Security audits

A security audit evaluates your entire security posture (policies, processes, configurations, controls) using frameworks like ISO 27001, SOC 2 or NIST. A pentest simulates real cyberattacks to identify exploitable vulnerabilities and test defenses. We recommend combining both for optimal protection and compliance.

A full audit typically takes 2-6 weeks depending on your infrastructure size and complexity. For infrastructure audits: 2-4 weeks. Application audits: 1-2 weeks. Compliance audits (ISO 27001, SOC 2 prep): 2-4 weeks. We also offer express audits in 72 hours for critical risks.

No. Our audits are designed to be non-intrusive. Tests are scheduled with you and performed during agreed windows (often off-hours). We use safe methods that don't disrupt production systems. Destructive testing requires special coordination and approval.

Yes. You receive an executive summary for leadership and a detailed technical report with: identified vulnerabilities, risk levels (critical/high/medium/low), CVSS scores, proof of concepts, business impact and prioritized remediation steps with timelines.

Yes. All our audits include assessment of compliance with Quebec's Bill 25 on personal data protection. We review data handling, privacy policies, incident processes and security measures. We can also do a dedicated Bill 25 compliance audit.

Remediation timelines vary. Critical vulnerabilities: 1-2 weeks. High: 1-3 months. Medium: 2-6 months. Full compliance: typically 3-6 months depending on scope and complexity. We provide a remediation roadmap with prioritized steps and can support implementation.