Author: Paul Thresher

You have decided your business needs a penetration test. Maybe a SOC 2 auditor asked for one, maybe a client’s security questionnaire demands it, or maybe you simply want to know whether your defences hold up. Then you request three quotes and they come back at $3,000, $14,000, and $55,000 for what looks like the same thing. The spread is not a mistake, and understanding it is the difference between buying real security assurance and buying a scan with a nice logo on the cover.

This guide breaks down what a penetration test actually costs in Canada, what drives the price up or down, and how to budget without overpaying or, worse, underpaying for a test that misses the flaws an attacker would find.

Most penetration tests for mid-market Canadian businesses land between $5,000 and $30,000 CAD, with the majority of scoped engagements we see for GTA companies falling in the $8,000 to $20,000 range. Price is driven mainly by scope (how many IP addresses, applications, and environments are in play) and methodology (how much of the work is manual expert testing versus an automated scan). A single external network test starts around $5,000; a full objective-based red team engagement can exceed $50,000.

How much does a penetration test cost in Canada?

In Canada, penetration tests typically cost between $5,000 and $30,000 CAD, with most mid-market engagements falling in the $8,000 to $20,000 range. The exact figure depends on what you are testing and how deeply. A narrow external network test sits at the low end, while a broad web application test or a multi-environment engagement climbs toward the top. The table below reflects the typical ranges we scope for mid-market clients across Toronto and the GTA.

These ranges assume manual testing by certified professionals, not an automated scan. A one-off scan of a small environment can be had for under $2,000, but it is a different product. For a fuller breakdown of the test types themselves, see our guide on what penetration testing is and the types available.

What affects the price of a penetration test?

The single biggest cost driver is scope: the number of live IP addresses, applications, user roles, and environments in play. When we scope a test for a GTA client, the quote moves on the count of targets far more than on the vendor’s day rate. A 5-page brochure site and a 40-screen customer portal with three user tiers are both “a web app,” but the second takes five times the effort to test properly.

Beyond raw scope, these factors push the number up or down:

• Methodology and manual depth. Automated scanning is cheap. Skilled humans chaining vulnerabilities together, the way a real attacker does, is where the cost and the value sit.
• Tester seniority and certifications. OSCP, GPEN, and CREST-certified testers command higher rates because they find what junior testers and tools miss.
• Retesting. A reputable firm retests after you fix findings to confirm the holes are closed. Some vendors bundle one retest; others charge extra.
• Reporting depth. A prioritized report with business context and remediation guidance costs more to produce than a raw tool export, and it is worth it when you have to hand it to an auditor or a board.
• Compliance requirements. Tests scoped to satisfy SOC 2, PCI DSS, or PIPEDA expectations follow stricter methodologies and documentation standards.

What do you actually get at each price tier?

Price tier maps directly to how much human expertise is involved and how usable the output is. A budget engagement is largely tool-driven and rarely satisfies an auditor. A mid-market engagement blends manual testing with automation and produces a report you can act on and defend. A premium engagement simulates a determined adversary against specific objectives. The table shows what separates them.

Penetration test vs vulnerability scan: why the price gap?

A vulnerability scan and a penetration test are different products at different prices because they answer different questions. A scan is an automated tool that lists known weaknesses, often hundreds of them, with no confirmation of which are actually exploitable. It costs a few hundred dollars and takes hours. A penetration test uses those findings as a starting point and has a human confirm what an attacker could truly reach, chaining flaws together to reach real business impact. That expert time is why a test costs 10 to 40 times more than a scan.

Both have a place. Run vulnerability scans continuously to catch new issues cheaply, and commission a penetration test periodically to validate your actual exposure. The mistake is paying scan prices and expecting test-grade assurance, or paying test prices for what turns out to be a scan.

Do you need a penetration test for SOC 2 or PIPEDA compliance?

For most Canadian mid-market businesses, yes, at least in practice. PCI DSS explicitly requires annual penetration testing for organizations that handle cardholder data. SOC 2 does not name penetration testing in the criteria, but auditors routinely expect one as evidence that you actively test your controls, and a missing test is a common finding. Under PIPEDA and Quebec’s Law 25, businesses must protect personal information with safeguards appropriate to its sensitivity, and regular testing is how you demonstrate that duty of care.

Here is the practical part that saves money: nine times out of ten, the SOC 2 auditor wants an external network test plus a web application test, not the full red team engagement a vendor may try to upsell. Scoping the test to the compliance requirement, rather than to the biggest possible engagement, is one of the easiest ways to control cost without failing the audit. If compliance is your driver, our compliance readiness team scopes the test to exactly what your framework requires.

How should you budget for penetration testing?

Budget from your risk and your obligations, not from a competitor’s invoice. Start by defining what a breach of each system would actually cost you, then scope the test to protect what matters most. Use this framework to arrive at a defensible number.

For most GTA mid-market companies, a realistic first-year budget of $10,000 to $18,000 CAD covers a properly scoped external and web application test with remediation retesting. Choosing the right partner matters as much as the budget, and our guide on how to choose a penetration testing company in Toronto walks through what to vet.

At BALANCED+, we have scoped and delivered penetration tests for mid-market businesses across Toronto and the GTA since building our security practice, and we price every engagement to the client’s actual attack surface and compliance requirements, not a one-size template. As a SOC 2 and ISO 27001 certified MSSP with a 24/7 security operations centre, we scope the test you need and help you fix what it finds. Explore our penetration testing services or get a scoped quote for your environment.

Sources

• Cost of a Data Breach Report 2024, IBM Security, 2024.
• PCI DSS v4.0 Requirements and Document Library, PCI Security Standards Council, 2024.
• The Personal Information Protection and Electronic Documents Act (PIPEDA), Office of the Privacy Commissioner of Canada.

If your business runs a FortiGate firewall or Fortinet SSL VPN, this week’s headlines deserve a measured response, not panic. A credential-harvesting campaign that researchers have nicknamed “FortiBleed” is circulating working login credentials for tens of thousands of internet-facing Fortinet devices worldwide. Here is the part the alarming name obscures: there is no new zero-day. The credentials were largely stolen in earlier Fortinet compromises and are now being fired back at organizations that never rotated them.

This post breaks down what FortiBleed actually is, what Fortinet has said about it, why it still poses real risk despite being “old” data, and the specific steps Canadian mid-market teams should take to close the exposure.

What is FortiBleed?

The campaign came to light after security researcher Volodymyr “Bob” Diachenko found an attacker-controlled server left publicly accessible, exposing the operation’s stolen credentials, victim lists, and tooling. Threat intelligence firm SOCRadar independently analyzed the same infrastructure and rated the campaign critical. The scale is what makes it notable: depending on the dataset analyzed, researchers count between roughly 74,000 and 87,000 affected devices and tens of thousands of verified working credentials across more than 22,000 domains.

What has Fortinet said about FortiBleed?

Fortinet has stated it is aware of the credential-harvesting activity targeting FortiGate firewalls and VPN devices, but that the activity is based on data from previous incidents and is not related to any recent incident or advisory. In other words, attackers are reusing previously exposed credentials and applying brute-force techniques against devices, rather than exploiting a new flaw in current Fortinet products.

This matches what security researchers concluded after examining the dataset: there is no associated CVE or patch for “FortiBleed” itself because there is no new vulnerability. Much of the credential and configuration data traces back to older Fortinet compromises, including devices exploited through CVE-2022-40684, an authentication-bypass flaw from 2022. The data was collected years ago and is now being recirculated and tested at scale.

Why is patching alone not enough?

Because the exposed credentials remain valid regardless of firmware version. Security researcher Kevin Beaumont noted that many of the affected devices were on fairly recent patches, and that the data appears to have come from exports of device configurations. A fully patched device still grants access to anyone holding a credential that was never rotated.

How older credentials were stored compounds the problem. Many devices still hold passwords hashed with salted SHA-256, which is feasible to crack offline with modern GPU hardware. Fortinet moved to the stronger PBKDF2 algorithm with randomized salt in early 2025, but devices upgraded without an administrator logging back in often keep the older, weaker hashes in place. In short: a device can be patched to the latest firmware and still be carrying crackable, never-rotated credentials.

How does the FortiBleed campaign work?

