious files, but most modern attacks use stolen passwords, phishing for Microsoft 365 sessions and legitimate admin tools that antivirus ignores. A small business needs at least MFA, endpoint detection and response (EDR) with someone monitoring it, email security, timely patching and tested backups. Antivirus is still useful as one layer.
- [Is SMS MFA good enough, or do we need phishing-resistant MFA?](https://cyberphore.com/knowledge-base/is-sms-mfa-good-enough/): SMS multi-factor authentication is much better than a password alone, but it is the weakest MFA method. Text codes can be phished, intercepted or redirected through SIM swapping. Authenticator apps with number matching are stronger for most staff. Administrators, finance staff and executives should use phishing-resistant MFA, such as FIDO2 security keys, passkeys or Windows Hello for Business, which cannot be captured by fake login pages.
- [What is the difference between an MSP and an MSSP?](https://cyberphore.com/knowledge-base/msp-vs-mssp/): A managed service provider (MSP) runs your day-to-day IT: devices, servers, Microsoft 365, networks, help desk and backups. A managed security service provider (MSSP) specializes in security: 24/7 threat monitoring, detection and response, vulnerability management and compliance support. Many SMBs use both. The MSP keeps systems running and patched, while the MSSP watches for attacks and responds, including attacks that abuse the MSP's own access.
- [What questions should I ask before choosing an MDR provider?](https://cyberphore.com/knowledge-base/questions-to-ask-an-mdr-provider/): Before choosing an MDR provider, ask what they monitor beyond endpoints, whether analysts can take containment action or only alert you, how quickly they respond and how that is measured, who the analysts are and where they work, where your data is stored, whether incident response is included, how they work with your IT provider, what reports you receive, and how you exit the contract.
- [Should we pay the ransom after a ransomware attack?](https://cyberphore.com/knowledge-base/should-we-pay-the-ransom/): Canadian authorities, including the Canadian Centre for Cyber Security and the RCMP, recommend against paying ransoms. Payment does not guarantee working decryption or deletion of stolen data, it funds further crime and it can mark you for repeat attacks. Paying is not generally illegal in Canada, but sanctions laws may prohibit payments to certain groups. Any decision should involve counsel, your insurer and experienced incident responders.
- [What is the difference between a vulnerability scan and a penetration test?](https://cyberphore.com/knowledge-base/vulnerability-scan-vs-penetration-test/): A vulnerability scan is an automated check that compares your systems against databases of known weaknesses, such as missing patches and misconfigurations, and should run continuously or at least monthly. A penetration test is a time-boxed exercise in which skilled testers manually try to exploit weaknesses, chain them together and show real business impact, usually done once a year or after major changes. Most businesses need both.
- [What does cyber insurance cover for a small business in Canada?](https://cyberphore.com/knowledge-base/what-does-cyber-insurance-cover/): Cyber insurance typically covers first-party costs such as incident response, forensic investigation, legal advice, breach notification, data restoration, business interruption and sometimes ransom or extortion payments, plus third-party liability for claims from clients, regulators and others after a breach. Coverage for social engineering fraud, contingent business interruption and regulatory fines varies widely, and many policies apply sublimits, waiting periods and exclusions.
- [What does cyber insurance require in Canada?](https://cyberphore.com/knowledge-base/what-does-cyber-insurance-require-in-canada/): Canadian cyber insurers commonly require multi-factor authentication on email, remote access and admin accounts, endpoint detection and response (EDR) on all devices, secure and tested backups with an offline or immutable copy, timely patching, email filtering, security awareness training and an incident response plan. Many also ask about 24/7 monitoring, privileged account controls and end-of-life systems. Missing controls can mean higher premiums, exclusions or a declined application.
- [What is a Microsoft 365 account takeover and how does it happen?](https://cyberphore.com/knowledge-base/what-is-a-microsoft-365-account-takeover/): A Microsoft 365 account takeover is when an attacker gains control of a user's Microsoft 365 account, usually by stealing the password and session through a phishing page, password spraying or infostealer malware. Once in, they read email, create hidden inbox rules, send fraud from the real mailbox and access OneDrive and SharePoint. Phishing-resistant MFA, conditional access and sign-in monitoring are the main defences.
- [What is a security operations centre (SOC)?](https://cyberphore.com/knowledge-base/what-is-a-soc/): A security operations centre (SOC) is the team, processes and technology that monitor an organization's systems for cyber threats, investigate alerts and respond to incidents, usually 24 hours a day. A SOC typically uses a SIEM, EDR and threat intelligence, with analysts triaging alerts, hunting for threats and containing attacks. Most small and mid-sized businesses use an outsourced SOC rather than building their own.
