Security

Real offensive depth

Testing and defence led by a published security researcher with five CVEs, including a CVSS 9.1 Mirai botnet kill-switch.

All security →
Testing & offensive
Penetration Testing
Web, network, and cloud, human-led
Vulnerability Management
Continuous scan, triage, remediation
Cloud Security Review
AWS, GCP, and Azure hardening
Enterprise Security Review
Find your exposed edges
AI & code
AI / LLM Security
Prompt injection, RAG, agent abuse
Vibe-Coding QA
Security review of AI-built code
LLM Red-Teaming
Adversarial testing for your model
Lead & respond
Fractional / Virtual CISO
Security leadership on tap
Retainers & Ongoing Work
Continuous compliance, security program, IR
Threat & Risk Assessment
Formal TRA for procurement
Security Questionnaire Response
We answer the questionnaires
Compliance

Audit-ready, fixed scope

SOC 2, ISO, CPCSC, and the Canadian privacy stack, run end to end with an independent auditor.

All frameworks →
Frameworks
SOC 2
Readiness + audit coordination
ISO 27001
ISMS, done properly
ISO 42001 (AI)
AI management system readiness
CPCSC (Defence)
Level 1 and Level 2
HIPAA
For digital health
PCI DSS
Scope reduction first
Program & audit
Gap Analysis
Know exactly where you stand
Internal Audit
ISO 27001 clause 9.2 and A.5.35
Auditor Management & Advocacy
We manage the auditor for you
Trust Center Setup
Speed buyer diligence
Vendor / Third-Party Risk
Assess your vendors
Canadian privacy
Outsourced Privacy Officer
External DPO and Law 25 contact
Quebec Law 25
The privacy law with teeth
PIPEDA
Federal privacy baseline
GDPR
EU data protection
Resources

Learn the space

Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.

Read the blog →
Learn
Research & CVEs
Our published vulnerability research
2026 Security Report
The state of startup security
Glossary
Security & compliance terms, explained
Library
Templates, checklists, and downloads
Tools & guides
Tools & Calculators
Free readiness and cost tools
Guides
Deep how-to walkthroughs
CPCSC Level 1 & 2 Guide
13 requirements, then all 98
Comparisons
traztech vs the platforms
Company
Blog
Buyer-focused security writing
Partners
Our offensive-security partner
Referrals
Refer a company, get rewarded
Case studies
Real engagements and the numbers behind them
How it works
The four phases, and what we need from you
FAQ
Common questions, answered
Services & offers

Productized security & compliance services

Fixed-scope engagements and readiness sprints across compliance frameworks, cloud security, security leadership, and AI governance. Every one is a door-opener into a longer advisory relationship, start small, scale when it works.

Book a discovery call
Security & compliance services

Security & compliance services

Audit Recovery

Your SOC 2 or ISO 27001 audit stalled, came back qualified, or hit a major nonconformity. We rebuild the evidence position and get you back into fieldwork once.

AWS Security Review

A security-focused review of your AWS environment (IAM, public exposure, misconfiguration, logging), not a cost audit. Findings prioritized by real risk.

CISO-as-a-Service

An outsourced CISO function on retainer (security strategy, compliance, and buyer trust), led by a published security researcher, without a full-time executive hire.

Cloud Security Assessment

A cloud posture assessment across AWS, GCP, and Azure (identity, network exposure, data protection, and misconfiguration), with risk-ranked findings.

Compliance Penetration Testing

A penetration test scoped and reported for SOC 2 or ISO 27001 audit evidence, delivered with our offensive-security partner Lorikeet Security.

Enterprise Security Review Response

We respond to a prospect’s enterprise security assessment or vendor audit on your behalf, so a big deal clears procurement without derailing your engineers.

Incident Response Tabletop

A half-day facilitated incident response exercise for exec, engineering, legal and comms, with an after-action report your board and insurer can both read.

Security Questionnaire Completion

Deal stuck on a buyer security questionnaire? We complete SIG, SIG Lite, CAIQ, VSA and custom questionnaires for you so the review clears fast.

