Email Security
Advanced anti-phishing, URL rewriting, attachment sandboxing, impersonation protection, DMARC and DKIM and SPF alignment. Covered in detail on the Microsoft 365 and Google Workspace pages.
Cybersecurity pillar · Vancouver, BC
Cybersecurity for Vancouver Businesses
A complete guide to managed cybersecurity for Vancouver and Lower Mainland small and mid-sized businesses. The threat landscape in 2026, the controls that actually move the needle, how each layer fits together, and the dedicated pages where each topic goes deep. Written by Alex Barari, founder of Hexafusion and a former PCI DSS Internal Security Assessor (ISA).
On this page
- The 2026 threat landscape for BC businesses
- The layered defence model we deploy
- How we align to NIST CSF 2.0
- Security maturity ladder
- Deep-dive cluster pages
- Compliance support (PIPEDA, PIPA, SOC 2, PCI)
- Industry-specific cybersecurity
- Cyber insurance in 2026
- A 90-day rollout
- Frequently asked questions
The 2026 threat landscape for BC businesses
Three patterns dominate every Vancouver cybersecurity incident we have helped clients respond to in the last 18 months:
- Ransomware moved down-market. Public breach reports consistently show 74 percent of ransomware victims now have fewer than 1,000 employees. Operators of ransomware-as-a-service have automated their way through dental practices, accounting firms, manufacturing shops, and non-profits. The Vancouver region is not a safe zone.
- Business email compromise (BEC) is now the highest-loss attack type in BC. Wire fraud targeting real-estate brokerages, legal trust accounts, accounting firms, and finance teams routinely produces six and seven-figure losses. Technical controls alone cannot stop BEC. It requires layered identity, email security, and trained humans.
- Credential theft drives 80+ percent of breaches. Stolen credentials (phished, info-stealer malware, password reuse) are the most common initial-access vector in every major annual breach report. Multi-factor authentication is the single control that blocks the majority of these attacks, and it is now the floor for compliance.
BC-specific factors layer on top: PIPEDA and BC's Personal Information Protection Act (PIPA) require reasonable safeguards. Cyber insurance underwriters tightened in 2025 and tightened again in 2026. The Office of the Privacy Commissioner of Canada has cited missing technical controls in multiple recent breach decisions.
The layered defence model we deploy
No single control stops every attack. We deploy a defence-in-depth stack so that when one layer fails, the next catches the threat. Each card below is a deep-dive page covering scope, methodology, FAQs, and how the layer fits the rest of the stack.
Endpoint Detection & Response (EDR / MDR) →
Behavioural endpoint protection plus 24/7 security operations centre coverage on Enterprise plans. The control that catches what antivirus misses. Cyber-insurance baseline.
Multi-Factor Authentication (MFA) →
Entra ID Conditional Access, hardware security keys, passkeys. The single control that blocks the most common attacks. Required by all major cyber insurers in 2026.
Security Awareness Training →
Monthly phishing simulations, just-in-time training, executive tabletops, PIPEDA-aligned modules. Reduces baseline click rates from 25-30 percent to under 5 percent inside a year.
Vulnerability Scanning & Attack Surface Management →
Continuous external attack-surface monitoring, monthly internal scans, cloud posture management, and prioritised remediation. SOC 2 and cyber-insurance ready.
Network Security
Next-generation firewall, network segmentation, intrusion prevention, DNS filtering, zero-trust network access. See the Network Support page for the full architecture.
Backup & Recovery
Immutable storage that ransomware cannot encrypt or delete, tested restores, documented recovery time and recovery point objectives. See the Backup & Disaster Recovery page.
Identity & Access Management
Microsoft Entra ID, Google Workspace identity, conditional access, privileged access workstations, just-in-time admin. Foundational layer. Documented per-tenant.
Dark Web Monitoring
Continuous monitoring of credential leaks tied to your domain. Stolen credentials are detected and rotated before attackers can reuse them.
Incident Response
Documented runbook for every plausible incident type. Quarterly tabletop exercises. Written incident reports for your insurer and any regulatory notification.
How we align to NIST CSF 2.0
The National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) version 2.0, released in 2024, defines six functions that every cybersecurity program must address. Hexafusion's managed cybersecurity service maps to every one.
