New PIPEDA Vendor Guidance: What Holds Up in Due Diligence
Canada's new PIPEDA third-party guidance sets the questions your buyers will ask. Here is the security evidence that holds up in vendor due diligence.
7 min
• Blog Archive
All Articles
74 total articles
Filter by year:
How a CREST Pentest Report Closes the Enterprise Security Review
Why a pentest report from a CREST-accredited firm, sent before procurement asks, shortens enterprise security reviews and the sales cycle behind them.
7 min
• 
What to Budget For Next Year: Penetration Testing, Tabletop Exercises, and Compliance
How PCI DSS, SOC 2 and ISO 27001 set pentest cadence and scope, where a gamified tabletop exercise fits as a line item, and a self-check for next year.
6 min
• 
What Actually Drives Penetration Testing Pricing (And Why There's No Industry-Wide Framework)
Why penetration testing has no standard price list, and how to compare quotes by scope type, environment size, testing depth and post-test deliverables.
11 min
• 
How Often Should You Pentest? Time Testing to Releases, Not the Calendar
Time pentests to releases and compliance windows instead of a fixed calendar, and set retest timing from finding severity and your remediation SLAs.
6 min
• 
The Vulnerabilities I Keep Finding in AI-Generated Code
Patterns seen in AI-generated code in production penetration tests: business logic gaps, authorization, input validation and error handling.
7 min
• 
How to Tell Your Board What Your Pentest Actually Found
How to turn a pentest report into a board briefing: put severity in business language, report remediation status honestly and use a ten-minute structure.
4 min
• 
The Compliance Trap: Why Compliance Doesn't Guarantee Safety
Audits such as SOC 2, ISO 27001 and PCI DSS measure process. What the PowerSchool breach shows and where penetration testing fits alongside compliance.
4 min
• 
Finding Closed Is Not Finding Fixed: Who Actually Owns Remediation After a Pentest
Who has the authority to call a pentest finding fixed, what remediation documentation should show and why a retest is the real confirmation.
5 min
• 
How to Get Budget Approved for a Gamified Tabletop Exercise
Build the business case for a gamified tabletop exercise: benchmark the cost, answer skeptical executives and win budget approval.
8 min
• 
What is a Gamified Tabletop Exercise?
What a gamified tabletop exercise is, why teams run one, and how it shows where your documented incident response plan breaks down under pressure.
8 min
• 
How to prepare for a penetration test
How to prepare for a penetration test: timeframe, scope, test environment, credentials, an emergency contact and what to expect in the final report.
6 min
• 
What to expect during a pentest?
What happens during a penetration test, from scoping and preparation to active testing and the final report, so you know what to expect at each stage.
6 min
• 
What Is Penetration Testing? A Plain-Language Guide for First-Timers
Penetration testing explained in plain language: what it is, how it works, and what to expect from scope to final report.
5 min
• 
What Building Security in Canada Teaches You About Enterprise Expectations: A Practitioner's View
How Canadian regulatory pressure shapes enterprise security expectations, and what a provider serving Canada, the U.S. and EU learns about buyer scrutiny.
5 min
• 
A Tale of Two Penetration Tests
Two organizations came to us for a penetration test with very different questions. What each approach shows about how companies buy security.
8 min
• 
Security Predictions for 2026: What Every CISO Needs to Know
Five security predictions for 2026, from AI-generated code risk to business logic testing and compliance, and how CISOs can adapt their testing plans.
10 min
• 
Why Third-Party Pen Testing Is Non-Negotiable for SaaS Firms in 2025
Why independent, CREST-accredited pen testing matters for SaaS firms selling to enterprise buyers, with compliance proof and board-level documentation.
6 min
• 
Exploring the Psychology Behind Cybersecurity Awareness Through Penetration Testing
How penetration testing shapes security awareness: the wake-up call for employees, their reactions to simulated attacks and the culture that follows.
2 min
• 
How to Choose a Reputable Penetration Testing Firm
How to choose a reputable penetration testing firm: define your needs, check certifications and references, set scope and review the reporting process.
4 min
• 
What benefit does CREST Penetration Testing Accreditation Bring?
What CREST accreditation means for clients of a penetration testing firm, including quality assurance, industry recognition and stronger client confidence.
2 min
• Announcing our new CREST Penetration Testing Accreditation
EliteSec has completed its CREST penetration testing audit and is now accredited, a third-party check that our testing follows best practice.
2 min
• 
Announcing our ISO 27001:2022 Certification
EliteSec is now ISO 27001:2022 certified. Why we pursued it, and how it answers the 'How can we trust you?' question prospects ask.
1 min
• 
We Are Canadian
A reminder that EliteSec is a Canadian-owned and operated cybersecurity firm based in Waterloo, Ontario, about 90 minutes west of Toronto.
