Assess your cybersecurity posture in two minutes.
Answer 12 questions to receive:
- → 01an indication of your maturity level
- → 02your main areas of risk
- → 03three priorities tailored to your situation
- → 04the type of support most relevant to your organization
No technical knowledge required.
What could a cyber incident cost your business?
Adjust the inputs to get a rough estimate. The goal is not to create fear but to understand the potential business impact.
This simulation provides broad estimates based on public studies, including the NetDiligence Cyber Claims Study 2025 and IBM Cost of a Data Breach Report 2025 for Canada. It is not an assessment of your organization’s actual risk. A tailored assessment is required for an organization-specific estimate.
How is this estimate calculated?
Starting point: $130,000 + $2,000 per employee. That amount is adjusted by an industry multiplier (professional services ×1.0; retail ×1.05; healthcare ×1.4; manufacturing ×1.2; financial services ×1.43; other ×1.0), informed by the sector cost differences in IBM’s Cost of a Data Breach Report 2025 for Canada, then increased by 30% when sensitive client information is held. The displayed range runs from half to double that midpoint, and the cost breakdown (incident response and forensics 30%, business interruption 28%, notification and compliance 22%, reputation 20%) follows the orders of magnitude in the NetDiligence Cyber Claims Study 2025. These parameters are illustrative estimates calibrated to those public studies, not an actuarial model of your risk.
Do any of these sound familiar?
Cybersecurity may not be your core business. The consequences of an incident still land directly on your organization.
"I do not even know whether we are vulnerable"
Without an assessment, you are making decisions without a clear view of your exposure. You do not know what an attacker would see when looking at your network.
"My insurer is asking for proof of security"
Cyber insurers increasingly require documented evidence. You may know controls are in place, but not what evidence to provide.
"We cannot justify a full-time cybersecurity executive"
You know the issue matters, but a full-time role is not realistic. You need senior expertise without adding a permanent executive salary.
"Our IT provider says everything is fine"
You still have no independent evidence: no report, no score, and nothing concrete to present to leadership.
"Technical reports do not help me make decisions"
Security reports are often filled with jargon. You need to know what to do next, not read 200 pages of CVE references.
"Cybersecurity is only a concern for large companies"
Small and mid-sized businesses are frequent victims of cyberattacks. Your size does not make you invisible; limited resources can make you easier to target.
See clearly, prioritize, act
Practical services aligned with your size, budget, and business priorities.
View all servicesMost likely. It covers businesses that handle personal information in Quebec, whether about customers or employees, and company size alone does not exempt you.
A scan finds known technical weaknesses. An audit looks more broadly at your practices: access, backups, suppliers, governance. A penetration test checks, with your authorization, what an attacker could actually achieve.
Activate your response plan, isolate affected systems without destroying evidence, then bring in your IT provider, an incident-response specialist and, where relevant, your insurer. Avoid improvised actions.
Yes. Many attacks are automated: they look for compromised accounts, exposed services or vulnerable software, regardless of company size.
Not entirely. Microsoft protects its infrastructure, but your accounts, access, sharing rules and configurations remain your responsibility.