FortiBleed is built on industrialized automation rather than manual hacking. According to SOCRadar’s analysis of the exposed attacker server, the operation runs as a self-perpetuating cycle: scan, validate, harvest, repeat. The mechanics break down into three reinforcing techniques.

The end goal is straightforward and dangerous: valid credentials let an attacker log in as a legitimate user, reach the firewall and the network behind it, change security controls, and create backdoor accounts. Researchers traced the cracked passwords being used to pivot into internal Active Directory environments, which turns a perimeter exposure into a full network compromise.

Who is affected, and does it reach Canadian businesses?

Yes. With devices in 194 countries and over 20 percent of entries tied to enterprises with $1B+ in revenue, the dataset is global and includes Canadian organizations. Named victims reported in coverage include major brands such as Samsung, Siemens, Foxconn, Oracle, Accenture, and DHL, alongside government agencies in critical-infrastructure sectors.

Telecom was the single most-targeted sector, followed by government, with healthcare and finance also heavily represented. For Canadian mid-market firms, the compliance stakes are real: a credential-driven breach can trigger mandatory breach reporting under PIPEDA, and regulated organizations in finance or healthcare face additional obligations under OSFI guidance and PHIPA. The Canadian Centre for Cyber Security has repeatedly flagged edge devices like VPN gateways as a priority target, and FortiBleed is a textbook example.

What should you do right now?

If your organization runs internet-facing Fortinet appliances and has not rotated credentials in the last few years, treat your existing credentials as potentially exposed until proven otherwise. The actions below are the same whether or not your specific device is in any dataset, because they close the reuse window that FortiBleed depends on. From a security operations standpoint, the response order matters: contain access first, then verify exposure, then harden.

Patching vs. credential hardening: where to focus

FortiBleed is a reminder that perimeter security is about identity as much as firmware. The table below maps the common assumption against the reality of this campaign, so you can prioritize the actions that actually reduce risk.

If you are not certain whether your Fortinet devices store crackable hashes, expose their management interface, or enforce MFA on every session, that uncertainty is the gap attackers are counting on. As a managed security partner to Canadian mid-market firms, our team handles exactly this kind of rapid exposure review: credential rotation, MFA rollout, and locking down edge devices. Start with our managed Fortinet firewall services, harden access with a zero-trust MFA rollout, or get continuous detection through our MDR and XDR service. If you suspect you are already affected, our incident response and forensics team can help you scope and contain it.

Frequently asked questions

Is FortiBleed caused by a Fortinet vulnerability?

No. Fortinet has stated the activity is not related to any recent incident or advisory, and there is no CVE or patch for “FortiBleed” because it is not a new flaw. It is a collection of credentials harvested in earlier compromises, some tracing back to CVE-2022-40684 in 2022, now being reused and brute-forced against live devices. That is why patching alone does not resolve it: you have to rotate the old credentials and re-hash passwords with PBKDF2.

How do I know if my Fortinet device is affected?

Assume potential exposure if any FortiGate or Fortinet SSL VPN interface is reachable from the internet. Review VPN and admin login histories for unfamiliar source addresses, check for unauthorized admin accounts or configuration changes, and watch for unusual Active Directory activity. Threat-intel lookup tools released alongside the campaign can also indicate whether your domain appears in the dataset.

Does enabling MFA fix the problem?

MFA is essential but not sufficient on its own. It blocks attackers from reusing stolen passwords, which is critical, but you still need to rotate the exposed credentials, remove the management interface from public internet access, and re-hash stored passwords to PBKDF2. MFA is one layer of a four-part response, not a single fix.

What are the compliance implications for Canadian companies?

A credential-driven breach can trigger mandatory breach-of-security-safeguards reporting to the Office of the Privacy Commissioner under PIPEDA, with notification to affected individuals where there is a real risk of significant harm. Regulated organizations in finance or healthcare may have further obligations under OSFI guidance or provincial health-privacy laws such as PHIPA. Document your response and timeline carefully.

Sources

• FortiBleed campaign exposes 75,000 Fortinet firewalls worldwide, CSO Online, 2026
• Fortinet FortiBleed data leak, Help Net Security, 2026
• FortiBleed: Fortinet Firewalls Compromised, SOCRadar, 2026
• CVE-2022-40684 Detail, NIST National Vulnerability Database, 2022
• Sweeping Credential-Harvesting Heist Compromises 30K Fortinet Devices, Dark Reading, 2026
• FortiGuard Labs Outbreak Alerts, Fortinet, 2026
• Respond to a privacy breach at your business, Office of the Privacy Commissioner of Canada, 2026

Most small businesses assume their email is secure because it’s hosted on Microsoft 365 or Google Workspace. That assumption gets expensive fast. Default filtering blocks obvious spam, but it doesn’t stop the targeted phishing campaigns, business email compromise attempts, and vendor impersonation attacks that make up the majority of successful breaches today.

This post covers what effective email security for a small business actually includes, where Microsoft 365’s built-in tools stop and where you need additional layers, and what a competent managed IT provider should be handling on your behalf.

Default email filtering is not enough. Small businesses need layered protection: authentication records (SPF, DKIM, DMARC), advanced phishing protection, BEC detection, email encryption, and ongoing monitoring. If your MSP isn’t actively managing these, your email environment is likely exposed.

Email security is the set of technologies, processes, and policies used to protect an organization’s email infrastructure from threats including phishing, malware delivery, business email compromise, spam, and unauthorized access. For small businesses, email security covers both inbound threat filtering and outbound controls: authentication records, encryption, data loss prevention, and user-facing protection against social engineering attacks.

Why Email Is Still the Top Attack Vector for Small Businesses

Email isn’t a legacy problem that newer tools have solved. It remains the primary delivery mechanism for the majority of cyberattacks because it works. According to the Verizon 2024 Data Breach Investigations Report, over two-thirds of breaches involve the human element: phishing, stolen credentials, and social engineering. Email is the most common vehicle for all three.

Small businesses are disproportionately targeted for a specific reason: they often have weaker controls than enterprises but handle valuable data (customer records, financial transactions, legal documents, health information) that attackers can monetize or ransom. A law firm with 20 employees is a much softer target than a bank, but it holds equally sensitive material.

What’s Built Into Microsoft 365 vs. What You Actually Need

Microsoft 365 includes Exchange Online Protection (EOP) on every plan: spam filtering, basic malware scanning, and some phishing detection. On Business Premium and above, you also get Microsoft Defender for Office 365 Plan 1, which adds safe links, safe attachments, and anti-impersonation protection. That’s a meaningful baseline, but it has well-documented gaps that attackers actively exploit.

Capability	M365 EOP (all plans)	Defender for O365 P1 (Business Premium)	What you still need
Spam and bulk filtering	Yes	Yes	Tuning and custom rules
Basic malware blocking	Yes	Yes	Sandbox detonation for zero-day payloads
Anti-phishing (generic)	Basic	Enhanced	AI-based behavioral detection
Safe Links (URL rewrite)	No	Yes	Time-of-click re-evaluation
Safe Attachments (sandbox)	No	Yes	Extended detonation window
Anti-impersonation (BEC)	No	Yes	Vendor and third-party impersonation detection
SPF / DKIM / DMARC enforcement	Partial	Partial	Full DMARC enforcement with reporting
Email encryption (S/MIME, OME)	No	No	Requires separate configuration
Outbound DLP	No	No	Microsoft Purview or third-party DLP
Security awareness training	No	Attack Simulator (basic)	Dedicated phishing simulation platform

The practical gap is the bottom half of that table. Most small businesses on M365 Business Basic or Standard are running EOP only, roughly equivalent to a locked front door with no alarm system.

The Core Email Security Controls Every Small Business Needs

These aren’t optional extras. They’re the baseline. If any of them are missing from your environment, you have an exploitable gap.

SPF, DKIM, and DMARC records: These DNS-based authentication standards verify that emails claiming to come from your domain actually originate from your servers. Without them, attackers can spoof your domain and send fraudulent emails that look like they came from you, a common tactic in vendor fraud and invoice scams. DMARC enforcement (policy set to “reject”) is the end goal; SPF and DKIM are prerequisites. Many Canadian small businesses have SPF configured but have never moved DMARC beyond “p=none,” which monitors but doesn’t block anything.