| NIST CSF 2.0 Function | What it covers | How Hexafusion delivers |
|---|---|---|
| Govern (new in 2.0) | Policy, risk tolerance, roles, accountability | Documented IT and security policies. Risk register reviewed quarterly. Named owners for every control. vCIO engagement on Professional and Enterprise plans. |
| Identify | Asset inventory, risk assessment, supply chain | Full asset inventory during onboarding, refreshed continuously. Risk assessment scored against CIS Critical Security Controls. Vendor inventory and supply-chain risk review. |
| Protect | Identity, access control, awareness, data security, platform hardening | MFA, conditional access, encryption at rest and in transit, awareness training, hardened device baselines. |
| Detect | Continuous monitoring, anomaly detection | EDR / MDR, behavioural detection, identity-risk scoring, 24/7 security operations centre on Enterprise plans. |
| Respond | Incident response, communications, mitigation | Documented 5-step incident-response runbook on every client. Quarterly tabletop exercises. Written incident reports for your insurer. |
| Recover | Recovery planning, communications, improvements | Backup & DR with 3-2-1-1-0 architecture, tested restores, documented recovery time and recovery point objectives, lessons-learned reviews after every incident. |
Security maturity ladder
Most Vancouver SMBs are not starting from scratch and not at the top either. We meet you where you are and progress the program through four maturity stages. Most clients land at Stage 2 in 90 days and reach Stage 3 in 12 to 18 months.
Stage 1. Foundational
MFA on all admins and users. Endpoint protection (EDR) on every device. Basic email security. Documented backups with at least one test restore. PIPEDA breach notification procedure on file. Where most clients start within 30 days of engagement.
Stage 2. Defensible
Conditional access policies, network segmentation, vulnerability scanning, awareness training, documented incident response runbook, quarterly tabletop exercises, immutable backups. Satisfies the typical 2026 cyber-insurance questionnaire.
Stage 3. Mature
24/7 MDR coverage, annual penetration testing, hardware-key MFA for admins and executives, privileged access workstations, supply-chain risk reviews. Ready for SOC 2 Type II audits and the most rigorous client security questionnaires.
Stage 4. Optimised
Continuous control validation, threat-intelligence integration, deception technology, mature insider-threat program, business-continuity testing across multiple scenarios. Typical for regulated mid-market clients with significant residual risk to manage.
Deep-dive cybersecurity topics
Each of the four cluster pages below covers one cybersecurity sub-topic in 2,400 to 3,000 words: scope, methodology, platforms, an industry-tuned FAQ, cyber-insurance angle, and how the topic fits the rest of the stack on this page.
EDR & MDR Vancouver →
Endpoint detection and response, managed detection and response, 24/7 security operations centre. The control most cyber insurers now require.
Multi-Factor Authentication Vancouver →
Entra ID Conditional Access, Duo, Okta, hardware security keys, passkeys, phishing-resistant MFA. Implementation patterns and pitfalls.
Security Awareness Training Vancouver →
Phishing simulation programs, executive tabletops, PIPEDA-aligned modules, board-ready reporting. Industry-specific scenarios for BC verticals.
Vulnerability Scanning Vancouver →
External attack surface management, internal vulnerability scanning, cloud posture management, prioritised remediation playbook.
Compliance support for BC businesses
Regulators, auditors, and contractual obligations all need documented evidence that controls exist and function. Our managed cybersecurity service produces that evidence as a by-product, not a separate project.
- PIPEDA and BC's Personal Information Protection Act (PIPA). Documentation, breach-response procedures, training records, technical safeguards aligned to OPC and OIPC expectations.
- Cyber insurance readiness. Renewal-ready statement of controls every year. Audit-quality answers to all standard underwriter questionnaire fields.
- PCI DSS for retail and e-commerce clients handling payment card data. Network segmentation, vulnerability scanning, secure development practices.
- SOC 2 Type I and Type II. Prep work, evidence collection, control mapping, auditor coordination. We work alongside your external auditor, not in place of them.
- FINTRAC for financial-services firms. Access logging, transaction-system monitoring, identity verification, record retention.
- BC healthcare (FIPPA, PIPA for clinics). Confidentiality controls, role-based access, audit logging for electronic medical record systems.
- Legal-services confidentiality. Information barriers (ethical walls), encrypted matter folders, conflict-of-interest checks tied to access control.
Industry-specific cybersecurity
Generic security templates miss the threats your industry actually faces. We tune the program by vertical.
Dental and medical clinics →
Electronic medical record protection, lab-integration security, insurance-claim phishing defence, BC PIPA for health data.
Law firms →
Trust-account wire-fraud prevention, real-estate closing security, opposing-counsel impersonation defence, ethical walls.
Accounting firms →
CRA-impersonation phishing, tax-season volume attacks, vendor banking-update fraud, client trust-account protection.
Financial services →
FINTRAC compliance, client-impersonation defence, regulatory-portal phishing, advanced monitoring.
Manufacturing →
Operational technology (OT) segmentation, vendor banking-update fraud, supply-chain attack defence, production-system continuity.
Construction →
Field-site security, contractor-impersonation defence, project-document protection, supplier wire-fraud prevention.
Cyber insurance in 2026: what changed
Canadian cyber insurance underwriters tightened materially in 2025 and tightened again in 2026. Three shifts every BC business owner should understand:
- MFA is no longer optional. The 2026 questionnaire asks specifically about MFA coverage of administrators, executives, finance, and rank-and-file staff. Anything less than near-100 percent coverage produces either declined coverage or surcharges. Our MFA page covers the deployment patterns.
