A local practitioner for your citizen-facing web services.

What usually starts the conversation

O. Reg. 51/26 maturity assessments due July 1, 2027 for hospitals, colleges, universities, school boards and children's aid societies; municipal privacy-impact and breach-reporting obligations from January 1, 2027; insurer requirements; a group-purchasing pentest agreement re-tender in early 2027.

The objections we hear, answered

"We need a firm with references" — we start as a subcontractor under a prime and target sub-threshold purchases. "We need 24/7" — a named partner SOC delivers it; we do onboarding, tuning and reporting.

The proof we bring

Security schedule aligned to GO-ITS 25.0 and municipal data-residency guidelines; insurance; a lab-based municipal-style case study; council-ready summary template.

How an engagement runs

1. Discovery and conflict screen. Twenty minutes to confirm scope, authorization and that nothing puts us in conflict.
2. Written authorization. Engagement letter and rules of engagement signed by both sides before any testing.
3. Find, fix, retest. Named practitioner, agent-assisted, on a dated plan with a report due date and a retest date.
4. Attestation. The letter is issued only after the retest record exists. Evidence hashes included.