Advanced phishing and impersonation detection: Generic anti-phishing rules look for known malicious indicators. Modern attacks use newly registered domains, lookalike URLs, and hijacked legitimate accounts, none of which trigger rule-based filters. AI-based detection that analyzes sender behavior, email patterns, and content anomalies catches what rules miss.

Safe attachments with sandboxing: Attachments are detonated in an isolated environment before delivery. Standard antivirus scans signatures; sandboxing catches zero-day payloads that haven’t been seen before. This is especially important for businesses that regularly receive documents from external parties: accounting firms, law offices, healthcare providers.

Email encryption for sensitive communications: Not every email needs encrypting, but if your business handles personal health information under PHIPA, legal communications, or financial data, you need a mechanism to encrypt specific messages and attachments in transit and at rest. Microsoft 365 Message Encryption (OME) and S/MIME both work, and neither is configured out of the box.

Phishing simulation and user training: Technical controls catch a lot, but not everything. The most effective defence against the emails that get through is a trained user who recognizes the warning signs. Quarterly phishing simulations with targeted training for users who click are standard practice at any well-run MSP. Platforms like KnowBe4, Proofpoint Security Awareness Training, and Microsoft Attack Simulator all handle this at different price points.

Business Email Compromise: The Threat Most Filters Miss

Business email compromise (BEC) is the most financially damaging email threat facing small and mid-market businesses, and it’s the one that standard filters are worst at catching. BEC attacks don’t deliver malware. They use social engineering: impersonating a CEO, CFO, or vendor to request a wire transfer, change a payroll account, or redirect an invoice payment.

According to the FBI Internet Crime Complaint Center (IC3) 2023 Annual Report, BEC resulted in over $2.9 billion USD in reported losses in the United States alone. Canadian businesses face the same threat and report incidents to the Canadian Anti-Fraud Centre (CAFC), which has tracked consistent increases in business fraud losses year over year.

BEC attacks often come from legitimate, compromised email accounts rather than spoofed domains, which means SPF, DKIM, and DMARC alone won’t stop them. Detection requires behavioral analysis: flagging unusual sending patterns, login anomalies, and out-of-character requests. This is why BEC detection needs to be explicitly configured, not assumed.

For a deeper look at how BEC works and how to recognize the warning signs, see our post on What Is Business Email Compromise (BEC).

What Your MSP Should Be Managing for Email Security

If you’re paying a managed IT provider for Microsoft 365 management, email security should be a defined deliverable, not something you have to ask about. Here’s what active management looks like in practice:

• DMARC policy progression: Starting at “p=none” for monitoring, moving to “p=quarantine,” and eventually enforcing “p=reject” as false positives are ruled out. This takes weeks of monitoring, not a one-time configuration.
• Defender for Office 365 policy tuning: Default policies are intentionally permissive. A managed provider tightens safe attachment policies, configures anti-impersonation protection for key executives and vendors, and adjusts link-rewriting settings based on your user workflow.
• Alert monitoring and response: Email security tools generate alerts when suspicious patterns are detected. Someone needs to triage those alerts, investigate potentially compromised accounts, and take action. An unmonitored alert is the same as no alert.
• Phishing simulation cadence: Running simulations quarterly, tracking click rates by department, and assigning targeted training to high-risk users.
• Incident response for compromised accounts: When an account is compromised (and eventually one will be), your MSP should have a defined playbook: revoke sessions, reset credentials, audit mailbox rules for forwarding, check sent items for exfiltration, and notify affected parties under PIPEDA’s breach reporting requirements if personal data was exposed.

Ask your current provider to show you your DMARC policy and the last 90 days of aggregate DMARC reports. If they can’t produce them in under five minutes, email authentication isn’t being actively managed. Free tools like MXToolbox’s DMARC lookup show your current record in seconds, and you can check it yourself right now.

Email Security and PIPEDA: What Canadian Businesses Need to Know

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), businesses are required to report breaches that pose a real risk of significant harm to affected individuals and to notify the Office of the Privacy Commissioner of Canada. Email is one of the most common breach vectors: a compromised inbox containing client records, health information, or financial data triggers reporting obligations.

For Ontario healthcare organizations, PHIPA adds additional requirements: health information custodians must implement administrative, technical, and physical safeguards appropriate to the sensitivity of the data. Weak email controls are a direct compliance gap. The Information and Privacy Commissioner of Ontario has issued formal findings against healthcare organizations for exactly this kind of oversight, as the province’s first-ever PHIPA fines demonstrated earlier this year.

PIPEDA breach reporting is not optional. If a phishing attack compromises an employee account containing personal information about clients or employees, you are required to assess whether the breach meets the reporting threshold and document your findings. Email encryption and access controls reduce both the likelihood of a breach and the scope of what gets exposed if one occurs.

How to Assess Your Current Email Security Posture

You don’t need a full security audit to get a baseline read on where you stand. These five checks surface the most common gaps:

• Check your DMARC record: Use MXToolbox’s DMARC lookup to verify your record exists and what policy is set. If it’s “p=none” or missing, your domain can be spoofed.
• Verify your M365 plan: Business Basic and Standard do not include Defender for Office 365. Business Premium does. If you’re not on Business Premium, you’re missing safe links, safe attachments, and anti-impersonation protection.
• Look for suspicious inbox rules: Compromised accounts frequently have forwarding rules set to external addresses or rules that auto-delete specific emails (like security alerts). Review inbox rules for all administrator accounts.
• Test your users: Send a simulated phishing email through Microsoft Attack Simulator or KnowBe4’s free trial. The click rate among staff who have never been trained is typically higher than leadership expects.
• Confirm MFA is enforced on all mailboxes: Multi-factor authentication doesn’t prevent phishing, but it prevents credential theft from resulting in account access. If any mailbox accepts password-only login, it’s one leaked credential away from compromise.

Email security for small business isn’t a product you buy once. It’s a set of ongoing controls: authentication records maintained and enforced, advanced filtering tuned to your environment, users trained and tested, and someone monitoring alerts and responding when something gets through. If your MSP isn’t doing all of this actively, there are gaps in your coverage.

At Balanced+, email security is part of every managed cybersecurity and managed IT engagement we run: Defender for Office 365 configuration and tuning, DMARC implementation and monitoring, phishing simulations, and a defined incident response process for compromised accounts. If you’re not sure where your current email setup stands, reach out for a no-obligation assessment and we’ll tell you exactly what we find.

Frequently Asked Questions

What does email security for small business include?

Effective email security for small business includes spam and malware filtering, anti-phishing protection, email authentication records (SPF, DKIM, DMARC), safe attachment sandboxing, email encryption for sensitive communications, and phishing simulation training for staff. Most small businesses on standard Microsoft 365 plans have only basic filtering in place and are missing several of these layers.

Is Microsoft 365 email secure enough for small businesses?

Microsoft 365’s built-in protection (Exchange Online Protection) is a reasonable baseline for spam and known malware, but it has significant gaps for targeted phishing, business email compromise, and zero-day attachment threats. Microsoft 365 Business Premium adds Defender for Office 365, which closes most of those gaps. Businesses on Basic or Standard plans are running minimal protection and should consider upgrading or adding a third-party email security layer.

What is DMARC and does my small business need it?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS record that tells receiving mail servers what to do with emails that fail authentication checks: monitor, quarantine, or reject them. Without DMARC enforcement, attackers can send emails that appear to come from your domain, enabling vendor fraud and impersonation attacks. Every business that uses email should have SPF, DKIM, and DMARC configured, with DMARC ultimately set to “reject.”

How much does email security cost for a small business in Canada?

Microsoft 365 Business Premium, which includes Defender for Office 365, runs approximately CAD $28 to $32 per user per month. Dedicated phishing simulation platforms like KnowBe4 add roughly $15 to $25 per user per year at small-business pricing. A managed provider handling configuration, monitoring, and incident response typically bundles email security into a broader managed IT or cybersecurity contract, which is often more cost-effective than licensing tools independently.

Sources

• Data Breach Investigations Report 2024, Verizon, 2024
• Internet Crime Report 2023, FBI Internet Crime Complaint Center (IC3), 2023
• Canadian Anti-Fraud Centre, Government of Canada
• Personal Information Protection and Electronic Documents Act (PIPEDA), Office of the Privacy Commissioner of Canada
• Information and Privacy Commissioner of Ontario, IPC Ontario
• DMARC Lookup Tool, MXToolbox

Every year, businesses lose more money to business email compromise than to ransomware, data breaches, and most other forms of cybercrime combined. And unlike ransomware, you often don’t know it happened until the funds are already gone and the attacker has disappeared.