- [What is a SOC 2 report and do Canadian companies need one?](https://cyberphore.com/knowledge-base/what-is-a-soc-2-report/): A SOC 2 report is an independent CPA firm's report on a service organization's security controls, based on the AICPA Trust Services Criteria. A Type I report covers control design at a point in time; a Type II tests whether controls operated over a period, usually 3 to 12 months. No Canadian law requires SOC 2, but clients, especially American ones, often demand it from SaaS and service providers.
- [What is a supply chain attack in cybersecurity?](https://cyberphore.com/knowledge-base/what-is-a-supply-chain-attack/): A supply chain attack is a cyberattack that reaches its targets through a trusted third party, such as a software vendor, managed IT provider, cloud service or supplier, rather than attacking them directly. Examples include malicious software updates, compromised remote management tools and hacked supplier email accounts. For small businesses, the most common version is an attacker abusing an IT provider's access or a vendor's hacked mailbox.
- [What is a tabletop exercise in cybersecurity?](https://cyberphore.com/knowledge-base/what-is-a-tabletop-exercise/): A cybersecurity tabletop exercise is a facilitated discussion in which leaders and key staff walk through a realistic attack scenario, such as ransomware or a fraudulent wire transfer, to test their incident response plan. Participants talk through decisions step by step without touching live systems. A typical session runs two to three hours, reveals gaps in roles, contacts and procedures, and produces a short list of improvements.
- [What is a vCISO and does my business need one?](https://cyberphore.com/knowledge-base/what-is-a-vciso/): A vCISO (virtual chief information security officer) is a part-time, outsourced security executive who sets an organization's security strategy, manages risk, oversees compliance and reports to leadership, without the cost of a full-time hire. A vCISO typically builds the security roadmap, writes policies, handles customer and insurer questionnaires, prepares for audits and guides incident decisions. It suits businesses of roughly 20 to 1,000 employees without a security leader.
- [What is an incident response plan and what should it include?](https://cyberphore.com/knowledge-base/what-is-an-incident-response-plan/): An incident response plan is a written, tested set of procedures that tells your organization how to detect, contain, investigate, recover from and report a cybersecurity incident. A small business plan should name the response team and decision-makers, list external contacts such as the insurer, IT provider, lawyer and incident responders, define severity levels, include playbooks for common incidents and cover breach notification duties. Keep a copy offline.
- [What is Bill C-8 (the Critical Cyber Systems Protection Act) and does it apply to my business?](https://cyberphore.com/knowledge-base/what-is-bill-c-8/): Bill C-8 is federal legislation that amended the Telecommunications Act and enacted the Critical Cyber Systems Protection Act (CCSPA). It received royal assent in June 2026. The CCSPA applies to designated operators in federally regulated critical sectors, such as telecommunications, banking, pipelines, power lines, nuclear and transportation, requiring cyber security programs and incident reporting. Most SMBs are not directly covered, but suppliers to those operators will feel contractual pressure.
- [What is business email compromise?](https://cyberphore.com/knowledge-base/what-is-business-email-compromise/): Business email compromise (BEC) is a fraud in which a criminal uses a hacked or impersonated email account to trick staff into sending money or sensitive data. Typical versions are fake supplier invoices, changed banking details and urgent payment requests from a spoofed executive. BEC usually involves no malware, so antivirus rarely catches it. Payment verification by phone and phishing-resistant MFA are the strongest defences.
- [What is CPCSC certification for Canadian defence suppliers?](https://cyberphore.com/knowledge-base/what-is-cpcsc/): The Canadian Program for Cyber Security Certification (CPCSC) is a federal program requiring suppliers on certain Department of National Defence contracts to prove they protect sensitive unclassified information. It has three levels: Level 1 is an annual self-assessment, Level 2 an external assessment by an accredited certification body, and Level 3 the highest. Requirements are based on ITSP.10.171, the Cyber Centre's adaptation of NIST SP 800-171.
- [What is CyberSecure Canada certification?](https://cyberphore.com/knowledge-base/what-is-cybersecure-canada/): CyberSecure Canada is a voluntary federal cybersecurity certification program for small and medium-sized organizations, run by Innovation, Science and Economic Development Canada (ISED). Certification shows that a business has implemented baseline security controls derived from the Canadian Centre for Cyber Security's guidance for SMBs, such as MFA, patching, backups, secure configuration and incident planning. Audits are carried out by certification bodies accredited by the Standards Council of Canada.
- [What is MDR?](https://cyberphore.com/knowledge-base/what-is-mdr/): Managed detection and response (MDR) is an outsourced security service in which a provider's analysts monitor your endpoints, cloud accounts and network around the clock, investigate suspicious activity and take action to contain threats, such as isolating a device or disabling a compromised account. MDR combines detection technology, usually EDR, with a 24/7 human team, so small businesses get round-the-clock response without hiring their own security staff.
