Contact
Let’s talk about your infrastructure
The first conversation is free and without commitment. You leave with a written summary of your primary exposure.
Office
Montréal, Québec, Canada
Write to us
Careers
What a first conversation looks like
The first call runs 30 to 60 minutes. We aim to understand your context: size, sector, regulatory obligations, past incidents, the state of your infrastructure and leadership priorities. No sales pitch at this stage.
We then send you a written summary of your primary exposure and, if an engagement makes sense, a costed proposal with scope, milestones and deliverables. If you do not proceed, the summary is yours to keep.
Key points
- A 30 to 60 minute conversation, with no commitment and no sales pitch.
- You leave with a written summary of your principal exposure.
- Incident in progress: say so in your message and it goes ahead of everything else.
- The first contact is with a consultant, not a sales desk.
How does a first conversation work?
In 30 to 60 minutes, by phone or video. We aim to understand your context: size, sector, regulatory obligations, past incidents, the state of your infrastructure and leadership priorities. No sales presentation at this stage.
The format is deliberately short and informal. Its purpose is not to sell you something but to establish whether your need matches what we know how to do, and which of our engagement types would deliver the most value in your situation. Sometimes the conclusion is that you do not need us, and that is an acceptable conclusion.
What should you do in the first sixty minutes of an incident?
Four reflexes, in this order. Do not power off the affected machines. Isolate from the network rather than shutting down. Write down the time and nature of what you observe. Then alert someone authorised to decide, before acting on the systems.
If personal information is affected, Law 25 additionally requires you to record the incident in your register, assess the risk of serious injury, and notify the Commission d’accès à l’information and the individuals concerned where that risk exists.
- Do not power off. A machine that is shut down loses evidence in memory that often determines what happened and how far it went. Unplug the network, yes; cut the power, no.
- Isolate rather than shut down. Removing suspicious endpoints and servers from the network limits spread while preserving state.
- Document as you go. Time, symptom, action taken, by whom. That record serves the qualification of the incident, the regulatory notification and your insurer.
- Do not pay, do not respond alone. Where a ransom is demanded, the Canadian authorities’ position is consistent: payment is not recommended. Report the incident to the Canadian Centre for Cyber Security and the Canadian Anti-Fraud Centre.
How do you handle inbound requests?
Every request is read by a consultant, not by an automated system nor by a sales qualification desk. We come back to you as soon as we have something useful to say, and reports of an incident in progress go ahead of everything else.
We do not publish a response-time commitment. That is a deliberate choice: a posted timeline is only worth having if it holds in every case, including during an emergency engagement at another client, and we prefer not to promise what we do not fully control. What we do guarantee is the nature of the reply: it comes from a person who has read your context.
What we see in the field
The three things that save the most time
When an executive writes to us, three pieces of information in the message shorten the first conversation considerably.
The first is what is prompting this now. An insurer’s questionnaire, a client requirement, an incident at a competitor, a doubt after reading something. This shapes everything, because it determines which deliverable will actually be useful to you.
The second is the size of the estate and the number of sites, even approximately. The third is whether an IT provider is already in place, and what their contract covers.
Sources
- Canadian Centre for Cyber Security · incident reporting and recommended measures
- Canadian Anti-Fraud Centre · reporting fraud and ransom demands
- Commission d’accès à l’information du Québec · confidentiality incident register and notification
- Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) · obligations in the event of a confidentiality incident
Frequently asked questions
How does the first conversation work?
It runs 30 to 60 minutes, by phone or video, with a consultant. We ask questions about your context rather than presenting our offers: what would stop you tomorrow, what your licences already cover, and who holds you to account. You then receive a written summary of your principal exposure. There is no sales presentation and no pricing proposal at this stage, because putting a number on it before surveying the environment would produce a wrong number.
Is the initial assessment genuinely without commitment?
Yes, and the written summary stays yours even if you do not proceed. That is a deliberate position: an organization that leaves with a clear view of its risks and decides to handle them itself has still gained something. We prefer that to an engagement sold before it was understood, which generally ends badly for both parties. No clause binds you at the end of that conversation.
Do you handle emergencies?
Reports of an incident in progress are prioritised above all other requests. Say so explicitly in the first paragraph of your message, or call. We do not publish a guaranteed response time, because a commitment of that nature is only worth having if it holds in every case, including when we are already engaged elsewhere. The Protection and 360 levels of SIRIS do, however, include contractually defined on-call coverage.
Do you charge for the first conversation?
No. The first conversation and the written summary that follows it are free. What is billed begins with the in-depth technical review, and that is then set out in a written proposal with scope, milestones and deliverables, accepted before any work starts. You will not receive an invoice for something you have not agreed to in writing.
Can we contact you if we already have an IT provider?
Yes, that is the most common case. We are not a managed IT services provider and we are not looking to replace yours: our role is analysis, advice and oversight. That includes helping you frame the technical questions you lack the means to ask, particularly about their patching timelines, the scope their contract actually covers, and their obligation to notify you of an incident at their end.
Is your infrastructure ready for the next threat?
A discovery call, without commitment, to understand your reality before recommending anything.