This post breaks down what BEC is, how attacks unfold step by step, and what controls actually stop them before money moves.

What Is Business Email Compromise?

The FBI tracks BEC separately from other cybercrime precisely because of its outsized financial impact. According to the FBI Internet Crime Complaint Center (IC3) 2023 Annual Report, BEC and its variant email account compromise (EAC) generated over $2.9 billion in reported losses in the United States alone in 2023, making it the highest-loss cybercrime category tracked by the FBI for the third consecutive year.

How Does a BEC Attack Work?

BEC attacks follow a recognizable pattern even when the specifics vary. The attacker doesn’t need malware or a zero-day exploit. They need a convincing email, a sense of urgency, and a target who hasn’t been trained to pause and verify.

The Five Types of BEC Attacks

The FBI IC3 categorizes BEC into five primary scenarios. Knowing which type is targeting your organization shapes how you respond and train.

• CEO fraud: An executive’s email is spoofed or compromised. Finance or accounting receives an urgent wire transfer request, often referencing a real deal or deadline.
• Vendor/invoice impersonation: Attackers pose as a known supplier and request a banking detail change on a pending invoice. The next legitimate payment lands in the attacker’s account.
• Account compromise: A legitimate employee’s email account is hacked and used to request fraudulent payments from customers or partners who trust the sender.
• Attorney impersonation: Criminals pose as a law firm handling a sensitive, time-critical transaction and pressure the target to act quickly and confidentially.
• Data theft (W-2 and payroll fraud): HR or finance is tricked into sending employee payroll data, W-2 equivalents, or PII that enables follow-on identity fraud or tax fraud.

BEC vs. Phishing: What’s the Difference?

BEC is often grouped with phishing, but they are meaningfully different attacks that require different defenses. Phishing is a scattershot campaign; BEC is a targeted strike built around research and impersonation.

Why Are BEC Attacks So Hard to Stop?

Three factors make BEC attacks unusually dangerous compared to other email threats.

They bypass technical defenses. A well-crafted BEC email contains no malicious links, no attachments, and no executable code. It can pass SPF, DKIM, and DMARC checks if the attacker has registered a convincing look-alike domain. Standard email security tools have nothing to flag.

They exploit human psychology. Urgency, authority, and secrecy are baked into every BEC script. “I need this done before the wire cutoff at 3 PM.” “Don’t loop in accounting on this, it’s a confidential matter.” These triggers short-circuit the verification habits that people apply under normal circumstances.

They’re cheap to run. Researching a target on LinkedIn costs nothing. Registering a look-alike domain costs under $20. The attacker’s return on investment is extraordinary relative to the effort required, which is why BEC volume has grown steadily even as other cybercrime tactics have faced increasing technical barriers.

Warning Signs of a BEC Attempt

Domain spoofing is subtle. Attackers register variations that look correct at a glance: adding a hyphen, swapping a letter (rn for m), or using a country-code TLD like .ca instead of .com. Training employees to check the actual sending address, not just the display name, catches a large percentage of attempts before any action is taken.

How to Protect Your Business From BEC

No single control stops BEC. The organizations that avoid significant losses combine technical safeguards with process controls and ongoing training, so that multiple layers must fail simultaneously for an attack to succeed.

What to Do If Your Business Has Been Targeted

Speed is the only meaningful variable in BEC recovery. If a fraudulent transfer has occurred, every hour reduces the chance of recovery.

At Balanced+, our managed cybersecurity services include email security configuration, security awareness training tailored to BEC scenarios, and ongoing monitoring that catches the account compromise attempts that often precede a BEC attack. If you’re not confident your team and your controls would stop a well-researched impersonation attempt, let’s talk.

Frequently Asked Questions

What is the most common type of BEC attack?

CEO fraud and vendor/invoice impersonation are the most frequently reported BEC variants. In CEO fraud, an executive’s email is spoofed or compromised and used to pressure a finance employee into an urgent wire transfer. In vendor impersonation, attackers pose as a known supplier and request a banking detail update before a scheduled payment, redirecting the next legitimate payment to an attacker-controlled account.

Can spam filters stop a BEC attack?

Standard spam filters and antivirus tools are largely ineffective against BEC because the attacks contain no malicious links or file attachments. The email often looks entirely legitimate. Effective defenses are process-based (verbal verification policies) and technical (MFA, DMARC/DKIM/SPF, external sender banners) rather than filter-based.

What is the difference between BEC and EAC?

BEC (Business Email Compromise) typically involves impersonation without actually accessing a real email account. EAC (Email Account Compromise) goes further: the attacker gains control of a legitimate account and sends fraudulent requests directly from it. EAC is harder to detect because the emails originate from a real, trusted address and pass all authentication checks. The FBI IC3 tracks both under the same reporting category because the financial impact and attack goals are the same.

How much do BEC attacks cost Canadian businesses?

The Canadian Anti-Fraud Centre (CAFC) tracks BEC as one of the top fraud categories affecting Canadian organizations, though losses are widely underreported. The CCCS National Cyber Threat Assessment 2025-2026 identifies BEC as a persistent and growing threat to Canadian businesses of all sizes. US figures from the FBI IC3 serve as a useful proxy: $2.9 billion in reported losses in 2023 from roughly 21,000 complaints, suggesting an average loss well above $100,000 per incident.

Sources

• FBI Internet Crime Complaint Center (IC3) 2023 Annual Report , Federal Bureau of Investigation, 2024
• Business Email Compromise: The $50 Billion Scam , FBI IC3, 2024
• Implementation Guidance: Email Domain Protection , Canadian Centre for Cyber Security (CCCS), 2023
• National Cyber Threat Assessment 2025-2026 , Canadian Centre for Cyber Security (CCCS), 2025
• Report a Fraud , Canadian Anti-Fraud Centre (CAFC)

In late April 2026, a threat actor known as ShinyHunters quietly compromised Instructure, the company behind Canvas LMS, one of the most widely used learning management systems in the world. By the time the breach surfaced publicly in early May, an estimated 275 million students and educators across roughly 9,000 institutions had their personal data sitting in the hands of a ransomware group with a May 12 deadline to collect.

This post breaks down exactly what happened, how attacks like this unfold, and what the warning signs look like. More importantly, it covers what organizations outside education should take from this. If your business relies on a SaaS vendor for anything mission-critical, the Canvas breach is a direct signal about your own exposure.

What Actually Happened: The Canvas Breach Timeline

According to Krebs on Security, the intrusion appears to have begun around April 29-30, 2026. ShinyHunters, a prolific cybercriminal group previously tied to the 2021 AT&T breach and the 2022 Wattpad leak, gained access to Instructure systems and began exfiltrating data. The group claimed to have taken records covering names, email addresses, student IDs, and internal platform messages.

Instructure confirmed the breach but stated that no passwords, financial data, or government-issued IDs were among the stolen records. That is meaningful context, but it does not eliminate the risk. Names combined with institutional email addresses and internal communications are more than enough to fuel targeted phishing campaigns against students, faculty, and administrative staff.

By May 7, Canvas entered maintenance mode, disrupting access for institutions across the US, UK, Canada, Australia, New Zealand, Sweden, and the Netherlands. Multiple Canadian post-secondary institutions confirmed they were affected, though the full scope is still being assessed.

How Breaches Like This Actually Happen

ShinyHunters does not operate like a script-kiddie running vulnerability scanners. The group is known for patience and for targeting credential databases, API keys, and cloud storage misconfigurations. Based on DataBreaches.net reporting, the Canvas intrusion follows a pattern the group has used repeatedly: gain initial access via exposed or stolen credentials, move laterally through cloud infrastructure, exfiltrate quietly, then surface with ransom demands once data is secured.

The mechanics generally follow a predictable kill chain. Understanding each stage is how defenders know where to interrupt it.

Warning Signs Your Organization Should Never Ignore

Most breaches are not discovered by the victim. Inside Higher Ed noted that Canvas institutions learned about the breach from external security researchers and media reports, not from Instructure’s own detection. That gap between compromise and notification is where the real damage accumulates.

