Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Securing AI use: the Cyber Centre’s 10 AI security measures
The Canadian Centre for Cyber Security's new primer sets out 10 AI security measures in three pillars. What each one asks for, and how it fits a PCI…
Read the insight →The EU Cyber Resilience Act: what Canadian exporters must report since 2026-09-11
Selling connected hardware or software into the EU? The Cyber Resilience Act's 24-hour vulnerability reporting duty applies since 2026-09-11, and the main obligations follow on 2027-12-11. Scope, deadlines,…
Read the insight →Post-quantum cryptography: why your first step is a cryptographic inventory
NIST's post-quantum standards are final and Canada has a federal migration roadmap to 2035. Why the first step is a cryptographic inventory, and how PCI DSS requirements 4.2.1.1…
Read the insight →Most breaches still start with a known weakness: scanning and patching under PCI DSS 4.0.1
Vulnerability exploitation is now the leading way into a breach. Here is how PCI DSS 4.0.1 links risk ranking (6.3.1), patch deadlines (6.3.3) and internal and external scanning…
Read the insight →How a penetration test runs: from scoping to retest
What actually happens during a penetration test, step by step: scoping and authorization, reconnaissance, exploitation, reporting and the retest that PCI DSS requirement 11.4.4 expects.
Read the insight →Multi-factor authentication for all access into the cardholder data environment: requirement 8.4.2 explained
Since 2025-03-31, PCI DSS requires MFA for all non-console access into the cardholder data environment, not only for administrators. Here is what that means in practice.
Read the insight →Penetration testing vs vulnerability scanning vs ASV scans: what PCI DSS actually requires
Vulnerability scans, ASV scans and penetration tests are different activities with different PCI DSS rules. Here is what requirements 11.3 and 11.4 ask for, and how often.
Read the insight →Segmentation testing: why reducing PCI scope needs proof
Segmentation can shrink PCI DSS scope, but only with proof. Merchants must test it yearly and service providers every six months, plus after changes. Here is what that…
Read the insight →Reporting a breach to the Privacy Commissioner: the “real risk of significant harm” test explained
Under PIPEDA, a breach must be reported when it creates a real risk of significant harm. Here is how to weigh sensitivity and probability of misuse, and what…
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.