RISS 360: enterprise-grade cybersecurity, scaled to your business

Why does a smaller business need a capability it cannot hire?

Because regulatory obligations and attackers draw no distinction by size, while resources clearly do. A forty-person business must keep an incident register, notify the Commission d'accès à l'information and withstand the same ransomware as a bank, with a fraction of the means.

The Canadian Centre for Cyber Security is explicit: ransomware attacks continue to rise in Canada and **all Canadian organizations are at risk, regardless of size**. Targeting is largely automated. The scans looking for an unpatched remote access do not know how many people you employ.

No trade is spared any more, and that is the point executives take longest to accept. From the farmer who depends on herd management software to the brokerage handling financial files, exposure is no longer readable in the sector: it is readable in the tools used, and in the habits of the people using them.

• The attacker's arithmetic favours smaller organizations. A large organization has detection teams, proven backups and negotiators. A smaller one is statistically less protected, more dependent on its systems to operate, and therefore likelier to pay quickly.
• You are also a path to something bigger. As a supplier to a major client, you become an entry point towards them, and that turns rapidly into a contractual requirement on you.
• The cost extends well beyond the ransom. Statistics Canada measured a doubling of recovery costs reported by Canadian businesses between 2021 and 2023, from $600M to $1.2B.

What does RISS 360 actually cover?

Three areas a smaller organization cannot hold on its own: regulatory compliance, protection tooling and its management, and continuous monitoring with incident response. You keep the decision on each. We carry the execution, the documentation and the regulatory watch.

This split is operational rather than commercial: these are the three places smaller organizations actually get caught, and the three where a gap in follow-up only becomes visible after the incident.

• Compliance. Confidentiality incident register, governance and retention policies, designation of the privacy officer, notification procedure, privacy impact assessments for your out-of-province data flows. All documented in a form that holds up under review.
• Protection. Organization-wide multi-factor authentication, endpoint and server detection, firewalls and remote access, supervised backups with real restore testing. We first audit what your current licences already cover without being switched on.
• Reputation and continuity. Monitoring of mentions of your organization and its leadership, a written and rehearsed response plan, and crisis communication prepared in advance rather than improvised on the day it matters.

How do you choose between the three levels?

The level follows your dependence on IT, not your revenue. Essentiel lays down the missing foundations. Protection adds continuous tool management and monitoring. The 360 level covers full digital transformation, compliance and governance included.

Moving between levels is the norm rather than the exception. Many organizations begin by closing the foundations, then shift to continuous management once the posture has stabilised.

• Essentiel. For the organization starting from far back, which first needs the basics closed: access, backups, patching, awareness. The aim is to make the most ordinary attack scenarios disappear.
• Protection. For the organization whose downtime is expensive and which needs someone watching continuously: supervised detection, tool management, defined on-call coverage, periodic posture review.
• 360. For the organization running a transformation project, answering client questionnaires or targeting a regulated market: governance, compliance and operational security treated as one piece of work.

What does cybersecurity cost for a smaller business?

It is the most asked question in this market, and we answer it directly: no single price can be published honestly. What determines scope, on the other hand, can be named precisely. Six variables explain why two firms of identical size receive very different proposals.

Dodging the question costs an executive's trust. Answering it with a posted price would be worse, because that price would be wrong for almost everyone. The variables that matter:

The page on building a proposal sets out how each of these variables translates into scope.

• The number of users and sites , which sets the surface to cover and to monitor.
• What already exists , and above all what your licences already cover: in many organizations, security features already paid for are simply not enabled.
• The applicable obligations , depending on whether you handle sensitive personal information, health data or payment data.
• Criticality , measured by what an hour of downtime actually costs you.
• The level of handover you want, from knowledge transfer to your teams through to full management.
• Your clients' and insurer's requirements , which sometimes impose controls you would not have prioritised.

How does an engagement start?

With a 30 to 60 minute conversation, free and without commitment, from which you leave with a written summary of your principal exposure. That summary is yours to keep even if you do not proceed. No tool is proposed before your exposure is understood.

If an engagement then makes sense, you receive a proposal with scope, milestones and deliverables. Deployment proceeds in reversible waves, each with its rollback window, because a smaller organization cannot afford a security project that interrupts its operations. Continuous management takes over afterwards, with a periodic report readable by a management team rather than by an engineer.

What happens to your current IT provider?

In the large majority of cases, they stay. We are not a managed IT services provider and we are not looking to replace yours. Our role is analysis, advice and oversight, which includes helping clarify what their contract should guarantee.

That position has a direct consequence: we have no interest in your buying one tool over another, because we do not resell licences. It is also what lets us assess your provider without a conflict of interest, verify their patching and notification commitments, and say when those are missing.