Risk, translated. · Moncton, NB · Serving Canada

Cybersecurity for small business.

Senior-led cybersecurity for small and mid-sized businesses. Most businesses your size don’t need a full-time security team, but they do need to understand their risk. We identify your real-world exposure, respond to customer and cyber-insurance security questionnaires, and test your defences using the same techniques an attacker would.

Built for businesses of 10 to 500 people, with or without an IT team.

  • Security on Call
  • Governance, Risk & Compliance
  • AI Governance
  • Penetration Testing
  • Industrial & OT Security
  • Security Architecture
  • Virtual CISO
Explore Our Services

Free 45-minute working session with a senior consultant. No obligation.

Frameworks we work in
ISO 27001 SOC 2 NIST CSF PCI DSS 4.0 HIPAA IEC 62443 ISO/IEC 42001

Senior-led, end to end. Every engagement is delivered by a senior consultant, never handed to a junior. Behind it: 7+ years securing energy, municipal, and retail-payment environments, with hands-on depth in security architecture & design, penetration testing (web, network, mobile), and application security testing (SAST & DAST).

Certifications we hold
CISSP OSCP CompTIA PenTest+ CompTIA Security+ CE Microsoft SC-900
Education
MBA B.Eng, Electrical/Electronics Engineering

In their words

What clients say.

I put off having our website looked at for two years, assuming a cybersecurity firm meant a hefty retainer and a three-month project. Wrong on both counts. Avertix gave us a fixed price up front, scoped it in one 45-minute call, and hardened our site without disrupting a thing. No retainer, no upsell. If you’re a small business owner avoiding this because you assume you can’t afford it: make the call. It cost less and took less time than I’d budgeted.
Facility Solutions Company
The best IT and OT security service in Atlantic Canada. Avertix is a true one-stop partner covering critical infrastructure, IT networks, and compliance across both OT and IT. What sets them apart isn’t only the technical depth. It’s the service: responsive, proactive, and genuinely invested in solving problems before they become issues. We’ve worked with several providers, but Avertix stands out. I’d recommend them without hesitation.
Engineering Services Firm

What we do

Eight services.
Boardroom to exploit.

Most firms do governance or offensive testing. We do both, plus the AI assurance work almost nobody in Atlantic Canada is equipped for yet, scoped to what a business your size actually needs, at a fixed price agreed before any work starts.

Advisory & Assurance

Strategy, governance and assurance, including AI.

vCISO Services

Fractional executive security leadership: strategy, board reporting and program direction, without a full-time hire.

  • Strategy
  • Board reporting

GRC Advisory

Governance, risk and compliance programs that satisfy the auditor and genuinely reduce exposure.

  • ISO 27001
  • SOC 2
  • NIST CSF

AI Governance & Assurance

Stand up an ISO/IEC 42001 management system and NIST AI RMF controls, then evidence them for audit and the board.

  • ISO/IEC 42001
  • NIST AI RMF

AI Risk & Compliance

AI risk and impact assessments, responsible-AI policy, and a defensible path through the EU AI Act.

  • EU AI Act
  • ISO/IEC 42005

Technical Security

Hands-on assessments and engineering.

Penetration Testing

Manual, expert-led offensive testing across web, network, cloud, mobile and API attack surfaces.

  • Web
  • Network
  • Cloud
  • API

OT / ICS Security

IEC 62443-aligned assessments for the industrial systems that cannot go down. Safety and uptime come first.

  • IEC 62443
  • SCADA

Security Architecture

Zero-trust reference architectures and pragmatic roadmaps that scale with cloud and modern work.

  • Zero Trust
  • IAM
  • SASE

Data Sanitization

Certified media destruction to NIST 800-88, with full chain-of-custody documentation.

  • NIST 800-88
  • Chain of custody

Ongoing support

A senior consultant
on call, all year.

Most small and mid-sized businesses do not need a full-time security hire. They need someone to ask. Keep Avertix on a monthly retainer and you get a direct line for the things that come up between projects.

  • A vendor security questionnaire landed and you have to answer it
  • An email looks wrong and nobody is sure whether to click it
  • A new system is going live and no one has reviewed it
  • Your insurer or your biggest customer is asking which controls you run

Not sure which of these you need?

That is what the first call is for. Bring the audit finding, the security questionnaire you cannot answer, or the AI deployment nobody has governed yet.

The promise

We don’t just find vulnerabilities. We turn them into decisions you can act on Monday.

01 · The advantage

Senior consultants only.
No junior hand-offs.

At most firms a partner sells the engagement and a graduate delivers it. Here, the person who scopes your work is the person who does it. Every finding is written by someone who has sat on your side of the table.

  • Framework-aligned by default, so findings hold up to auditors, regulators and insurers
  • Prioritized remediation roadmaps with owners and effort estimates
  • Plain language you can act on, not a 100-page PDF nobody opens

02 · The wedge

AI governance,
ready now.

Your organization is already deploying AI. Your policy, your risk register and your regulator are not caught up. We close that gap with a defensible program rather than a statement of intent.

AI system inventories and model cards, risk and impact assessments, human-oversight controls, and independent assurance readiness, all mapped onto the ISO 27001 or SOC 2 program you already run.

