Privacy and Compliance8 min read
How to use frontier AI on your data without exposing PII
Most firms don't need to train their own AI model to use AI safely on their data. What they need is a scrub-and-send pipeline in front of a model that already exists: scrub personal information (PII) locally, send placeholders, log every request, restore the real values on return. Here is how the pipeline works, when the expensive options earn their place, and how it lines up with Canadian and UK privacy rules.
Cybersecurity7 min read
The October 2026 PHP vulnerabilities: who is exposed and what to do this week
On October 21, 2026 the PHP project fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated web request run code on the server. The fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP runs about 69% of websites with a known server-side language, and roughly half of PHP sites sit on a branch that gets no official fix. Here is what the numbers mean and what to do.
Cybersecurity6 min read
Finding the balance: managed devices or browser-based access?
Should you keep shipping and maintaining company laptops with a full security agent stack, or move part of your workforce to browser-based access? The hard questions to ask so costs stay down without shrinking your security footprint.
CPCSC7 min read
How to self-attest for CPCSC Level 1 in CanadaBuys: a step-by-step walkthrough
CPCSC Level 1 is a self-assessment against 13 controls, recorded with an expiry date in your CanadaBuys supplier profile and checked at contract award. Here is the exact sequence, what to keep as evidence, and the mistakes that stall suppliers.
CPCSC7 min read
CPCSC vs CMMC: what a Canadian supplier to U.S. primes has to do twice
CPCSC and CMMC grow from the same NIST SP 800-171 root, but there is no published reciprocity, so a Canadian supplier selling into both defence markets needs both. Here is where they overlap, where they differ, and how to build once and attest twice.
CPCSC6 min read
What specified information means under CPCSC, and how to draw your assessment boundary
Specified information is any Government of Canada information a non-government organization must protect when it handles, processes or stores it. Under CPCSC, every device, person, facility and service provider that can reach it is in scope. Here is how to draw the boundary so the assessment is small and defensible.
CPCSC6 min read
CPCSC Readiness Consulting for Canadian Defence Suppliers
What CPCSC readiness actually involves for a Canadian defence supplier: the gap assessment, the controls, the System Security Plan, and how to choose a consultant.
CPCSC6 min read
CPCSC Readiness for Complex Defence Supply Chains
CPCSC requirements flow down from primes to the subcontractors that handle specified information. Here's how to run readiness across a multi-tier defence supply chain.
CPCSC5 min read
What is CPCSC and who needs it
CPCSC is Canada's mandatory cybersecurity standard for defence suppliers. Learn who needs it, what the three certification levels require, and when the deadlines hit.
CPCSC5 min read
CPCSC Level 1 vs Level 2: what defence suppliers need to know
CPCSC Level 1 and Level 2 share the same framework but differ in scope, verification, and cost. Here's a plain-language comparison to help you understand what each level actually requires.
Privacy and Compliance6 min read
PIPEDA compliance checklist for Canadian SMBs with contractors
PIPEDA applies to any Canadian business that collects personal information. For businesses using contractors, compliance is harder than most owners realize. This checklist covers what you need to have in place.
Cybersecurity5 min read
What are the CCCS Baseline Controls?
The Canadian Centre for Cyber Security publishes 13 baseline controls that define the minimum cybersecurity posture every Canadian organization should maintain. Here's what each control covers and what it takes to implement.
Cybersecurity5 min read
MSSP in Canada: Managed Security Costs and When You Need One
A three-person in-house SOC in Canada costs $500-800k a year. An MSSP does it for a fraction. Here's what managed security costs in Canada and when you actually need a provider.
Cybersecurity6 min read
Zero Trust explained for mid-market businesses
Zero Trust is a security model built on verified access rather than perimeter trust. For mid-market businesses, it's the most effective framework for modern threats. Here's what it means in practice and where to start.
CPCSC5 min read
How long does CPCSC Level 2 preparation take?
CPCSC Level 2 preparation typically takes three to six months, depending on your starting posture. Here's a realistic breakdown of each phase and what drives the timeline.
Workforce IT Governance5 min read
Workforce IT governance: what Canadian SMBs miss
Most Canadian SMBs are exposed in ways they have not mapped, whether they hire full-time staff, remote workers, or contractors. Here is what is typically missing and what the compliance consequences are.
Workforce IT Governance6 min read
The week you lose every time you hire someone
Every time a Canadian business brings someone on, a week disappears into IT logistics. Here is what that cycle costs and what it looks like when it stops.
