All services Executive Advisory
Cyber risk, explained so your board can decide.
Leaders get reports full of acronyms and percentages. We turn them into what matters to the business: what could stop, what it would cost, and what to approve next.
62Risk scorelower is better
▼ 9 since Q2
Top risks
| Risk | Business impact | Level | Trend |
|---|---|---|---|
| Invoicing system down | 2 to 4 days without billing | High | |
| Payment fraud by email | $40k to $90k per incident | High | |
| Client data exposed | Law 25 notice, client trust | Medium |
Readiness
- MFA on all accounts82%
- Staff trained this year64%
- Critical vendors reviewed40%
- Backups restore-tested100%
Decision needed
Require MFA on all remote access before the insurance renewal.
≈ 2 weeks · low cost
How we build it
- GatherIT data, interviews, insurance and contracts.
- TranslateInto downtime, dollars and obligations.
- DecideA short pack that ends with what to approve.
From the IT report to the board table
What IT reportsWhat the board needs to hear
- DMARC policy at p=noneAnyone can send email that looks like it comes from us, including fake invoices to our clients.
- EDR coverage 78%One laptop in five has no protection that would catch ransomware.
- 14 critical CVEs open > 30 daysKnown holes attackers actively use are still open on systems we depend on.
- No tested restore in 12 monthsWe don’t know whether we could recover from ransomware, or how long it would take.
The questions boards ask
- “Are we secure?”There’s no yes or no. We show where you stand, the trend, and the three risks that matter most.
- “Could what happened to them happen to us?”We check the same entry points against your setup, and tell you plainly.
- “Are we spending enough?”We show what current spending covers and where the gaps are, so the budget follows the risk.
- “What’s our exposure under Law 25?”Your obligations, where you fall short, and who is accountable.
- “What do we do the day it happens?”A short, rehearsed plan: who decides, who calls the insurer, who talks to clients.
What we help leadership with
- Board briefingsClear updates on risk and progress, built for non-technical directors.
- Risk in business termsWhat could stop, for how long, and what it would cost.
- Investment prioritiesWhere the next dollar reduces the most risk.
- GovernanceWho owns security, how it’s reported, how decisions get made.
- Law 25, PIPEDA, GDPRWhat the law expects of you, in plain language.
- Executive crisis exerciseLeadership rehearses a realistic incident before it happens.
Examples on this page are illustrative.
Schedule an Advisory Session
Tell us what's going on. The expert who would lead the work replies within 1–2 business days, in English or French.