Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Securing AI use: the Cyber Centre’s 10 AI security measures
The Canadian Centre for Cyber Security's new primer sets out 10 AI security measures in three pillars. What each one asks for, and how it fits a PCI…
Read the insight →Post-quantum cryptography: why your first step is a cryptographic inventory
NIST's post-quantum standards are final and Canada has a federal migration roadmap to 2035. Why the first step is a cryptographic inventory, and how PCI DSS requirements 4.2.1.1…
Read the insight →AI in the payment environment: what the PCI SSC’s new AI guidance means for your scope
The PCI SSC published Security Considerations for AI Systems on 2026-09-15. AI is scoped like any other technology. Where chatbots, agents and shadow AI pull systems into PCI…
Read the insight →Phishing and ransomware: the PCI DSS 4.x controls that actually help
Ransomware is the top cybercrime threat to Canadian critical infrastructure and phishing remains a leading way in. Five PCI DSS 4.x requirements that reduce the risk for any…
Read the insight →You can’t lose what you don’t keep: reducing PCI scope by not storing card data
The most effective PCI DSS control is often the data you never hold. How hosted payment pages, tokenization and segmentation shrink your cardholder data environment, and the traps…
Read the insight →Most breaches still start with a known weakness: scanning and patching under PCI DSS 4.0.1
Vulnerability exploitation is now the leading way into a breach. Here is how PCI DSS 4.0.1 links risk ranking (6.3.1), patch deadlines (6.3.3) and internal and external scanning…
Read the insight →How a penetration test runs: from scoping to retest
What actually happens during a penetration test, step by step: scoping and authorization, reconnaissance, exploitation, reporting and the retest that PCI DSS requirement 11.4.4 expects.
Read the insight →PCI DSS v4.0.1: what the limited revision changed and what it did not
PCI DSS v4.0.1 clarified wording but added no new requirements. Here is what changed, what stayed the same, and what Canadian organizations should update now.
Read the insight →Which PCI self-assessment questionnaire applies to you? A plain guide for small merchants
A plain-language guide to choosing the right PCI DSS Self-Assessment Questionnaire, including the 2025 changes to SAQ A for e-commerce merchants using embedded payment forms.
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.