Resources · Buying local in cybersecurity
Cybersecurity tools designed here, ranked by where the money goes: Quebec companies first, then Canadian ones. For each product: what it does, where it comes from, who owns it and what it costs when the price is public. At the bottom of the page: penetration testing firms.
| Product | Category | Origin | Owner's country | Local impact | Price |
|---|---|---|---|---|---|
| Quebec first | |||||
| Flare | Threat intelligence / exposure | Montréal (QC) | Canada (Quebec) | Quebec | On request |
| Secure Exchanges | Encrypted email and e-signature | Drummondville (QC) | Canada (Quebec) | Quebec | From CA$0.99/user/month |
| Cyberdefense.ai | AI-powered web application firewall (WAF) | Quebec (province) | Canada (Quebec) | Quebec | On request |
| Okiok (RAC/M Identity, S-Filer) | Identity and access (IGA), secure file transfer | Laval (QC) | Canada (Quebec) | Quebec | On request |
| Awee – Lümee | Awareness and human risk | Greater Montréal (Laval) | Canada (Quebec) | Quebec | On request |
| SecuAAS (SecuScan, SecuSIEM, SecuAI) | SIEM, vulnerability scanning, sovereign AI | Quebec (province) | Canada (Quebec) | Quebec | On request |
| Ecurem CLM | Certificates, cryptography, post-quantum | Quebec | Canada (Quebec) | Quebec | On request |
| Quantum eMotion (Sentry-Q, eFlux-Q…) | Quantum security (QRNG, post-quantum) | Montréal (QC) | Canada (Quebec) | Quebec | On request |
| BoostSecurity | Application security / software supply chain | Montréal (QC) | Canada (Quebec) | Quebec | On request |
| BlueBear LACE | Forensics (law enforcement) | Gatineau (QC) | Canada (Quebec) | Quebec | On request (police) |
| Polytechnique Montréal start-ups | Various (human risk, GRC, DevSecOps, KYC/AML) | Montréal (QC) | Canada (Quebec) | Quebec | To be confirmed |
| Data Next Step (services) | Services: vCISO, DevSecOps, compliance | Montréal (QC) | Canada (Quebec) | Quebec | ≈ $150/h |
| Made in Quebec, foreign-owned | |||||
| GoSecure Titan | Managed detection and response (MDR / EDR) | Montréal (QC); headquartered in San Diego (U.S.) | United States | Made here · foreign-owned | On request |
| Terranova Security | Awareness and phishing simulation | Laval (QC) | United States | Made here · foreign-owned | On request |
| Zerospam (Hornetsecurity) | Email filtering and security | Montréal (QC) | United States | Made here · foreign-owned | On request |
| Hitachi Cyber (formerly Hitachi Systems Security) | SOC and managed security services | Blainville (QC) | Japan (ultimate owner) | Made here · foreign-owned | On request |
| Seela | Online cybersecurity training | Presence in Montréal | France | Made here · foreign-owned | On request |
| Then Canada | |||||
| CIRA Canadian Shield | Protective DNS | Ottawa (ON) | Canada | Canada | Free |
| CIRA DNS Firewall and awareness training | Enterprise protective DNS, awareness | Ottawa (ON) | Canada | Canada | Training from $50/user/year |
| Assemblyline | File and malware analysis | Ottawa (ON) | Canada | Canada | Free (open source) |
| Get Cyber Safe | Awareness content | Ottawa (ON) | Canada | Canada | Free |
| Field Effect MDR | Managed detection and response (MDR) | Ottawa (ON) | Canada | Canada | Per user, by quote |
| Beauceron Security | Awareness and human risk | Fredericton (NB) | Canada | Canada | On request |
| 1Password | Password management | Toronto (ON) | Canada | Canada | US$8.99/user/month |
| Bluink eID-Me | Identity verification and digital identity | Ottawa (ON) | Canada | Canada | On request |
| Plurilock (DEFEND, AI DLP) | Continuous authentication, data loss prevention | Vancouver / Victoria (BC) | Canada | Canada | On request |
| Echoworx | Email encryption | Toronto (ON) | Canada | Canada | On request |
| BlackBerry (UEM, AtHoc, SecuSUITE) | Secure communications, device management | Waterloo (ON) | Canada | Canada | On request |
| Canadian, foreign-owned | |||||
| eSentire | Managed detection and response (MDR) | Waterloo (ON) | United States (majority) | Canadian · foreign-owned | On request |
| Absolute Security (formerly Absolute Software) | Device resilience and control | Founded in Vancouver; headquartered in Seattle | United States | Canadian · foreign-owned | On request |
| Magnet Forensics (AXIOM) | Digital forensics | Waterloo (ON) | United States | Canadian · foreign-owned | On request |
| Arctic Wolf (Aurora) | MDR and endpoint protection | Large team in Waterloo (ON) | United States | Canadian · foreign-owned | On request |
Products designed and owned in Quebec. Every sale directly strengthens the Quebec ecosystem.
