Frequently asked questions
Short answers to the questions owners and office managers ask before they hire us: what we do, what happens when you call, how work is quoted and how you would leave. Each answer links to the page that goes deeper.
What we do and who we do it for
We run four practices from one team: cyber forensics and incident response, privacy and AI governance, legal technology for law firms and in-house counsel, and managed IT support. The same people who look after a client's Microsoft 365 tenant day to day are the ones who investigate it when something goes wrong, so nobody starts from a blank page.
Mostly small and mid-sized organizations, from a handful of staff to a few hundred. Our published case studies cover a Mississauga real estate developer, a fire protection and security company, a Vaughan smart-home integrator, a metrology and calibration firm and a pharmaceutical services company. We work from offices in Vaughan and Vancouver and have been doing this since 2018.
Yes. A common setup is that your provider keeps the helpdesk and we take a defined piece, such as a security review, an email authentication project or an investigation. During an incident the split matters: your provider restores service, and we preserve evidence and work out what happened. Co-managed IT explains how the lines are usually drawn.
When something has gone wrong
Call (289) 582-9930; the line runs 24/7. We will ask what you saw and when, which accounts or machines look affected, what anyone has already changed, and if you have cyber insurance or a lawyer involved. Before anyone hangs up you should have a short list of what to do and what to leave alone. The incident response FAQ covers those first decisions.
Usually not. Unplug the network cable or turn off Wi-Fi and leave it powered on, because memory can hold evidence of how the attacker got in. The exception is encryption actively spreading across the network, where stopping the damage comes first. If you are unsure, call before you pull the plug.
We work under the direction of breach counsel when counsel is retained, and we write reports an adjuster can follow. Check your policy's notice clause and vendor rules before you sign with any responder, ours included. For counsel, insurers and brokers sets out how that relationship works. We carry $2M in cyber liability insurance ourselves.
Our forensic work is collected and documented so it can be relied on in a dispute, and we take on expert-witness work. Whether a particular report is admissible is a question for your counsel. The digital forensics and evidence FAQ explains chain of custody and what a report needs to contain.
Quotes, timing and contracts
Outside an emergency, we scope the work first and send the terms in writing before it starts. During an incident the first call is about containment, and the written scope follows once the size of the problem is clearer. Ongoing support is quoted after we have looked at your users, devices and systems. Managed IT plans and the sample engagement letter show what the paperwork looks like.
We are staffed 24/7. For anything that is not an emergency, use the contact form or call (289) 582-9930. If systems are down or you think someone is inside your accounts, do not wait for an email reply: call the incident line.
Most work, including most investigations, is done remotely. Some jobs need hands on hardware, such as cabling, Wi-Fi surveys or imaging a laptop that cannot be shipped. When that is the case we arrange it as part of scoping the work, and our Vaughan office is at 7810 Keele St.
Every admin account and password for your systems, your Microsoft 365 or Google Workspace global admin access, network and firewall credentials, licence records and the documentation of how things are set up. Ask any provider, including us, to confirm that in writing at the start. How to switch IT providers walks through a clean handover.
Managed IT, cost and security basics
A managed IT company, or managed service provider (MSP), runs a business's IT for a monthly fee under a written scope: helpdesk support, device monitoring and patching, Microsoft 365 or Google Workspace administration, backups, security tools and vendor management, plus planning for upgrades and projects. Our managed IT practice and IT companies guide explain the model.
It depends on scope: users and devices, servers, security and backup tools, coverage hours and onboarding. Quotes are usually per user, per device or tiered. We do not publish prices; we quote in writing after scoping. The managed IT cost guide explains every cost driver.
Most businesses under about 20 staff get more coverage from a provider than from one hire; larger firms often keep an internal person and add a provider. The managed vs in-house guide shows how to run the numbers.
Your internal IT staff keep some work and a provider takes defined pieces, such as security monitoring, after-hours incidents and projects, with each task assigned in writing. See co-managed vs fully managed IT.
BEC is fraud where a criminal takes over or imitates a business email account to redirect payments or obtain sensitive information, usually after stealing a password through a fake sign-in page. It rarely involves malware. If it is happening now, call (289) 582-9930; our BEC response page explains what we do.
Yes. DMARC tells receiving mail servers to junk or reject email that fakes your domain. In IT Rapid Support's GTA Business Email Security Q4 2026 study, only 20.7% of 482 mail-enabled GTA business domains enforced it. Check yours with the email spoof check.
Applications commonly ask about MFA on email, remote access and admin accounts, endpoint detection and response, tested offline or immutable backups, patching, staff training and an incident response plan. The cyber insurance readiness checklist lists what to have in place and on file.
MFA for every account, blocking legacy authentication, two emergency admin accounts and fewer than five Global Admins, then forwarding blocks, audit alerts and DMARC. The Microsoft 365 security best practices page has the full checklist.
Still have a question?
Send it through the contact page; we read every enquiry, 24/7. For an active incident, call (289) 582-9930.
Related.
- PageIncident response FAQShort, plain answers to the questions people ask in the first hours of a cyber incident: whether to turn things off, whether to pay, who to tell, and how insurance and…
- PageDigital forensics and evidence FAQAnswers for employers, HR teams and lawyers on collecting devices and accounts, recovering deleted and cloud data, chain of custody, phones, and what a forensic report…
- PagePrivacy breach and notification FAQShort answers to the Canadian breach questions that come up first: does this count, is there a real risk of significant harm, who has to be told and when, what records…
- HubReal Work for Real GTA BusinessesFive engagements written up from our own records: what the client brought us, what we did and what changed. Some clients are named with their permission; others are described by sector only.
Talk to us.
Tell us what you need. We are staffed 24/7. Active incident? Call (289) 582-9930, 24/7.