Managed Cybersecurity · Canada
Service group: CybersecurityA cybersecurity programme sized for a 5 to 200 person organization
We operate the practical controls that reduce the likelihood and impact of common attacks, such as account takeover, phishing and ransomware, and we document who is responsible for each one so security stops being an assumption.
At a glance
- Service
- Recurring managed cybersecurity programme delivered by Podium Catchers, built from scoped control areas
- Best suited to
- Canadian organizations of roughly 5 to 200 employees without a dedicated internal security team
- Core inclusions
- Identity and MFA policy, endpoint protection, email filtering, backup oversight, patching, alert review in agreed hours and a quarterly risk review (as scoped)
- Not included by default
- After-hours monitoring, penetration testing, digital forensics, legal or regulatory advice, and licence purchases
- Frameworks referenced
- CIS Controls, NIST Cybersecurity Framework 2.0 and the Canadian Centre for Cyber Security baseline controls, used as reference points rather than as an attestation
- Pricing basis
- Per user and per device per month, proposed after discovery and confirmed in a written quotation
- How to start
- Book a consultation or begin with a security assessment, then review a written scope before onboarding
What managed cybersecurity covers
Managed cybersecurity is the ongoing operation of a defined set of security controls across your identities, devices, email, data and network. Rather than buying a single product and hoping it is configured well, you get a provider who deploys the controls, keeps them current, reviews what they report, and tells you plainly where risk remains.
We organize the work around the five functions most small organizations need first: knowing what you have, protecting accounts and devices, noticing suspicious activity, responding in a coordinated way, and recovering data. These map naturally to the Govern, Identify, Protect, Detect, Respond and Recover functions in NIST CSF 2.0, and to the baseline controls the Canadian Centre for Cyber Security publishes for small and medium organizations.
No set of controls can stop every attack. The goal is to make common attacks harder, to shorten the time between something going wrong and someone noticing, and to make recovery a rehearsed process rather than an improvisation.
Security problems we usually find first
Most incidents at smaller organizations start with ordinary gaps, not exotic techniques.
Inconsistent sign-in protection
Multifactor authentication is enabled for some staff, legacy authentication is still allowed, and shared or former-employee accounts remain active.
Unmanaged or unpatched devices
Laptops that have not checked in for months, operating systems past end of support, and endpoint protection that was installed once and never reviewed.
Email as the main attack path
Phishing, invoice fraud and impersonation of executives or suppliers reach inboxes because filtering, SPF, DKIM and DMARC were never tuned.
Backups nobody has restored
Backup jobs report success, but no one has tested a restore, and the backup copy may be reachable with the same credentials an attacker would steal.
Control areas in the programme
Identity and access
MFA enforcement, conditional access where licensing supports it, administrator account separation, and regular access reviews for staff, guests and service accounts.
Endpoint protection
Managed antivirus and endpoint detection on covered Windows and macOS devices, with policies for tamper protection, attack surface reduction and device isolation.
Email security
Anti-phishing and anti-malware policies, safe link and attachment handling, and sender authentication records configured for your domains.
Vulnerability and patch management
Scheduled operating system and application updates, plus periodic scanning to find what patching missed and prioritize the fixes.
Backup and recovery oversight
Monitoring of backup jobs for in-scope systems, separation of backup credentials, and periodic restore tests.
People and preparedness
Security awareness training, simulated phishing, and an incident response plan your leadership team has walked through before it is needed.
Typical scope boundaries
Your proposal lists the exact control areas, devices and users covered. This is the usual starting point.
Typically included
- Security baseline configuration for Microsoft 365 or Google Workspace identities
- Endpoint protection deployment, policy management and alert review on covered devices
- Email filtering policy and sender authentication record maintenance
- Patch management and periodic vulnerability scanning of covered devices
- Backup job monitoring and scheduled restore tests for listed systems
- Review of security alerts during agreed business hours
- A maintained risk register and a quarterly security review
Requires separate scope or quotation
- 24/7 monitoring or a security operations centre (SOC) service
- Penetration testing or red-team exercises
- Digital forensics, breach investigation or litigation support
- Legal, privacy or regulatory advice, including breach notification decisions
- Security software licences and hardware purchases
- Preparing or submitting a CyberSecure Canada certification application on your behalf
Technologies we commonly work with
The final toolset depends on your licensing and existing investments, confirmed during discovery.