In our work with GTA mid-market firms, the signals that precede a confirmed breach tend to cluster around the same overlooked indicators.

What Data Was Taken and Why It Matters

Instructure confirmed that the stolen data includes names, email addresses, student IDs, and internal platform messages. No passwords, no payment card data, no government IDs. That framing is accurate but can be misleading when evaluating actual risk.

Consider what an attacker can do with a name, an institutional email address, and the content of internal messages. They can craft a spear-phishing email that references a real conversation, a real course, a real colleague. That specificity is what makes socially engineered attacks effective. The targets are not abstract; they are 275 million real people with names, affiliations, and communication histories now sitting in a threat actor’s database.

Under PIPEDA (Canada’s federal private sector privacy law), organizations that experience a breach involving a real risk of significant harm are required to notify both the Privacy Commissioner of Canada and affected individuals. “Significant harm” explicitly includes humiliation, damage to reputation, and financial loss. A breach of this nature, particularly where internal messages are involved, likely clears that threshold for Canadian institutions. Provincial health data held by universities may also trigger PHIPA obligations depending on the context.

How to Protect Your Organization from Vendor-Side Breaches

You cannot prevent a breach at your vendor’s data center. What you can do is limit how much of your exposure depends on their security posture, and build the capability to respond fast when something goes wrong on their end.

What ShinyHunters’ Track Record Tells Us

This is not a first offense. ShinyHunters has been linked to breaches at AT&T, Ticketmaster, Santander Bank, and dozens of other organizations. The group operates with a commercial mindset: they find high-value targets, exfiltrate at scale, and monetize through ransom or data sales on criminal marketplaces. Education platforms are attractive because they aggregate massive user populations with historically under-resourced security teams.

According to DataBreaches.net, the word “again” in their headline is deliberate: Instructure has faced security incidents before. Repeat targeting by sophisticated threat actors is common when organizations do not remediate root causes after an initial incident.

Decision Framework: Assessing Your Vendor Risk Right Now

Use this framework to prioritize which vendors in your stack need immediate attention. It is not exhaustive, but it surfaces the highest-risk exposure quickly.

• Data sensitivity: Does this vendor store employee PII, customer data, financial records, or communications? Higher sensitivity means higher priority.
• Access scope: Does the vendor integration have broader system access than the use case requires? Excessive permissions amplify breach impact.
• Breach history: Has this vendor had a prior incident? How did they handle notification, remediation, and communication?
• Contractual protections: Do your vendor agreements include breach notification timelines, data deletion clauses, and liability provisions? If not, renegotiate at renewal.
• Substitutability: If this vendor went into maintenance mode tonight, how long before your operations are critically impacted? Document that number and plan around it.

If you are not sure where your vendor risk exposure actually sits, that is exactly the kind of gap we help GTA mid-market organizations identify and close. Balanced+ provides cybersecurity assessments, third-party risk reviews, and managed security services built for organizations that cannot afford to find out the hard way. Start with our cybersecurity services page to see what a structured approach looks like.

Frequently Asked Questions

Was my Canvas account hacked?

If you have an account on any Canvas LMS platform, your name, email address, student or faculty ID, and possibly internal messages may have been included in the exfiltrated data. Instructure confirmed that passwords and financial data were not compromised. Watch for phishing emails that reference specific course names, colleagues, or internal details, as these would indicate your data is being used in follow-on attacks.

What is ShinyHunters and how dangerous are they?

ShinyHunters is a well-documented cybercriminal group known for large-scale data theft and ransom extortion. They have been linked to breaches at AT&T, Ticketmaster, Santander, and others. They typically operate by accessing cloud environments using stolen or exposed credentials, exfiltrate large datasets quietly, and then surface with ransom demands. The group is considered a persistent and sophisticated threat actor, not an opportunistic script operation.

What do businesses need to do after a vendor breach like this?

First, contact the vendor directly and request a written impact assessment confirming whether your data was in scope. Second, brief your security team and review any integrations that may have exposed data. Third, increase phishing awareness among employees, since follow-on spear-phishing is a near-certain outcome when contact data is stolen. If the vendor stores data covered by PIPEDA or PHIPA, review your notification obligations under those frameworks with legal counsel.

Does this breach affect businesses outside the education sector?

Directly, no. Canvas LMS is used primarily in education. But the broader lesson applies to any organization using SaaS platforms: your vendor’s security posture is part of your attack surface. The tactics ShinyHunters used in the Canvas breach are the same ones targeting HR platforms, CRMs, and cloud storage providers in the commercial sector. Third-party vendor risk management is not an education problem; it is a business problem.

Sources

• CBC News: Ontario universities affected by Canvas data breach
• Time: Canvas Cyber Attack — ShinyHunters Hack, What to Know
• Krebs on Security: Canvas Breach Disrupts Schools and Colleges Nationwide
• DataBreaches.net: ShinyHunters Hacks Instructure Again — Canvas Down
• Malwarebytes: Millions of Students’ Personal Data Stolen in Major Education Cyberattack
• Inside Higher Ed: Pay or Leak — Hackers Target Big Higher Ed Vendor

In October 2023, a ransomware attack against a shared IT vendor knocked five southwestern Ontario hospitals offline for months, cost those organizations over $7.5 million, and compromised the personal health information of more than 516,000 patients and employees. Surgeries were postponed. Cancer radiation treatments were transferred to other facilities. Most systems were not restored until February 2024. The attack didn’t require a sophisticated breach of each hospital’s own infrastructure; it came through a single shared service provider that all five organizations trusted.

That case illustrates exactly why PHIPA compliance is not a paperwork exercise. This post covers what Ontario’s health privacy law requires from your IT environment, where most healthcare organizations in the GTA fall short, and what to look for in a managed IT provider that actually understands the regulatory landscape.

What PHIPA Actually Requires from Your IT Environment

PHIPA doesn’t mandate specific technologies. What it requires is that health information custodians take steps “reasonable in the circumstances” to protect personal health information. The IPC has consistently interpreted this through its investigations and orders to include a defined set of technical controls that any healthcare IT environment needs to address.

• Encryption: Personal health information must be encrypted at rest and in transit. Unencrypted devices are among the most cited causes of reportable breaches in IPC investigations.
• Access controls and audit logging: Only authorized personnel should access patient records, access should be role-based, and every access event should be logged. Without audit logs, you cannot investigate a breach or demonstrate compliance.
• Breach detection and response: You must have the ability to detect breaches and respond to them. Ontario’s PHIPA requires notification to affected individuals at “the first reasonable opportunity,” which the IPC has interpreted as within 72 hours in most circumstances, far tighter than the 60-day window under the US HIPAA framework.
• Written vendor agreements: Any IT provider or cloud service that handles personal health information on your behalf must be bound by a written data sharing agreement that addresses PHIPA obligations. This applies to your EMR vendor, cloud storage provider, and managed IT provider.
• Privacy governance: The IPC’s first administrative monetary penalty, issued in August 2025 against a physician and his private clinic, found that the clinic had “sorely lacked any of the essential elements of a data privacy and security governance program.” That phrase (from the IPC’s own decision) is now the benchmark against which Ontario healthcare organizations are being measured.

The SickKids Ruling: Ransomware Is a Breach Even If Nothing Was Stolen

In 2025, an Ontario court issued a significant ruling in the Hospital for Sick Children case that every healthcare organization in the province needs to understand. The court found that a ransomware attack that makes personal health information inaccessible triggers PHIPA’s breach notification obligations, even when there is no evidence that the information was actually accessed, viewed, or stolen by the attacker.

The same ruling found that an email account compromise lasting as little as one hour constitutes both unauthorized disclosure and unauthorized use under PHIPA, triggering the duty to notify at the first reasonable opportunity.

Real Consequences: What Has Happened to Ontario Healthcare Organizations

The southwestern Ontario hospital attack is the clearest illustration of supply chain risk in healthcare IT. All five organizations used the same IT service provider, TransForm Shared Service Organization. When that vendor was compromised, every connected hospital was affected simultaneously. The attack forced postponed surgeries, diverted cancer treatments, and generated millions in recovery costs, across organizations that individually may have had reasonable security practices.

