.svg)
Cybersecurity
Filter by Tag
How Does a DMARC Check Work? A Step-by-Step Guide to DMARC Validation
A DMARC check looks at a message that has already gone through SPF and DKIM, and asks one more question: does the domain that passed either of those...
How Does a DKIM Check Work? A Step-by-Step Guide to DKIM Verification
A DKIM check confirms two things about a message: 1) that a system holding the sending domain's private key signed it, and 2) that the signed parts...
How Does an SPF Check Work?
When a message arrives, the receiving mail server checks the sending domain's SPF record before it does almost anything else with the message. It...
SPF, DKIM and DMARC: How the Three Email Authentication Records Work Together
SPF, DKIM and DMARC work as a team to stop attackers from sending email that looks like it comes from a domain they do not control. SPF checks...
vCISO Services for Mid-Market SaaS: How to Evaluate Fractional Security Leadership in 2026
vCISO services give a mid-market SaaS company senior security leadership on a fractional basis: someone who owns the security program, drives SOC 2...
Top 8 vCISO Services for Mid-Market SaaS in 2026
The right vCISO service for a mid-market SaaS company is the one that owns and runs the security program end to end, on a fractional basis, the way a...
What Does a Security Architect Do?
A security architect does three jobs: sets security requirements for systems other people design, assesses and reviews those designs, and solutions...
How to Run a Security Assessment Across 90 Applications in 90 Days
When an application portfolio is too large to pen-test, an inquiry-based maturity assessment gets you a defensible, board-ready picture in weeks...
Designing Centralized Identity Across Hybrid Environments: A Security Architecture Walkthrough
Centralizing identity across cloud and on-prem environments is a security architecture problem before it is a tool-selection problem. You start by...
Security Architecture in Practice: The Questions Teams Actually Ask
Security architecture is the practice of designing how people, process, and technology work together to protect an organization's systems. It is not...
What Is Security Architecture? A Practitioner's Guide
Security architecture is the practice of understanding a system component by component and connection by connection. In practice it comes down to two...
How to Create a Security Architecture Diagram (With a Worked Example)
A security architecture diagram is a boxes-and-arrows drawing of a system: boxes for the key components, arrows for the data flows or network flows...
Who Advises on Security Architecture and Design? The Five Options Compared
Advice on security architecture and design should come from someone with a deep understanding of cybersecurity practice: ideally ten or more years in...
The Security Architecture Review Process: Phases, Checklist, and Deliverables
A security architecture review is a structured walk through a system's components and connections, checking each against security best practices and...
What Is a SOC Report? SOC 1, SOC 2, and SOC 3 Explained
A SOC report (System and Organization Controls report) is an independent auditor's attestation report on a service organization's controls, issued by...
Third Party Risk Management (TPRM): What It Is and How to Build a Program
Third party risk management (TPRM) is the discipline of identifying, assessing, and controlling the risks that come from the external organizations a...
What Is a Vulnerability Scan? What It Finds, What It Misses, and How Often to Run One
A vulnerability scan is an automated check that compares systems, software, and configurations against a database of known security weaknesses and...
Vulnerability Assessment Services: What They Include, What They Cost, and How to Choose a Provider
Vulnerability assessment services are engagements where a third party inventories an environment, scans it for known security weaknesses, validates...
Quebec Law 25 Compliance: The Privacy Law Every SaaS Company Should Know About (But Probably Doesn't)
Quebec Law 25 is the province's modernized private-sector privacy law: a set of amendments (adopted in 2021 as Bill 64) to the Act respecting the...
Build a Security Program Before Anyone Asks For One
Almost every first call I get starts the same way. Someone outside the company is suddenly asking for a security artifact. A prospect sent a...
Law 25 Compliance Checklist: What Security Teams Actually Need to Do
Quebec's Law 25 has been fully in force since September 2024, and the penalties are no longer theoretical. Under the Act respecting the protection of...
Canadian Cybersecurity & Compliance Statistics 2026
The bottom line for 2026: Canadian data breach costs rose 10.4% to CA$6.98 million even as the global average fell. Canada is the outlier, and the...
Bill C-8 Is Law: What Canada's Critical Cyber Systems Protection Act Requires, and Who It Reaches
Bill C-8 is now law. Its centrepiece, the Critical Cyber Systems Protection Act (CCSPA), places mandatory security obligations on operators in six...
CCSPA Cybersecurity Program Requirements: Every Obligation in Canada's New Law, Listed
A CCSPA cyber security program is a documented set of reasonable steps to identify and manage cyber security risk, protect critical cyber systems,...
Canadian Cybersecurity & Compliance Statistics 2026
The bottom line for 2026: Canadian data breach costs rose 10.4% to CA$6.98 million even as the global average fell. Canada is the outlier, and the...
What Vanta and Drata Can't Automate
Companies that implement Vanta or Drata expecting near-complete automation of their SOC 2 compliance work tend to hit the same wall. The integrations...
The Real Cost of a Data Breach in Canada (2025)
Canada is moving in the wrong direction on breach economics.
In 2025, the average cost of a data breach for a Canadian organization climbed to...
The Canadian Ransomware Paradox: Why Two Surveys Disagree on Payment
Two of the most-cited Canadian ransomware statistics flatly contradict each other.
Statistics Canada, reporting on 2023 data released in October...
After Bill C-27: Quebec Law 25 and Canadian Privacy Costs
For three years, the dominant story in Canadian privacy law was the federal one. Bill C-27, the Digital Charter Implementation Act, was on track to...
Why Frameworks Are Lenses on a Security Program
When the second framework arrives, most teams make the same mistake.
The first one, usually SOC 2, took nine to twelve months and a large chunk of...