Threat exposure management: dark web monitoring, stolen credentials, data leaks, external attack surface and identity exposure.
End-to-end encrypted email and file sending, with nothing for the recipient to install. Integrates with Outlook and Gmail, hosted in Canada, designed with Quebec's Law 25 in mind.
Protection, monitoring and compliance for web applications, APIs and portals, integrated into private data centres. Aimed at hospitals, cities and critical organizations.
RAC/M Identity for identity governance and administration, S-Filer for secure file sharing, plus audit and architecture services.
Awareness through micro-lessons of under 2 minutes that measure human risk. Partner in a Université Laval initiative.
SaaS suite hosted at OVH in Beauharnois, with data kept in Quebec, designed for Quebec's Law 25, PIPEDA and the GDPR.
Centralizes the certificate lifecycle, inventories cryptographic assets and prepares for the post-quantum transition. SaaS, dedicated instance or on-premises.
Quantum random number generator and a suite of post-quantum products: encryption, entropy as a service, SDK.
DevSecOps platform to secure the software supply chain and AI-generated code (acquired SecureIQx and Korbit in 2026).
Tools that automate the processing of digital evidence in child exploitation cases. LACE Carver is integrated into Griffeye (Magnet Forensics).
Mindlock (cognitive training), TuringVault (SaaS tools for SMBs), Ratel Guard (AI virtual CISO), DevOps Shield (cloud governance), CloudConseils (tenant isolation for SaaS), Chronhr (KYC/AML).
A services firm, not a product: Zero Trust, DevSecOps, Quebec's Law 25 readiness, SOC 2, ISO 27001 and ISO 42001, AI agent audits. Combines local expertise with an offshore team.
The teams, and often the R&D, are here, but the parent company is elsewhere.
MDR platform with a SOC, endpoint detection, email protection and professional services (including penetration testing).
Awareness and phishing simulation platform in over 40 languages, with gamification.
Cloud email protection, now part of Hornetsecurity's Microsoft 365 offering.
Global SOCs and managed security and data privacy services.
Learning platform where each person trains at their own level. Also offered to universities to train the next generation.
Canadian-owned products, including free tools offered by Canadian organizations.
DNS that blocks malicious and phishing sites, using the Canadian Centre for Cyber Security threat feed. Private, Protected and Family tiers, iOS and Android apps.
Business version of Canadian Shield, with data kept in Canada, plus awareness training.
Open-source platform for triaging and analyzing malicious files, developed by the Cyber Centre.
Bilingual awareness content, reusable in training.
Turnkey MDR for SMBs, with per-user pricing designed for MSPs.
Awareness, phishing simulations and a personal cyber risk score for each employee. Also offers white-labelling for MSPs.
Team password vault with SSO, policies and reporting.
Remote identity verification, reusable digital ID (eID-Me app) and OpenID Connect and SAML identity provider.
Continuous behavioural authentication, AI-related data loss prevention, plus resale and services.
Email encryption for large enterprises, with data centres in the United States and Europe.
Endpoint management, crisis alerts and encrypted communications, mainly for governments.
Founded in Canada, since acquired by foreign interests.
Full MDR with forensics and incident response services.
Visibility, control and automatic repair of endpoints and their security agents.
Acquisition and analysis of digital evidence from computers, phones and the cloud.
Managed security operations and endpoint protection (Aurora Endpoint Security, formerly Cylance).
Firms that perform penetration testing and offensive security, ranked on the same principle: Quebec firms first, then Canadian ones. Penetration tests are almost always quote-based, depending on the scope of the engagement.