- [What is PIPEDA and does it apply to my business?](https://cyberphore.com/knowledge-base/what-is-pipeda/): PIPEDA, the Personal Information Protection and Electronic Documents Act, is Canada's federal privacy law for the private sector. It applies to organizations that collect, use or disclose personal information in commercial activity, except within provinces with substantially similar laws, and always to federally regulated businesses and cross-border transfers. It requires consent, appropriate security safeguards, breach reporting to the Privacy Commissioner and breach record-keeping.
- [What is Quebec Law 25?](https://cyberphore.com/knowledge-base/what-is-quebec-law-25/): Quebec Law 25, formerly Bill 64, is the law that modernized Quebec's private-sector privacy act. It requires businesses to designate a person in charge of protecting personal information, report confidentiality incidents that pose a risk of serious injury to the Commission d'accès à l'information, keep an incident register, conduct privacy impact assessments and obtain clearer consent. Its requirements phased in between 2022 and 2024, with significant penalties.
- [What is shadow AI and is it a risk for my business?](https://cyberphore.com/knowledge-base/what-is-shadow-ai/): Shadow AI is employees using AI tools such as chatbots, browser extensions, meeting transcribers or coding assistants without IT approval or oversight. The risk is that confidential client data, personal information or source code ends up in services your business has not vetted, which can breach privacy laws like PIPEDA and Quebec Law 25. Approving safe tools and setting a clear usage policy works better than outright bans.
- [What is zero trust?](https://cyberphore.com/knowledge-base/what-is-zero-trust/): Zero trust is a security approach that assumes no user, device or network is trustworthy by default, even inside the office. Every access request is verified based on identity, device health and context, users get only the access they need, and activity is monitored continuously. For a small business, zero trust mostly means strong MFA, conditional access, managed devices, least privilege and replacing broad VPN access.
- [What should I do if a Microsoft 365 email account has been hacked?](https://cyberphore.com/knowledge-base/what-to-do-if-microsoft-365-is-hacked/): If a Microsoft 365 account is hacked, reset the password, revoke all sessions and refresh tokens, remove any MFA methods and devices the attacker added, delete malicious inbox rules and forwarding, review and remove suspicious app consents, then search the audit log to see what was accessed and sent. Warn contacts who may have received fraudulent emails, and assess whether personal information was exposed and must be reported.
- [What should I do if I clicked a phishing link?](https://cyberphore.com/knowledge-base/what-to-do-if-you-clicked-a-phishing-link/): If you clicked a phishing link, report it to IT or your security provider immediately. If you entered a password, change it from a trusted device, revoke active sessions and check for new MFA methods and inbox rules. If you downloaded or opened a file, disconnect the device from the network but do not turn it off. Speed matters most: reporting within minutes can stop an account takeover.
- [Which cybersecurity framework should a small business use?](https://cyberphore.com/knowledge-base/which-cybersecurity-framework-should-a-small-business-use/): Most Canadian small businesses should start with the Canadian Centre for Cyber Security's baseline controls or CIS Controls Implementation Group 1, which give a practical, prioritized list of safeguards. Use NIST CSF 2.0 to organize and communicate your program to leadership. Pursue CyberSecure Canada, SOC 2, ISO 27001 or CPCSC only when customers, contracts or regulators require a formal certification or attestation.
- [Who do I call after a cyber attack in Canada?](https://cyberphore.com/knowledge-base/who-to-call-after-a-cyber-attack-in-canada/): After a cyber attack in Canada, call your cyber insurer's breach hotline first if you have coverage, then your incident response provider and IT provider to contain the attack, and a privacy lawyer to guide reporting. Call your bank immediately if money was sent. Report the incident to local police, the Canadian Anti-Fraud Centre and the Canadian Centre for Cyber Security, and to privacy regulators if required.
- [Why do cyber insurance claims get denied?](https://cyberphore.com/knowledge-base/why-are-cyber-insurance-claims-denied/): Cyber insurance claims are most often denied or reduced because the application overstated security controls, such as claiming MFA was on all remote access when it was not, because the insurer was notified late, because the business hired vendors without insurer consent, or because the loss falls under an exclusion or sublimit, such as social engineering fraud, war exclusions or prior known incidents. Accurate applications prevent most disputes.
- [Why do hackers target small businesses?](https://cyberphore.com/knowledge-base/why-do-hackers-target-small-businesses/): Hackers target small businesses because most attacks are automated and opportunistic, and SMBs often have weaker defences, no overnight monitoring and limited IT staff. Small firms still hold money, payroll, client data and access to larger partners. Criminals use stolen passwords, phishing and unpatched systems at scale, then pick whoever is easiest. Being small does not make you invisible, it makes you easier.

## Other
- [How we work](https://cyberphore.com/how-we-work/)
- [Glossary](https://cyberphore.com/glossary/)
- [Blog](https://cyberphore.com/blog/) and [editorial standards](https://cyberphore.com/blog/editorial-standards/)
- [Emergency incident response](https://cyberphore.com/emergency/)
- [Contact](https://cyberphore.com/contact/)