In 2025, a vendor contracted by Ontario Health atHome suffered a ransomware attack that compromised patient information, with the breach confirmed more than two months after the initial incident. The IPC’s 2024 annual report also highlighted an investigation involving a medical imaging clinic where a ransomware attack compromised more than 500,000 patient records and the clinic ultimately paid the ransom to restore access to its systems.

These are not edge cases. They are the norm in Ontario healthcare cybersecurity, and the IPC’s enforcement posture is getting more aggressive. August 2025 saw the first-ever administrative monetary penalties issued under PHIPA, the first time any Canadian privacy commissioner had used this enforcement mechanism. The IPC can now impose penalties of up to $50,000 on individuals and $500,000 on organizations for PHIPA contraventions.

Compliant vs. Non-Compliant: What Each Looks Like in Practice

What to Look for in a Managed IT Provider for Ontario Healthcare

Not every managed IT provider is equipped to work in a PHIPA-regulated environment. A provider that serves manufacturing clients operates under entirely different risk and compliance requirements. When evaluating a managed IT partner for your healthcare organization, these are the criteria that matter:

Balanced+ works with healthcare organizations across Toronto and the GTA to build IT environments that meet PHIPA requirements without disrupting clinical operations. If you are not sure where your current environment stands, our healthcare IT services page outlines how we approach compliance and security for Ontario health information custodians. We are happy to walk through a gap assessment before you commit to anything.

Frequently Asked Questions

What is PHIPA and who does it apply to in Ontario?

PHIPA is Ontario’s Personal Health Information Protection Act, which governs how health information custodians handle patient data. It applies to physicians, hospitals, pharmacists, laboratories, long-term care homes, community health centres, and other regulated health professionals in Ontario. There is no size threshold: a sole-practitioner clinic has the same obligations as a regional hospital. The IPC enforces PHIPA and now has the authority to issue administrative monetary penalties of up to $500,000 for organizational violations.

How quickly does PHIPA require breach notification in Ontario?

PHIPA requires that affected individuals be notified “at the first reasonable opportunity” after a breach is discovered. The IPC has interpreted this as approximately 72 hours in most circumstances, which is considerably faster than the 60-day window under the US HIPAA framework. Serious and deliberate breaches must also be reported to the IPC immediately. The 2025 SickKids ruling confirmed that ransomware attacks that render data inaccessible, even with no evidence of data theft, still trigger these notification obligations.

Does my IT provider need to sign a special agreement to comply with PHIPA?

Yes. Any agent or third party that handles personal health information on behalf of a health information custodian must be bound by a written agreement that addresses PHIPA obligations. This includes your managed IT provider, EMR vendor, cloud storage service, and any other technology partner with access to patient data. Using an IT provider without a signed PHIPA-compliant data sharing agreement puts your organization in violation, regardless of how secure the provider’s own systems may be.

What does a managed IT provider do for a healthcare organization?

A managed IT provider for healthcare handles the technical controls that PHIPA requires: device encryption, role-based access management, audit logging, patch management, 24/7 monitoring, and breach detection and response. They also assist with vendor agreement reviews, incident response planning, and ensuring that cloud services meet Ontario privacy standards. For smaller clinics and specialist practices without dedicated IT staff, a qualified managed IT provider is typically the most practical way to maintain sustainable PHIPA compliance without adding internal headcount.

Sources

• Southwestern Ontario hospital cyberattack cost organizations $7.5M — Cyber Secure Catalyst (August 2024)
• Southwestern Ontario hospitals cyberattack financial impact — CBC News (August 2024)
• Ontario Health atHome vendor ransomware attack — Global News (2025)
• Hospital for Sick Children v. Ontario IPC: ransomware notice obligations — BLG (September 2025)
• First administrative monetary penalty issued under PHIPA — IPC Ontario (August 2025)
• A New Era of Privacy Enforcement: Ontario’s first AMPs under PHIPA — Dentons Data (2025)
• Review of noteworthy cases — IPC Ontario 2024 Annual Report
• Personal Health Information Protection Act, 2004 — Ontario Legislature

Your employees are already using AI. They’re drafting emails in ChatGPT, summarizing contracts in Claude, building reports with Copilot, and asking Gemini to review vendor agreements. None of it went through IT. None of it was approved. And in most cases, nobody knows it’s happening.

This is shadow AI, and it’s now one of the fastest-growing security and compliance risks for mid-market Canadian businesses. This post breaks down what shadow AI is, what data is actually leaving your organization, and what a practical response looks like.

What Is Shadow AI?

The term distinguishes between AI tools that have been formally evaluated, licensed, and governed (such as Microsoft Copilot deployed through an M365 enterprise tenant) and those being used informally through personal accounts or free-tier access. The distinction matters because enterprise and consumer versions of the same product carry fundamentally different data handling terms.

How Common Is Shadow AI in the Workplace?

More common than most IT leaders assume. According to Microsoft’s 2025 Work Trend Index, 75% of knowledge workers now use AI tools in their daily work, and 78% are bringing their own AI tools to the job rather than waiting for employer-provided options. The report refers to this as “BYOAI” (Bring Your Own AI), and it is accelerating.

The gap between employee adoption and IT governance is significant. Most organizations have policies covering software installation, data classification, and acceptable use, but very few have updated those policies to explicitly address generative AI. In our conversations with GTA mid-market IT teams, the question “do you have an AI use policy?” is still answered with “not yet” more often than not.

What Data Are Employees Actually Putting Into AI Tools?

This is where the theoretical risk becomes concrete. Research from data security firm Cyberhaven found that 11% of the data employees paste into ChatGPT is confidential business data, including source code, financial records, client information, and internal strategy documents. That figure was measured across enterprise environments where employees knew their activity could be monitored.

The most documented example remains Samsung’s 2023 incident, in which engineers at the company’s semiconductor division pasted proprietary source code and internal meeting notes into ChatGPT while troubleshooting software bugs. The data was submitted before Samsung had an AI use policy in place. Samsung responded by banning generative AI tools across the company: a reaction that is effective but not sustainable for most organizations.

In practice, the most common categories of data entering AI tools without authorization include:

• Client contracts and proposals being summarized or edited
• Financial reports and budget documents being analyzed
• HR data including performance reviews and compensation information
• Internal technical documentation and system architecture details
• Personal information about clients, employees, or patients

Employees are not being reckless; they are being efficient. The problem is that efficiency and data governance are not the same objective, and without clear guidance, employees default to the tools that get the job done fastest.

Three Security Risks Shadow AI Creates

1. Data Transmitted to Third-Party Servers Without Your Control

When an employee submits a prompt to a consumer AI tool, that data travels to the vendor’s servers. For free and personal-tier accounts, OpenAI’s privacy policy historically allowed user inputs to be used to improve their models unless users opted out. Even with opt-outs enabled, the data has left your environment and sits on infrastructure you do not control, governed by terms of service your legal team has never reviewed.

2. No Audit Trail

Email is logged. File access is logged. Cloud storage has version history. Generative AI prompts submitted through a browser on a personal account leave no trace in your systems. If a compliance audit asks what client data was shared externally in the last 12 months, you cannot answer that question. If a confidentiality dispute arises, you have no record of what was disclosed and when. This is not a hypothetical gap; it is a gap in your controls right now.

3. Confidentiality Agreement and NDA Exposure

Most client-facing confidentiality agreements were drafted before generative AI existed. They prohibit disclosure of covered information to third parties, and submitting that information to a public AI model almost certainly constitutes disclosure, even if the employee’s intent was purely to get help with a task. The exposure is real whether or not a breach occurs. If a client or partner discovers their information was processed through an unapproved AI tool, the conversation with legal is not a comfortable one.

Shadow AI and Canadian Compliance: PIPEDA and PHIPA

Canadian businesses face specific compliance obligations that make shadow AI a regulatory issue, not just a security one.

Under PIPEDA (Personal Information Protection and Electronic Documents Act), organizations are responsible for personal information under their control, including information held by third parties on their behalf. When an employee submits personal information to a consumer AI tool without a data processing agreement in place, the organization is likely in breach of its accountability obligations under PIPEDA Principle 1, regardless of whether the employee acted intentionally.