- Microsoft Entra ID, conditional access and Microsoft Authenticator
- Microsoft Defender for Business, Defender for Endpoint and Defender for Office 365
- Microsoft Intune compliance and configuration policies
- Third-party endpoint protection platforms where already licensed
- Business firewalls with secure remote access
- Cloud and on-premises backup platforms with immutable or offline copies
- Security awareness training and phishing simulation platforms
Who this programme suits
Organizations with no security lead
Owner-led and mid-sized businesses where security decisions currently fall to whoever manages IT, if anyone.
Firms handling client or patient information
Accounting, legal, healthcare and professional services teams who need documented safeguards and clearer evidence for insurers and clients.
Businesses answering insurance questionnaires
Organizations whose cyber insurance renewal asks about MFA, endpoint detection, backups and training, and who want accurate answers.
What changes when security is managed
- A written list of controls, owners and known gaps instead of assumptions
- Faster awareness of suspicious sign-ins and device alerts during agreed hours
- Fewer easy entry points for phishing and credential theft
- Recovery that has been tested before an incident tests it for you
- Better-supported answers to insurer and client security questionnaires
- A prioritized roadmap you can budget against quarter by quarter
How we build and run the programme
Consultation
We discuss your systems, data, insurance requirements, recent incidents and the risks that worry leadership most.
Baseline assessment
We review identity, endpoint, email, backup and network settings against recognized baseline controls and record the gaps.
Written scope and roadmap
You receive a proposal listing the control areas, covered users and devices, alert review hours and a prioritized remediation plan.
Deploy and harden
Urgent gaps such as missing MFA, unprotected devices or untested backups are closed first, with change communication for staff.
Operate and review
We maintain the controls, review alerts in agreed hours, update the risk register and meet quarterly to reprioritize.
Ways to start
Recurring security services are confirmed in a written quotation before billing begins.
Start with an assessment
A Security Assessment or Microsoft 365 Security Assessment shows where you stand before you commit to recurring services.
Add individual controls
Managed Endpoint Security, Security Awareness Training or Backup Monitoring can be added on their own, priced per device or per user.
Bundle with managed IT
Security control areas can be combined with a managed IT package so support and security are handled by the same accountable team.
Privacy obligations remain yours to decide
Organizations subject to PIPEDA must report breaches of security safeguards that create a real risk of significant harm and keep records of all such breaches. We can help you gather technical facts, but whether and how to report is a legal decision you should make with qualified legal advisers.
Frequently asked questions
Can you guarantee we will not be breached?
No provider can honestly promise that. We reduce the likelihood of common attacks, improve how quickly suspicious activity is noticed during agreed hours, and make recovery a tested process. Remaining risks are recorded in your risk register so leadership can decide how to treat them.
Is this a 24/7 security operations centre?
No. Alert review happens during the hours written into your scope. If you need continuous monitoring, we will say so during discovery and discuss what an extended arrangement or a specialist provider would involve.
Do you help with CyberSecure Canada or other frameworks?
We use CIS Controls, NIST CSF 2.0 and the Canadian Centre for Cyber Security baseline controls as reference points. If you decide to pursue CyberSecure Canada, the controls we operate can support your preparation, but the application and any assessment are yours.
What happens if we have an incident?
We follow the incident response plan agreed with you: contain affected accounts or devices, preserve logs we have access to, restore from backup where needed, and coordinate with your insurer, legal advisers or a forensic firm if one is engaged.
How is managed cybersecurity priced?
Most components are priced per user or per device per month. Figures shown in the store or calculator are proposals; your written quotation confirms the final price after discovery.
Related services
Products and packages
Industries we support
Service areas
Find out which security controls your organization needs first
Book a consultation to review your current protections and priorities. You will receive a written scope and roadmap before any recurring commitment.