CyberSafe operates 24/7 detection and response, offensive testing and compliance programs for Canadian banks, utilities, hospitals, manufacturers and government teams. Our SOC has been on shift around the clock since 2016.
Most clients start with managed detection from our SOC, then add offensive testing, compliance work or embedded specialists as the program matures.
Our 24/7 SOC: analysts on shift around the clock with the SIEM, SOAR and XDR stack underneath them. We take the alert queue, hunt for what rules miss, and call you when something matters.
Penetration tests that read like incident reports, not checkbox exercises. Red team engagements when the SOC needs a real workout, and application testing wired into your CI pipeline.
Firewalls, endpoints, email gateways and identity, run by us on the vendors you already own. Palo Alto, Check Point, Cisco, Microsoft, Sophos and more.
Gap analysis, roadmaps, policy work and audit prep for ISO 27001, SOC 2, PCI DSS, PIPEDA and OSFI B-13. We have sat through enough audits to know what assessors look for.
Certified SOC analysts, detection engineers, cloud security specialists and GRC consultants embedded in your team for as long as you need them.
We are not here to sell licences or hours. Most clients come to us with tools already in place and need someone to make the program work properly.
The hard part is not the technology. It is keeping good analysts on shift for years, tuning detection so the queue stays survivable, and knowing what to escalate.
Pen testers who write their own tooling. GRC consultants who have worked the other side of the audit table. Analysts who rotate into threat hunting and detection engineering.
ISO 27001, SOC 2, PCI DSS, PIPEDA and provincial privacy regimes. We know which controls assessors care about and which ones they wave through.
Splunk or Sentinel, CrowdStrike or Cortex, Palo Alto or Fortinet. We pick the tools that fit each environment instead of reselling one stack.
Most onboardings follow this shape. Banks and federal clients take longer because of the compliance gates we clear together.
Attack-surface mapping, log review and stakeholder interviews. We benchmark against the framework your auditor cares about: NIST CSF, ISO 27001, PCI DSS or OSFI B-13.
SIEM, EDR, email, identity and network controls chosen for your environment. We integrate what you already own before recommending anything new.
Once ingestion is verified and runbooks are signed off, the SOC goes live. Analysts triage, hunt for what rules miss, and escalate only what matters.
Quarterly pen tests, annual red team, audit prep and awareness training. The work shifts from putting out fires to making sure new ones do not start.
Both started as internal tooling for our analysts. Clients kept asking for them, so we turned them into products. We still use them every day.
Aggregates, normalises and scores indicators from open-source, commercial and our own incident telemetry, then pushes the result straight into your SIEM.
Realistic phishing simulations that test how people actually respond, track awareness maturity over time, and reduce human risk without shaming anyone.
Most of our work is under NDA. These three clients gave us permission to name them. Reference calls with comparable organizations are available on request.
Next-generation firewall deployment and managed security across Ferring's global operations, with centralised policy and regional customisation for local compliance.
Dedicated CyberSafe professionals across SOC operations, cloud security, SIEM engineering and change management for one of the world's largest energy companies.
24/7 managed detection and response across 4,000+ locations, running Microsoft Sentinel and Defender for endpoint, identity, cloud and vulnerability management.
Every sector has its own regulator, its own threat actors and its own definition of an acceptable outage. We have done the work in each of these.
Banks, credit unions, insurers and fintech. SOC monitoring, fraud-adjacent detection and audit-ready evidence.
Federal, provincial and municipal agencies. Red team exercises, assessments and compliance programs for public-sector controls.
Hospitals, payers and life sciences. Ransomware defense for environments where downtime is a patient-safety problem.
Grid, pipeline and water operators. OT/ICS monitoring, SCADA segmentation and critical-infrastructure incident response.
Multi-site managed security for manufacturers. OT network segmentation, supply-chain risk and production-aware response.
SaaS and cloud-native companies. Application security, cloud posture assessments and DevSecOps that ships with the product.
Breach analysis, threat intelligence and company news, written by the analysts and consultants who do the work.
Migrating 240+ detection rules from IBM QRadar to Splunk Enterprise Security, backed by a flexible Cribl data pipeline.
Read the announcementCEO Dinis Fernandes on the good, the bad and the ugly of AI in offense and defense, and what Canadian security leaders should do now.
Read the recapState-aligned activity against Canadian targets increased year over year, with a 70% shift to encrypted web-protocol command and control.
Read the analysisA 30-minute scoping call with a pre-sales engineer, not a salesperson. We look at what you already have in place before recommending anything.
Tell us a little about your organization and what you need. A specialist replies within one business day.
A CyberSafe specialist will reply within one business day. If this is an active incident, email info@cybersafe.global with "URGENT" in the subject line.