- EDR or MDR is the new floor. Antivirus alone is not credit for endpoint protection anymore. Most carriers explicitly require EDR with behavioural detection, and tier-1 carriers require either MDR or documented 24/7 internal monitoring. Our EDR / MDR page covers what counts.
- Documented incident response is mandatory. Carriers want to see a written runbook, named roles, quarterly tabletop exercises, and post-incident reports. "We will figure it out when it happens" is not acceptable.
Every Hexafusion managed cybersecurity client receives a renewal-ready statement of controls each year covering all the standard questionnaire fields. We can also complete the underwriter questionnaire on your behalf for the technical-controls sections.
A typical 90-day cybersecurity rollout
What progressing from "no real security program" to "Stage 2 defensible" looks like over the first quarter of engagement:
Days 1-15
Discovery and inventory. Risk assessment against CIS Critical Security Controls. EDR agents deployed to all endpoints. MFA enrolled for all users.
Days 16-30
Conditional access policies enforced. Email security baseline (DMARC, DKIM, SPF, anti-phishing). Vulnerability scanning baseline established. First phishing simulation campaign.
Days 31-60
Network segmentation, firewall policy review, immutable backup verified with test restores, incident response runbook documented, security awareness training program live.
Days 61-90
First quarterly tabletop exercise. Cyber-insurance statement of controls delivered. Documentation handoff. First quarterly security review with leadership.
Frequently asked questions
Where do we start if we have nothing in place?
Stage 1 in the first 30 days. The four foundational controls in order: MFA on all users, EDR on every endpoint, documented backups with a tested restore, and a basic incident response procedure on file. That alone reduces the realistic risk of a successful ransomware or BEC attack by an order of magnitude. We move into Stage 2 over the next 60 days.
How does this satisfy PIPEDA and BC PIPA?
PIPEDA Principle 4.7 requires safeguards proportional to the sensitivity of personal information. BC PIPA section 34 imposes a similar reasonable-safeguards expectation. Our managed cybersecurity service produces documented evidence (policies, training records, incident response procedures, technical-control configurations) that maps to both. The same evidence is what the Office of the Privacy Commissioner of Canada has cited as missing in recent breach decisions.
We are a 10-person firm. Are we really a target?
Yes. Public breach data is unambiguous. 74 percent of ransomware victims have fewer than 1,000 employees. Attackers have automated their way down-market. A 10-person law firm or accounting practice in Vancouver is a viable target because the financial value of a successful attack is comparable to a much larger company and the defences are typically much weaker.
What about cyber insurance? Will you help us renew?
Yes. Every managed cybersecurity client receives a renewal-ready statement of controls each year. We can also complete the underwriter questionnaire technical-controls sections on your behalf. Several BC clients have moved into preferred tiers (lower premium, higher coverage) by submitting our statement.
Do you handle SOC 2 prep?
Yes. We do the controls work and the evidence collection. The audit itself is performed by an independent third-party auditor. We work alongside whichever audit firm you choose. SOC 2 Type I (point-in-time) prep typically takes three to six months. SOC 2 Type II (six to twelve months of operating-effectiveness evidence) builds on Type I.
What if we are breached?
Our documented five-step incident response runbook activates. Contain, investigate, eradicate, recover, lessons. For Enterprise plan clients we have 24/7 security-operations-centre coverage. For Professional, business-hours triage. Written incident report goes to your leadership, your cyber-insurance carrier, your legal counsel, and any regulator that requires notification under PIPEDA or BC PIPA.
Can we test before committing?
Yes. Two free starting points: the 2-minute online quiz for self-assessment, or a free external attack-surface scan that we run against your public-facing assets and deliver as a written report. Both are no commitment.
Who writes the content on these pages?
Alex Barari, founder of Hexafusion and a former PCI DSS Internal Security Assessor (ISA). Content reflects real patterns from our BC client work: dental, legal, accounting, financial services, manufacturing, construction, and non-profit clients across the Lower Mainland.
Cybersecurity service areas across Metro Vancouver
Get a tailored cybersecurity plan
Take the free 2-minute self-assessment for an immediate baseline, or request a full security review from a Hexafusion consultant. Both are no commitment.
Take the free quiz Request an assessmentRelated services
Managed IT VancouverIT ConsultingCloud ServicesMicrosoft 365Google WorkspaceNetwork SupportBackup & DRIT Supplier / Dell
Service areas across Metro Vancouver
For a Canadian-specific reference on these controls, see the Canadian Centre for Cyber Security baseline controls and the Office of the Privacy Commissioner of Canada's safeguards and breach guidance. These two documents now drive cyber insurance underwriting questions for Canadian SMBs.
24/7 incident response is available for Professional and Enterprise managed clients. Reach the Hexafusion security desk at (604) 332-1500 for active incidents, or book a discovery call to discuss managed cybersecurity for your Vancouver business.