03 · Method & materials

A disciplined path,
every engagement.

Four phases, always in the same order, so you always know where you are and what comes next. The craft is in the precision, not the theatrics.

01

Discover

We map your environment, assets and business context before touching a single control.

02

Assess

We quantify real exposure through hands-on testing and framework-aligned analysis.

03

Design

We architect resilient, pragmatic solutions with a prioritized remediation roadmap.

04

Defend

We implement, validate and continuously strengthen the controls that matter.

04 · Who we help

The problems that bring
smaller businesses to us.

You do not have to know what is wrong before you call. Most of these start as one awkward question nobody in the building can answer.

Nobody actually owns security

You have an IT person, a managed provider, or neither, and security keeps falling between them. We take ownership of it without you hiring for it.

vCISOSecurity on Call

A customer wants proof

A security questionnaire, a SOC 2 request, an ISO 27001 clause in a contract. We give you the shortest honest path to the answer they will accept.

SOC 2ISO 27001NIST CSF

Your insurer wants specifics

Cyber policies now ask exactly which controls you run, and a wrong answer costs you the claim. We get you to a defensible yes, in writing.

Controls reviewEvidence

You grew faster than your security

New staff, new SaaS, old access nobody revoked, and no map of any of it. We find what you actually have before someone else does.

Access reviewArchitecture

You do not know what a breach would cost

Testing your defences the way an attacker would is the only honest way to find out. Then we price the risk in operational terms, not scanner output.

Penetration testingRisk

Something else?

The problems change, the method does not. Tell us what is keeping you up and we will scope it on the call.

Industries we know: professional services · financial services · healthcare · energy & utilities · manufacturing · retail & payments · municipal & government · engineering & construction

05 · Credentials

Framework-aligned,
audit-defensible.

8 Services across advisory & technical
4 Phase engagement model
100% Senior-led delivery, no hand-offs
Advisory & Assurance vCISO · GRC Advisory · AI Governance & Assurance · AI Risk & Compliance
Technical Security Penetration Testing · OT / ICS Security · Security Architecture · Data Sanitization
Governance frameworks NIST CSF · NIST 800-53 · ISO 27001 / 27002 / 27701 · SOC 2 · HIPAA · HITRUST · PCI DSS 4.0 · CMMC · FedRAMP
AI frameworks ISO/IEC 42001 · NIST AI RMF · ISO/IEC 23894 · ISO/IEC 42005 · EU AI Act
Technical standards IEC 62443 · NIST 800-88 · Zero Trust · SASE / SSE
Certifications CISSP · OSCP · CompTIA PenTest+ · CompTIA Security+ CE · Microsoft SC-900
Governance & delivery PRINCE2 Practitioner · ITIL v3 Foundation
Education MBA · B.Eng, Electrical/Electronics Engineering
Based in Moncton, New Brunswick · serving Canada

Before you call

Questions we get
from businesses your size.

We are a small business. Can we actually afford this?

Usually yes, and for less than people expect. We scope the work on a single call and agree on a fixed price before anything starts, so there is no open-ended bill. If an ongoing retainer is the better fit, you are charged for the time you actually use rather than a flat managed-service fee. The first consultation is free, and we will tell you if you do not need us yet.

We do not have an IT team. Can you still help?

That is the normal case for businesses this size, and it is who this practice is built for. You do not need to speak the language or know what is wrong before you call. We work out what you have, explain it in plain terms, and tell you what to do first. Where you have an IT provider already, we work alongside them rather than replacing them.

What actually happens in the free consultation?

Forty-five minutes with a senior consultant, not a salesperson. Bring the audit finding, the questionnaire you cannot answer, the insurance form, or just the thing that is worrying you. You leave with a scoped path forward and a clear idea of cost, whether or not you engage us. There is no obligation and no follow-up sales sequence.

How does the Security on Call retainer work?

A monthly retainer keeps your line open to a senior consultant, and the work you draw on is billed as time and materials, so you pay for the hours you actually use. It is meant for the things that come up between projects: a vendor questionnaire, a suspicious email, a new system going live, an insurer asking which controls you run. We will tell you on the first call whether it is worth it for a business your size.

A customer sent us a security questionnaire. Can you help?

Yes. It is one of the most common reasons businesses call us. We work out which of the questions genuinely apply to you, help you answer them accurately, and identify the small number of gaps worth closing before you send it back. Where a customer is asking for SOC 2 or ISO 27001, we will tell you honestly whether you need the certification or just a defensible answer.

Do you work outside New Brunswick?

Yes. We are based in Moncton, New Brunswick, and work with clients across Canada. Assessments, testing, advisory and governance are all done remotely, and on-site visits are arranged where the work genuinely needs someone in the building, which is most common for industrial and OT environments. Service is available in English and French.

Start here

Schedule a free consultation.

A working session with a senior consultant, not a sales call. Bring the questionnaire you cannot answer, the insurance form, the audit finding, or just the thing that is worrying you. You will leave with a scoped path forward and a clear idea of cost, whether or not you engage us.

  • Scope your exposure and the obligations that actually apply
  • A prioritized view of what to fix first, and what can wait
  • Clear pricing before any work begins