SOC 2 Evidence Collection

Evidence gathering, control mapping, and audit prep for your SOC 2 examination, so you walk into the audit organized instead of scrambling for screenshots.

Third-Party Risk Management

Stand up a vendor and third-party risk (TPRM) program and run vendor security reviews, so your own buyers and auditors see supply-chain risk under control.

Trust Center Setup

We build a public trust center that answers buyer security questions before they ask (SafeBase / Vanta Trust style) so fewer deals stall on security review.
Framework readiness

Framework readiness

CPCSC Level 1 & 2 Readiness

CPCSC readiness for Government of Canada defence suppliers: the 13-requirement Level 1 self-assessment, or Level 2 against ITSP.10.171.

GDPR Readiness

EU GDPR readiness: lawful basis, data mapping, data processing agreements, DSAR handling, and breach procedures for companies serving EU residents.

HIPAA Readiness

HIPAA readiness for health-data companies: administrative, physical, and technical safeguards, risk analysis, BAAs, and policies to protect PHI.

ISO 27001 Readiness

Done-for-you ISO 27001 readiness: ISMS scoping, Statement of Applicability, control build-out, internal audit, and Stage 1/2 coordination.

NIST CSF Assessment

Assessment against the NIST Cybersecurity Framework (CSF 2.0) across its six Functions: Govern, Identify, Protect, Detect, Respond, and Recover.

PCI DSS Readiness

PCI DSS v4.0.1 readiness: cardholder-data environment scoping, gap assessment, SAQ guidance, and remediation for anyone handling payment card data.

PIPEDA Readiness

PIPEDA readiness for Canadian private-sector organizations: consent, safeguards, breach reporting, and access rights under Canada’s federal privacy law.
Deadline-driven readiness

Deadline-driven readiness

Cyber Insurance Readiness

Meet the security controls cyber insurers now require (MFA, EDR, tested backups, an IR plan) so you can get covered or bring your premium down.

EU AI Act Readiness

Conformity readiness for the EU AI Act. We map your high-risk (Annex III) AI systems to the Act’s obligations and close the gaps before enforcement lands.
Security leadership

Security leadership

Fractional CISO to Unblock an Enterprise Deal

A named CISO plus questionnaire and SOC 2 support to unstick a deal that’s blocked on the buyer’s security review.

Fractional Head of Security

Build and run your security function part-time (program, hiring, and roadmap) without paying for a full-time executive before you need one.

Interim CISO

A drop-in interim CISO to cover a departure, a crunch, or a gap between hires, keeping your security program moving without missing a beat.

Security Leadership for Fundraising

Security and technical due-diligence leadership to get you through investor or acquirer diligence: vCISO plus hands-on technical DD support.

vCISO for MSPs

White-label and overflow virtual-CISO capacity for MSPs and consulting firms: offer senior security leadership to your clients under your own brand.
AI security & governance

AI security & governance

AI Acceptable Use Policy

A practical internal AI acceptable-use policy your team will actually read and follow, clear rules for what tools, data, and uses are okay.

AI Governance Program

Stand up AI governance (an AI use policy, risk register, model inventory, and human-oversight controls) so your AI adoption is deliberate, not accidental.

AI Penetration Testing

A structured penetration test for AI-powered products, mapped against the OWASP LLM Top 10, from prompt injection to sensitive-data disclosure.

AI Vendor Risk Assessment

Assess the security and privacy risk of the AI tools and vendors your company adopts, before their data handling becomes your problem.

LLM Red Teaming

Adversarial testing of your LLM or agent app (prompt injection, jailbreaks, tool abuse, and data exfiltration), delivered with Lorikeet Security.

Shadow AI Audit

Discover the unsanctioned AI and LLM tools in use across your organization and bring them under governance before they leak data.
Get started

Not sure which fits?

Check our pricing, talk to a fractional CISO about ongoing leadership, or book a call and we'll point you to the right starting engagement.

Book a call