For Ontario healthcare organizations and their vendors, PHIPA (Personal Health Information Protection Act) applies an even stricter standard. Submitting personal health information to any unauthorized third-party system including an AI tool, without explicit consent and a data custodian agreement is a reportable breach. The Office of the Information and Privacy Commissioner of Ontario has been explicit that AI tools are not categorically exempt from these requirements.

Approved vs. Unapproved AI Tools: What’s the Difference?

Not all AI tools carry the same risk. The critical variable is not which tool is used; it is what data agreement governs how that tool handles your information.

The pattern is consistent: enterprise-tier access with a signed data processing agreement is manageable. Consumer-tier access with a personal account is not, regardless of which AI provider is involved.

How to Build an AI Use Policy That Actually Works

Banning AI tools is not a realistic response. Employees will continue using them; the ban simply pushes activity further underground and adds compliance exposure without adding security. The goal is governance, not prohibition.

What to Do Right Now if You Have No AI Policy

If your organization does not yet have an AI use policy, you are not in a minority, but you are carrying avoidable risk. The practical starting point is not a comprehensive policy document; it is a two-step interim position you can communicate this week:

• Communicate a temporary rule: “Until we have a formal policy, do not submit client information, personal information, or anything covered by a confidentiality agreement to any AI tool you access through a personal account.” This is not a ban; it is a data minimization instruction your team can actually follow.
• Audit your enterprise AI tool access: Determine which AI tools your organization already has access to through existing software agreements: M365 Copilot, Google Workspace Gemini, GitHub Copilot for developers. These are your sanctioned options. Communicate them clearly so employees have an approved path rather than defaulting to personal accounts.

At Balanced+, we help GTA mid-market businesses build practical AI governance frameworks as part of broader IT and cybersecurity programs, including data classification, DLP configuration, and employee training. If you want to understand where your current AI exposure sits, a cybersecurity assessment is a good starting point. It is not a sales process it is a structured look at where the gaps are.

Frequently Asked Questions

What is shadow AI, and how is it different from shadow IT?

Shadow IT refers to any software or system used by employees without IT approval: unauthorized apps, personal cloud storage, unapproved SaaS tools. Shadow AI is a specific subset of shadow IT focused on generative AI tools like ChatGPT, Gemini, and Claude. The key difference is the data risk: shadow IT introduces unapproved software into your environment, while shadow AI actively transmits data out of your environment to third-party servers, often with no visibility or audit trail.

Is it a compliance violation for employees to use ChatGPT at work?

It depends on what data is involved and what account type is used. Using ChatGPT through a personal or free account to submit client personal information, health data, or information covered by a confidentiality agreement likely creates a PIPEDA or PHIPA compliance issue, and may breach contractual obligations with clients. Using ChatGPT Enterprise under a signed data processing agreement with proper controls is a different matter. The tool itself is not the determining factor; the governance terms and data involved are.

Can I just ban AI tools to avoid the risk?

You can issue a ban, but it will not eliminate the risk; it will push activity underground and remove whatever visibility you currently have. Employees who rely on AI tools to do their jobs will continue using them; they will simply avoid mentioning it. A more effective approach is to define approved tools with enterprise data agreements, publish clear rules about which data categories are off-limits regardless of the tool used, and monitor usage through available admin consoles. Governance is more durable than prohibition.

What should an AI use policy include for a mid-market Canadian business?

At minimum: a list of approved AI tools and the specific account type required (enterprise, not personal); a list of data categories that cannot be entered into any AI tool regardless of approval status (personal information, health data, client confidential data, source code); a process for employees to request approval for new AI tools; and a reference to existing data classification and acceptable use policies. For businesses subject to PIPEDA or PHIPA, the policy should also address third-party data processing agreements and how AI tool vendors are evaluated for compliance.

Mid-market IT teams are stuck in an impossible spot. Too large to ignore enterprise-grade security requirements. Too small to staff for them internally. Every director we talk to has run the numbers at least once — and most have quietly shelved the spreadsheet.

This post walks through what the math actually looks like when a mid-market Canadian business tries to build a security team in-house, why it almost never pencils out, and what you’re really paying for when you bring in an MSSP instead.

Key takeaway: A mid-market business that tries to staff a proper security team in Toronto typically spends $500K+ on salaries alone before tools, management, or coverage gaps. That arithmetic — not trendiness — is why managed security services exist.

Mid-market business: In Canada, a mid-market business is typically defined as a company with 50 to 500 employees and annual revenue between $10M and $1B. Mid-market firms face the same cyber threats and compliance requirements as enterprises but with a fraction of the headcount and budget to absorb them.

The Math Most Mid-Market Businesses Don’t Want to Do

A fully-loaded senior security engineer in Toronto runs $130K+ in base salary alone. Add benefits (typically 20–30%), hardware, training, certifications, and management overhead, and you’re closer to $170K–$190K per head. That’s one engineer.

One engineer can’t run a security program. Threats don’t respect business hours. Critical vulnerabilities get disclosed on Fridays. Incidents happen at 2 AM on long weekends. To cover nights, weekends, vacation, and the specialty domains a modern environment demands — network, endpoint, cloud, identity, compliance — you need 3 to 5 people at a bare minimum.

$500K+ — the baseline salary cost

Annual base salary cost for a mid-market business to staff a 3–5 person in-house security team in Toronto, before benefits, tooling, recruiting, or management overhead. (Based on Robert Half 2025 Salary Guide, Canada)

Cost Category	In-House (3–5 engineers)	MSSP (comparable coverage)
Base salaries	$400K–$700K	Included
Benefits & overhead	$80K–$140K	Included
Tooling & licensing	$100K–$250K	Included
24/7 coverage	Hire 5+ or pay overtime	Included
Management layer	+1 FTE	Included
Typical annual cost	$700K–$1.2M+	$120K–$300K

Even at the high end, an MSSP contract typically runs 25–35% of the cost of a comparable internal team — before you factor in the tools, recruiting time, and ramp-up you skip entirely.

⚠️ Worth noting: These numbers assume you can actually hire the people. In Canada’s tight cybersecurity labour market, open security roles at mid-market salaries routinely sit unfilled for six months or longer. The (ISC)² Cybersecurity Workforce Study has tracked a persistent global shortage of roughly 4 million cybersecurity professionals year after year.

Why One Security Engineer Isn’t Enough

Every mid-market business that tries to “just hire one good security person” eventually discovers the same thing. Security isn’t a single job — it’s a stack of specializations that rarely live in one person’s head.

• Network security (firewalls, segmentation, VPN, SD-WAN)
• Endpoint security (EDR/XDR, patching, device management)
• Identity and access management (SSO, MFA, privileged access, zero trust)
• Cloud security (Azure, AWS, Microsoft 365 hardening, CSPM)
• Incident response (forensics, containment, recovery)
• Governance, risk, and compliance (SOC 2, PIPEDA, PHIPA, policy)
• Threat detection and monitoring (SIEM, SOAR, threat hunting)

A senior generalist can touch all of these, but none deeply. That’s fine until something breaks. When an actual incident happens, you need the specialist who has seen it before — and if that person works for you, they’re probably on vacation or handling tickets.

💡 Pro tip: The tell that a one-person security team is failing isn’t dramatic. It’s quiet: patching drift, unreviewed alerts, stale documentation, and the same audit findings showing up year after year. By the time something loud happens, the program has usually been underwater for months.

What You’re Actually Buying From an MSSP

Here’s the part that usually gets missed in the build-vs-buy conversation. An MSSP contract isn’t just labour arbitrage — you’re not simply renting cheaper engineers. What you’re actually buying is depth: access to a bench of specialists, tooling that’s already paid for, and playbooks built from hundreds of incidents you didn’t have to experience firsthand.

1. 24/7 monitoring and response. Security operations coverage that doesn’t take long weekends, go on parental leave, or burn out after the third late-night incident.
2. Specialist access on demand. Cloud architects, network engineers, incident responders, and compliance analysts when you need them, not on payroll when you don’t.
3. Enterprise tooling already deployed. SIEM, EDR, vulnerability management, and threat intelligence platforms that would cost six figures annually to license and staff directly.
4. Incident response playbooks. Documented, rehearsed procedures for the scenarios that would otherwise force your team to improvise at 3 AM on a Saturday.
5. Compliance and insurance support. SOC 2, PIPEDA, PHIPA, and cyber insurance questionnaire coverage without having to hire a dedicated GRC lead.

