Cybersecurity Consultants near you

A vulnerability scan runs tools against your systems and lists known weaknesses it recognises. It is broad, repeatable and cheap in effort, and it is the right starting point for most small organizations. Its weakness is that it reports what is theoretically present without establishing what an attacker could actually reach or chain together, and it produces false positives that need a human to dismiss.

A penetration test is a person attempting to exploit weaknesses within an agreed scope and time window, demonstrating real impact: this account was reachable, that data could be extracted. It is narrower, more expensive in skilled time, and more useful once the obvious gaps from scanning are already closed. Paying for a penetration test while unpatched systems and shared administrator passwords remain in place tends to produce an expensive report confirming what a scan would have told you.

An assessment or audit is a structured comparison against a named standard or baseline, producing findings about process and governance as well as technology. Ask which of the three you are buying and insist the proposal name it, because scan output is sometimes repackaged and sold as an audit, and the difference is not visible in the cover page.

Ask any consultant what standard their findings are measured against. Without one, a report is a list of one person's opinions in no particular order, and you cannot tell whether it is complete. For smaller Canadian organizations the Canadian Centre for Cyber Security's baseline controls are a strong and citable anchor, published by the federal cyber security authority and aimed explicitly at organizations with fewer than 499 employees.

The baseline is organised as thirteen control areas: developing an incident response plan, automatically patching operating systems and applications, enabling security software including anti-malware and firewalls, securely configuring devices and changing default passwords, using strong user authentication with two-factor where feasible, providing employee awareness training, backing up and encrypting data, securing mobility and separating work from personal data, establishing perimeter defences, securing cloud and outsourced services, securing websites against common web application weaknesses, implementing access control with least privilege and unique accounts, and securing portable media.

That list is also a useful filter when you read a proposal. A consultant who moves straight to advanced tooling while several baseline areas are unaddressed is selling you the interesting work rather than the work that reduces your risk first.

Testing begins with written authorization, not enthusiasm. The engagement letter should name precisely which systems, addresses, domains and accounts are in scope, which are explicitly excluded, when testing may occur, and what the tester must do immediately if they find evidence of an existing compromise. Testing systems you do not own or control can require the owner's permission as well, which commonly applies to hosted platforms and cloud services governed by a provider's terms.

Agree in advance how findings will be delivered. A useful report gives each finding a severity, describes how it was confirmed, names the system affected, states who in your organization owns the fix, and separates the handful of things that need attention this month from the improvements that can wait. A wall of undifferentiated output does not help you act.

Build the retest into the engagement rather than treating it as a future purchase. Remediation frequently misses part of a finding or reintroduces it elsewhere, and an unverified fix is an assumption. The closing conversation should also cover what changed in your own understanding, since the point of the exercise is that your team can maintain the improvement after the consultant leaves.

The Cyber Centre's ransomware playbook puts preparation ahead of response. It recommends maintaining multiple backup copies stored offline, noting that storing backups offline offers the most protection against ransomware incidents, and testing restoration regularly rather than trusting the backup report. It also recommends multi-factor authentication, applying security patches, segmenting networks, using application allow lists, and training employees to recognise phishing.

On paying a ransom the guidance is discouraging and specific: payment does not guarantee recovery of data, validates the ransomware business model, funds organized crime, may raise anti-money laundering or sanctions issues, and does not prevent attackers from demanding more or selling stolen data regardless. A consultant who treats payment as a routine option rather than a last resort with legal consequences is not giving you the government's view.

Recovery in the playbook means isolating infected systems, reporting to law enforcement and the Cyber Centre, resetting credentials, scanning backups for malware before trusting them, reimaging systems, identifying how the attacker got in, and restoring into an isolated environment. Note that a ransomware event involving personal information can simultaneously trigger privacy obligations, so the technical response and the reporting assessment need to run in parallel rather than one after the other.

A security report is an inventory of the fastest routes into your business, which makes its handling part of the engagement rather than an afterthought. Agree who receives it, how it is transmitted, how long the consultant retains their copy and working data, and what is destroyed at the end. Ask the same about any data extracted during testing. The Privacy Commissioner's safeguards guidance expects protection proportionate to sensitivity, and few documents in your organization will be more sensitive than this one.

Confirm you receive the underlying evidence and not just a summary, that the report is yours to share with an insurer or a customer if you need to, and that raw tool output is available if a future consultant wants to compare. Where personal information is touched during the work, a written agreement covering its use, protection and return or destruction reflects the accountability that stays with you as the organization.

Finally, ask what the consultant expects of you after delivery. The engagements that change anything end with a short remediation plan your own people can execute and revisit, not with a document that is filed and rediscovered during the next incident.