Testing and defence led by a published security researcher with five CVEs, including a CVSS 9.1 Mirai botnet kill-switch.
All security →SOC 2, ISO, CPCSC, and the Canadian privacy stack, run end to end with an independent auditor.
All frameworks →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →There are four different businesses hiding behind the phrase, and picking the wrong one is the expensive mistake. Here is how to tell them apart, what to ask, and what things cost.
“Cybersecurity consulting” covers work that has almost nothing in common. A firm that gets you through a SOC 2 audit and a firm that breaks into your product are both cybersecurity consultancies, and hiring one when you needed the other wastes a quarter.
So this guide starts with the categories rather than a list of names. Work out which one you are buying and the shortlist writes itself.
| Category | What they sell | Buy when | Watch for |
|---|---|---|---|
| Compliance and readiness | Getting you to a SOC 2, ISO 27001, HIPAA, PCI DSS or CPCSC position, and coordinating the auditor | A buyer, regulator or investor is asking for a report or certificate | Firms that produce documentation without changing anything. Ask what they will fix, not just what they will write. |
| Offensive security | Penetration testing, red teaming, adversarial assessment of products and AI systems | You need to know what actually breaks, or a buyer wants proof of a test | Scanner output sold as a penetration test. Ask who tests, and whether a retest is included. |
| Managed security | Running detection, monitoring and response tooling for you, ongoing | You have systems to watch and nobody watching them | Alert volume you cannot action. Ask what happens at 2am and who actually responds. |
| Advisory and leadership | Fractional or virtual CISO, programme ownership, board and buyer reporting | Nobody senior owns security and buyers keep asking who does | Advice with no delivery behind it. Ask who does the work the advice creates. |
The Big 4 and the large national firms do serious work and carry a name that satisfies a nervous board. They are also expensive, usually staff engagements with juniors, and rarely interested below a certain deal size. If you are a fifteen-person SaaS company, you will get a partner in the pitch and an associate on the work.
Boutiques are cheaper and the person who sold you the work usually does it. The risk is depth and continuity: a two-person firm has no bench if someone is unavailable. Ask who covers your engagement if the lead is away, and ask it before you sign rather than when it happens.
Managed providers and MSPs increasingly sell compliance alongside IT. That can work well when the same team already runs your infrastructure. It works badly when compliance is a line item bolted onto a helpdesk contract and nobody on the team has been through an audit.
Frameworks like SOC 2 and ISO 27001 are international and a competent firm anywhere can run them. Canadian obligations are where local knowledge earns its fee: PIPEDA federally, Quebec’s Law 25 with its own privacy officer and breach duties, PHIPA for Ontario health data, CPCSC for defence supply chain, and OSFI expectations if you sell to a bank or insurer.
If you sell into the US as well, which most Canadian SaaS companies do, the useful firm is one that runs both without treating one as a translation of the other. CPCSC and CMMC, for example, share a control ancestry but are separate programmes with separate assessors.
We are a boutique. We do compliance readiness, offensive security with a partner firm, and fractional CISO work, for startups and growth-stage companies mostly selling into enterprise. We publish our prices on the pricing page because we think making you sit through a call to learn a number wastes everyone’s time.
We are not the right choice if you want a managed security service watching your estate around the clock, if you need a global firm’s name on the cover for board reasons, or if your problem is IT support rather than security. We will say so on the call rather than stretching a scope to fit.
What we do have that is checkable: five published CVEs including CVE-2024-45163, a CVSS 9.1 kill-switch for the Mirai botnet, a SOC 2 Type II built from nothing to zero exceptions across 76 controls, and 20+ penetration testing engagements. The detail is on our research page and the engagements are on our case studies.
We are based in Toronto and work across Canada and into the US. These pages cover what is specific to each market rather than repeating the same copy with a name swapped in:
If you already know the category you are buying, these go deeper: SOC 2 consultants in Canada, penetration testing companies in Canada, CPCSC readiness providers, and ISO 27001 consultants in Toronto.
It depends entirely on the category. Compliance and readiness firms get you to a SOC 2 or ISO 27001 report. Offensive security firms attack your systems and tell you what breaks. Managed providers run tooling for you day to day. Advisory firms supply leadership. Most companies need one of these, not all four, and buying the wrong category is the most common and most expensive mistake.
Fixed-scope work has published prices: a gap analysis from $3,000, penetration testing from $1,000, an incident response tabletop from $1,000, and a fractional CISO from $3,000 a month. Open-ended advisory retainers vary widely. Any firm that will not give you a starting figure before a discovery call is asking you to sit through a sales process to learn its price.
For SOC 2 or ISO 27001, not necessarily, since both are international. For PIPEDA, Quebec Law 25, PHIPA, CPCSC or OSFI expectations, a firm that works to Canadian law and Canadian guidance daily will save you time. If you sell into the US as well, look for one that runs both without treating Canada as an afterthought.
Who is doing the work, not who is selling it. What the deliverable is, in writing. Whether the price is fixed or an estimate. Whether a retest or a second pass is included. What happens if scope changes. And ask for something they have published, whether that is research, prices or a methodology, because a firm that publishes can be checked.
No, and for SOC 2 they cannot be the same firm. The audit report has to be issued by an independent CPA firm. A readiness consultant prepares you and coordinates that auditor. Anyone offering to both prepare and certify you for SOC 2 is describing something that is not a SOC 2 report.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation across 76 controls with zero exceptions, on a team of 15.
Free templates
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security. Free, no card. A short note from Jacob follows every few weeks.
From Jacob Masse, founder of traztech. No spam, unsubscribe in one click.