Most of our Managed IT & Cybersecurity clients at Balanced+ come to us after they’ve tried the “hire one senior person” route and watched it collapse under the workload. By the time we take over, the answer isn’t just adding more people — it’s a different operating model altogether.

When Hiring Internally Still Makes Sense

We’re not going to pretend every mid-market business should outsource all of security. There are cases where internal headcount is the right call — and pretending otherwise would be doing you a disservice.

ℹ️ When to hire in-house: Bring security in-house when you’ve outgrown the mid-market definition (500+ employees), when you have sustained regulatory complexity that requires dedicated GRC staff, or when security itself is a core product differentiator — think fintech, healthtech, or defence contractors.

Even in those cases, most mature security organizations run a hybrid model: internal staff for strategy, architecture, and vendor management, with an MSSP or MDR partner handling 24/7 operations and specialty work. Trying to do all of it internally at 50–500 employees is what quietly breaks IT budgets across the GTA every year.

The IT-to-Employee Ratio Test

Here’s a quick gut-check we use with prospective clients. Take your total IT headcount (including any security people), divide by total employees, and see where you land. That’s your IT-to-employee ratio — and it’s a remarkably accurate predictor of whether in-house security is even a conversation worth having.

• Worse than 1:50 — You’re understaffed for your size. Security work is getting sacrificed for helpdesk tickets, and the gap is probably already showing up in audits.
• 1:50 to 1:100 — Industry average for Canadian mid-market. You have capacity for daily operations but almost never for dedicated security depth.
• Better than 1:100 — You’ve invested in automation and tooling. You might have room for a security specialist, but almost certainly not a full internal team.

In every scenario above, the math for in-house security staffing gets worse, not better. Even at a healthy 1:50, you have the depth to keep the lights on — not to run a proper security program with 24/7 monitoring, incident response, and specialty coverage.

The Real Question Isn’t Build vs. Buy

The decision isn’t “in-house or outsourced security.” That framing assumes both options are economically viable, and for most mid-market Canadian businesses, in-house simply isn’t. The real question is: how do we get enterprise-grade security coverage at mid-market economics?

The answer is almost always some form of managed services — whether that’s a full MSP/MSSP relationship, a co-managed model that augments a lean internal team, or an MDR partner bolted onto existing staff. The specifics depend on your current capability, regulatory posture, and risk tolerance. The underlying arithmetic doesn’t change.

Bottom line: Mid-market businesses don’t outsource security because it’s fashionable. They outsource it because $700K+ for an incomplete internal team is worse than $200K for depth, 24/7 coverage, and specialists on demand. The arithmetic is the argument.

If you’re weighing whether to build a security team internally or partner with an MSSP, we’re happy to walk you through the math for your specific environment — headcount, coverage gaps, tooling, and all. Take a look at our Managed IT & Cybersecurity services, or get in touch for a ratio-check conversation. No pitch, just the numbers.

IT compliance is one of those terms that gets thrown around in boardrooms and vendor pitches, but rarely explained in plain language. If you are a business owner, COO, or IT manager at a mid-market company, understanding what IT compliance actually means is the first step toward protecting your organization from regulatory penalties, data breaches, and lost client trust.

This guide breaks it down: what IT compliance is, why it matters for Canadian businesses, what frameworks apply to you, and what a managed IT provider actually does to keep you compliant.

IT Compliance, Defined

Common IT Compliance Frameworks in Canada

The frameworks that apply to your business depend on your industry, where your data lives, and who you do business with. Here are the ones mid-market companies in the GTA encounter most often:

PIPEDA (Personal Information Protection and Electronic Documents Act)

Canada’s federal privacy law. It applies to every private-sector organization that collects personal information in the course of commercial activity. If you handle customer data, names, emails, financial details, health information, PIPEDA applies to you. Under the act, organizations must obtain meaningful consent, limit data collection to what is necessary, and implement appropriate security safeguards.

PHIPA (Personal Health Information Protection Act)

Ontario’s health privacy legislation. If your organization is a health information custodian or processes personal health information on behalf of one, PHIPA imposes strict requirements on access controls, audit logging, breach notification, and data residency.

Ontario Bill 194 (Strengthening Cyber Security and Building Trust in the Public Sector Act)

A newer piece of legislation that expands cybersecurity and privacy obligations for Ontario’s broader public sector, and signals where private-sector regulations are headed. If your organization works with public-sector clients, understanding Bill 194 is essential.

SOC 2

A voluntary framework developed by the AICPA that evaluates an organization’s controls around security, availability, processing integrity, confidentiality, and privacy. SOC 2 Type II certification is increasingly required by enterprise clients and partners before they will sign a contract. If your sales team keeps hearing “do you have SOC 2?”, this is what they mean.

PCI DSS (Payment Card Industry Data Security Standard)

If you process, store, or transmit credit card data, PCI DSS compliance is mandatory. Requirements include network segmentation, encryption, access controls, regular vulnerability scans, and penetration testing.

NIST Cybersecurity Framework

A widely adopted voluntary framework from the U.S. National Institute of Standards and Technology. Many Canadian organizations, and their cyber insurance providers, use NIST CSF as a baseline for evaluating security maturity. It organizes controls into five functions: Identify, Protect, Detect, Respond, and Recover.

Why IT Compliance Is Hard for Mid-Market Companies

Enterprise organizations have dedicated compliance teams, GRC platforms, and seven-figure security budgets. Small businesses often fly under the radar. Mid-market companies get the worst of both worlds: they are large enough to be targeted by regulators and attackers, but rarely have the in-house staff to manage compliance properly.

Common challenges include:

• Overlapping frameworks. A healthcare company processing credit cards may need to satisfy PHIPA, PIPEDA, PCI DSS, and SOC 2 simultaneously, each with different controls, evidence requirements, and audit cycles.
• Continuous monitoring. Compliance is not a one-time project. Frameworks require ongoing evidence collection, policy reviews, vulnerability scanning, and access audits.
• Documentation burden. Auditors do not just want to see that you have controls, they want documented policies, procedures, and evidence that those controls are enforced consistently.
• Evolving requirements. Regulations change. New legislation like Ontario Bill 194 can shift your obligations overnight. Staying current requires dedicated attention.
• Talent gap. Compliance-qualified IT professionals are expensive and hard to find. A mid-market company competing with banks and tech firms for GRC talent is fighting an uphill battle.

What a Managed IT Provider Does for IT Compliance

This is where the confusion usually starts. Many business leaders assume that hiring a managed IT provider means compliance is “handled.” The reality is more nuanced, but a good provider does take significant compliance burden off your plate.

Here is what a managed IT compliance engagement typically includes:

IT Compliance Is Not Just a Security Problem

It is tempting to treat compliance as a subset of cybersecurity. In practice, IT compliance touches every part of your technology environment:

• HR and onboarding: How are user accounts provisioned and deprovisioned? Is access reviewed when employees change roles?
• Procurement: Are your vendors assessed for security risk? Do your contracts include data processing agreements?
• Operations: Are your backup and disaster recovery procedures documented and tested? Can you prove it?
• Finance: If you process payments, are your systems PCI-compliant? Is cardholder data isolated?

How to Evaluate a Provider’s Compliance Capabilities

Not every managed IT provider is equipped to handle compliance. When evaluating a partner, ask:

• Which frameworks do you have direct experience with? Generic “we do compliance” answers are a red flag. You want specifics: SOC 2 Type II, PCI DSS v4.0, PHIPA, NIST CSF.
• Is your own organization certified? A provider that has achieved SOC 2 certification themselves understands the process from the inside, not just theoretically.
• How do you handle evidence collection? Manual spreadsheets signal immaturity. Look for automated evidence collection integrated with your existing tooling.
• What is your remediation process? When a gap is identified, how quickly is it addressed? Is remediation included in the engagement, or billed separately?
• Can you support multiple frameworks simultaneously? If you need SOC 2 and PCI DSS, your provider should map overlapping controls rather than running two separate projects.

Getting Started with IT Compliance

If your organization has not formally addressed IT compliance, the path forward is straightforward:

IT compliance is not a checkbox exercise. It is an ongoing operational discipline that protects your business, satisfies your clients, and keeps regulators at arm’s length. The question is not whether you need it, it is whether you are doing it well enough.