A real look at where your business actually stands, security-wise.

A penetration test is one type of security check — a human actively tries to break in. It's expensive ($4,000-$25,000) and typically only makes sense once your obvious weaknesses are already closed off. A comprehensive security assessment is broader and comes first: we look at everything (vulnerabilities, configurations, policies, cloud posture, physical security, staff behaviour) and give you a prioritized roadmap. Think of it as the physical exam that comes before any specialist referral. Most Cape Breton businesses should do the assessment before spending on a pen test.

Vulnerability scans (which we also offer, from $29/mo) catch known technical vulnerabilities in your public-facing systems. They're valuable but they only see one slice — technical, external, automated. A comprehensive assessment looks at the whole picture: how your firewall is configured, whether your backups actually restore, whether your staff have MFA, whether your policies match your practice, whether someone could walk into your server room. Most breaches don't come from unpatched CVEs — they come from misconfigurations, weak policies, and human factors that a scan won't catch.

Often yes. Cyber-insurance carriers increasingly require documented security assessments as a condition of coverage or reasonable premium rates. If your renewal questionnaire is getting more detailed each year, a formal assessment is what most carriers actually want to see when they ask about "security posture." We can structure the deliverable to answer your carrier's specific questions if you send us the questionnaire in advance.

No. Everything we do is designed to be non-disruptive. External vulnerability scanning happens against your public-facing systems the same way an attacker would probe them — no impact to your operations. On-site work is walk-through observation and configuration review, not active testing that could crash a system. The whole assessment runs while your business runs.

A written PDF with an executive summary (readable by non-technical leadership), a detailed findings section (each risk rated Critical / High / Medium / Low with specific remediation recommendations), a prioritized 30/60/90-day roadmap, and — for the Comprehensive tier — compliance mapping showing where you stand against relevant frameworks. Everything is written to be actionable, not academic. Sample structure is available on request; email us if you want to see the format before booking.

Minimal disruption. We need: (1) one point of contact to answer questions and grant read-only access to systems, (2) an IT lead or vendor to attend the debrief if you have one, and (3) leadership availability for the executive briefing (Comprehensive tier only). We do the heavy lifting; you don't need to prep anything special.

That's your call. If you're an existing managed IT client of ours, remediation of the findings is folded into your regular support work. If you're not, you can hire us hourly for remediation, hand the report to your in-house IT team, or (for compliance-driven work) use it as a briefing document for a security consultant. The report is structured so any competent IT professional can act on it — you're not locked into using us for the fixes.

Some of it, in theory. In practice, in-house teams almost never do a full assessment on themselves — different priorities, blind spots to their own work, no time to write the report. An outside assessment brings fresh eyes, dedicated hours, and a written deliverable your leadership and insurance carrier can rely on. If your in-house team is thorough, they'll agree with 80% of our findings and have their own notes on the other 20% — that's a healthy assessment.