| Small web application test | $5,000 to $15,000 |
| External infrastructure | $5,000 to $20,000 |
| Internal network | $8,000 to $30,000 |
| Red team | $50,000 to $150,000 and up |
| Firm | Services | Origin | Owner's country | Local impact | Price |
|---|---|---|---|---|---|
| Quebec first | |||||
| Cynergit and Les Technologies Wolf | SMB penetration testing, Wi-Fi security, forensics | Victoriaville (QC) | Canada (Quebec) | Quebec | Quote-based |
| Yack Sécurité | Penetration testing and offensive security | Saint-Jean-sur-Richelieu (QC) | Canada (Quebec) | Quebec | Packages, amounts not published |
| Corsek | Penetration testing, red team, purple team | Quebec (city to be confirmed) | Canada (Quebec) | Quebec | Quote-based |
| Okiok (penetration testing) | Penetration testing and vulnerability assessments | Laval (QC) | Canada (Quebec) | Quebec | Quote-based |
| Mondata | Penetration testing, MDR | Montréal (QC), originally from Québec City | Canada (Quebec) | Quebec | Quote-based |
| Precicom Technologies | Penetration testing, managed IT services | Montréal and Québec City (QC) | Canada (Quebec) | Quebec | Quote-based |
| Commissionnaires du Québec | Penetration testing, including physical | Montréal, Québec City, Trois-Rivières, Saguenay, Sherbrooke (QC) | Canada (Quebec) | Quebec | Quote-based |
| Groupe CyberSwat | Penetration testing and compliance | Montréal and Québec City (QC) | Canada (Quebec) | Quebec | Quote-based |
| Cyology Labs | Penetration testing, incident response | Montréal (LaSalle, QC) | Canada (Quebec) | Quebec | Quote-based |
| Made in Quebec, foreign-owned | |||||
| GoSecure (penetration testing) | Penetration testing, red team, purple team | Montréal (QC); headquartered in San Diego (U.S.) | United States | Made here · foreign-owned | Quote-based |
| Hitachi Cyber (penetration testing) | Penetration testing, OT/ICS | Roots in Greater Montréal; headquartered in Santa Clara (U.S.) | Japan (ultimate owner) | Made here · foreign-owned | Quote-based |
| Then Canada | |||||
| Vumetric (TELUS) | Penetration testing, PTaaS | Founded in Quebec; now headquartered in Toronto (ON) | Canada | Canada | Quote-based |
| KPMG Egyde | Penetration testing, continuous security testing | Québec City and Montréal (QC) | Canada | Canada | Quote-based |
| Stingrai | Penetration testing, PTaaS | Toronto (ON) | Canada | Canada | From US$3,000 per assessment |
| Packetlabs | Manual penetration testing | Toronto (ON) | Canada | Canada | Minimum ≈ $10,000 |
| Digital Boundary Group | Penetration testing | London (ON) | Canada | Canada | Quote-based |
| White Tuque | Penetration testing for SMBs, CISO on demand | Toronto (ON) | Canada | Canada | Packages from $4,900 |
| Canadian, foreign-owned | |||||
| eSentire (penetration testing) | Penetration testing, red team | Waterloo (ON) | United States (majority) | Canadian · foreign-owned | Quote-based |
Cynergit: internal and external infrastructure security assessments, penetration testing, configuration reviews and wireless network security. Wolf: vulnerability scanning, black box and grey box testing, social engineering, phishing and digital investigations, for SMBs.
Active Directory and internal network, external IP addresses, Wi-Fi, web, APIs, mobile and AI applications, SCADA/OT and risk audits. Semperis partner.
Offensive security boutique: penetration testing, red team, purple team and setting up offensive programs.
Network, application and infrastructure penetration testing, vulnerability assessments, MDR. ISO 27001 and SOC 2 Type 2 certified.
Penetration testing, managed detection and response, and WeActis for Microsoft 365 data exposure. ISO 27001 certified.
External and internal black, grey or white box testing: applications and APIs, cloud (AWS, Azure, M365, GCP), IoT, SCADA, phishing, red team and purple team.
Internal and external network, web, mobile, SaaS, social engineering, physical intrusion, IoT and cloud testing. Combines physical security and cybersecurity.
Penetration testing, security assessments, support for ISO 27001, SOC 2, Microsoft 365 and Quebec's Law 25.
Penetration testing, vulnerability assessments, incident response, dark web monitoring and training, mainly for SMBs.
One of the largest ethical hacking teams in Quebec: network, web, mobile, Wi-Fi, physical, code review, SAP, cloud, IoT/SCADA, social engineering, red team and purple team. OSCP-certified team, PCI DSS QSA.
Penetration testing, vulnerability management, OT/ICS security and managed security services.
A major penetration testing specialist: external, internal, SCADA/ICS, web, mobile, API, cloud, medical devices, IoT, red team, social engineering and compliance. PTaaS platform. OSCP, OSWE, OSEP team.
Penetration testing and continuous security testing practice of a major firm, born from Egyde, a Québec City firm.
Web, API, mobile, AI/LLM, cloud, network, Active Directory, social engineering, red team and purple team, delivered as PTaaS. CREST accredited.
Applications, APIs, mobile, AI, infrastructure, cloud, IoT, OT, red team, purple team, assumed breach, social engineering and continuous testing. CREST accredited, SOC 2 Type II.
Network, application, SCADA, cloud and physical testing. Founded in 2003, over 1,000 engagements a year. SOC 2 Type 1.
Penetration testing, CISO on demand, MDR, phishing campaigns and simulations, geared to SMBs.
Penetration testing and red team offered as a complement to its MDR.
Want to choose local solutions that fit your organization?
Let's talkPrices, owners and offerings verified in October 2026, with independent double-checking of ownership, based on public sources (vendor websites, Capterra, GetApp, press releases). Prices in green are public; the others are negotiated. Acquisitions are frequent in this sector: confirm with the vendor before any recommendation or quote. Curseur is not affiliated with any of the vendors mentioned.
Questions? Write to us: info@curseur.ca