Penetration testing services that include the retest, not just the report
Trusted by
Penetration testing services, three pillars, one operator.
One Canadian team agrees the scope, runs the test, and comes back after you've fixed it. Pen testing and ethical hacking are the same work under two names, and both belong to the engineer who has to explain the finding.
Scope and authorisation
Written rules of engagement, signed, naming what's in scope, what we won't touch, and which windows we work in.
The test
Network, web application, external and internal, run against a documented methodology rather than a scanner and a screenshot.
Report and retest
Findings your engineers can reproduce, then a second pass once the fixes land, so a closed finding is proven closed.
Does Penetration Testing work the same way in every industry?
No. The Penetration Testing work is the same craft in every sector, but the conditions around it are not. In financial services that means OSFI's technology and cyber risk rules; in government, Protected A, B and C data handling; and in defence and aerospace, controlled goods rules, CMMC and the flow-down from your prime. We keep the service and change the part that bends.
Testing at the cadence your regulator and your customers expect.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Protected A, B and C data handling decides where the work can run and who can touch it.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
Controlled goods rules, CMMC and the flow-down from your prime set what a supplier can do.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
Health information sits under provincial privacy law, and your IT provider is usually the custodian's agent.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
Solicitor-client privilege decides how a firm can handle its data.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
What do you need from Penetration Testing?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- Penetration Testing
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584Penetration testing in Canada, made real.
A test you can't reproduce isn't evidence. It's an invoice with severity ratings attached.
What good testing produces, and what your framework asks for.
Good testing produces two things: findings an engineer can reproduce without trusting you, and proof the fix worked. Most of this market delivers the first badly and skips the second entirely. Compliance is usually the trigger for Canadian buyers, so it's worth knowing what your framework asks for. PCI DSS v4.0.1 requires internal and external testing at least every 12 months and after any significant change, a documented methodology, segmentation testing, and remediation retesting under 11.4.4. Service providers test segmentation every six months, not twelve (source: PCI DSS v4.0.1, requirement 11.4).
Scope is where engagements go wrong, in both directions.
Too narrow and you buy a test of the one system you already trusted. Too broad and the days get spread so thin nothing gets tested properly. We write scope with you before quoting, name what we won't touch, and get it signed. That document is also your legal cover: testing systems without written authorisation is a criminal matter in Canada, not a technicality, and a reputable tester will insist on the paperwork before you do.
The report, and the retest the industry quietly bills for.
The other failure is the report. Severity scores without reproduction steps produce a month of argument between your developers and a PDF, which is how real findings die. Every finding we file carries the request, payload, or path that worked, so your team reproduces it in minutes and disputes nothing. Then we come back. The retest is what turns a finding into a fixed system, and charging separately for it is the industry's quiet habit.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow a network penetration test and web application pentest run.
Four steps, and step 01 is longer than clients expect. Scoping properly takes a conversation about what you're actually worried about, what's in production, what's behind which control, and which systems would hurt if we broke them. Skip that and you get a test of whatever was easiest to reach. We also agree the escalation path before starting, because occasionally a Canadian estate turns out to be compromised already, and nobody wants to be deciding who to call at that point.
Engagement phases
Phases 01 to 04
Scope and authorise
What's in, what's out, which windows, which contacts. Written rules of engagement, signed by someone in your Canadian entity who can sign them.
Test
External perimeter, internal network, web applications, against a documented methodology rather than a scanner and a screenshot.
Report with reproduction
Every finding carries the exact request or path that worked, ranked by what an attacker gains, not by raw score.
Retest
Once your fixes land, we test the same findings again and say plainly which are closed. That's what your auditor wants to see.
Penetration testing services questions, answered straight.
Answers first, including when a test is the wrong purchase. An architect takes the call, not a salesperson.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- SecurityNetwork SecurityCanadian network security services built by CCIEs, with segmentation, access control and firewall policy actually enforced.
- SecuritySecurity Awareness TrainingCanadian security awareness training run as a programme, with phishing simulation, coaching, and an auditor-ready record.
- SecurityThreat Risk Assessment (TRA)Canadian threat risk assessment mapped to the federal control catalogue that took effect in March 2026.