1 min
• 
Penetration Testing for Small Businesses - Why Size Doesn't Matter
Why small businesses are targets too, seven common traps that lead them to skip penetration testing, and the red flags that say it is time to plan one.
11 min
• The Value of Manual Penetration Testing - Beyond Automated Scans
Why manual penetration testing finds what automated scanners miss: strategic thinking, dynamic adaptation, social engineering coverage and customization.
10 min
• 
6 Signs Your Organization Needs Professional Penetration Testing
Six signs your organization needs a penetration test, from infrastructure changes and compliance to client requirements and an outdated assessment.
8 min
• 
The Hidden Costs of Neglecting Penetration Testing: 5 Real-World Examples
The business costs of skipping penetration testing, including reputational damage, regulatory exposure and false confidence, with breach examples.
14 min
• Making the Right Choice: Penetration Testing vs Vulnerability Assessment
How a penetration test differs from a vulnerability assessment on depth, real-world scenarios and human involvement, and which one fits your business.
9 min
• Why You Need Regular Cybersecurity Penetration Testing
Seven benefits of regular penetration testing, from finding new vulnerabilities to meeting regulations, and why we recommend testing at least once a year.
9 min
• 
What Is Cloud Penetration Testing?
What cloud penetration testing is, the types of tests, why it matters and how it works step by step, using the 2019 Capital One breach as an example.
14 min
• What is a Tabletop Exercise? Our Cybersecurity Secrets
What a cybersecurity tabletop exercise is, its seven goals, when to run one, and how it compares with walkthroughs and other alternatives.
9 min
• 
7 Penetration Testing Best Practices for Small Businesses
Seven penetration testing best practices for small businesses, from starting with a risk assessment to scoping the test, choosing a provider and retesting.
13 min
• 
Our Top 10 Advanced Web Application Penetration Testing Techniques
Ten advanced web application penetration testing techniques, from SQL injection to SSRF, and how threat modeling helps pick the right one.
11 min
• How Long Does a Pen Test Take? Insights From a Professional Pen Tester
Most pen tests take 2 to 4 weeks, though scope can stretch that from 1 to 15 weeks. What drives the timeline and what can prolong a test.
11 min
• 
Building a Penetration Testing Dropbox
A walkthrough of building a Raspberry Pi penetration testing dropbox for remote internal network testing and Wi-Fi audits, from hardware to deployment.
9 min
• What Is Web Application Penetration Testing? 2024 Comprehensive Guide
What web application penetration testing is, why it matters, how black, grey and white box approaches differ and how a test runs step by step.
17 min
• Penetration Testing in Cyber Security: How It Works
How penetration testing works in cyber security: the five phases, why compliance teams ask for it and how to choose black, grey or white box access.
12 min
• 12 Penetration Testing Tools You Must Know About Before You Get Started
Which penetration testing tools testers rely on, from Metasploit to Mimikatz, grouped by exploitation, password attacks and information gathering.
12 min
• Penetration Testing vs. Red Teaming: Decoding Their Unique Roles
How penetration testing and red teaming differ, the pros and cons of each, and when a red team exercise adds more than a standard pen test.
11 min
• 
Limitations of Penetration Testing: The Blind Spot Dilemma
Penetration testing is effective but has blind spots. Where it falls short, from scope limits to gaps between tests, and how to counter them.
12 min
• What's The Difference Between Penetration Testing And Vulnerability Scanning?
To the untrained eye, they have similar-sounding names, but penetration testing and vulnerability scanning are very different services.
12 min
• 
Will AI Replace Your Cybersecurity Company? Your Cyber Security AI Guide
Whether AI can replace a cybersecurity company, which tasks it can take over, and six AI threats security teams need to manage in the coming years.
15 min
• 3 Types Of Cyber Security Hackers: What They Mean For Your Business
White hat, black hat and grey hat hackers explained, with the WannaCry attack as an example and what each type means for your business.
16 min
• Do AI and ChatGPT Pose New Threats to Your Cyber Security?
How ChatGPT and AI change the cyber threat picture, from automated attacks and social engineering to polymorphic malware, and what organizations can do.
8 min
• How Cybersecurity Services For Startups Can Boost Your Sales
How verifiable, measurable cybersecurity practices help startups overcome trust objections from larger buyers, with seven steps to a security strategy.
9 min
• Does My Organization Need A Penetration Test?
Criteria for deciding whether your organization needs a penetration test, from compliance and major IT changes to incidents, plus when you can wait.
9 min
• 
Do I Need A Cybersecurity Consultant? A Guide For Toronto Startups
What a cybersecurity consultant does, the risks one helps shield your business from, and how to decide whether your Toronto startup needs one.
9 min
• 
Are Password Managers Dangerous?
Are password managers dangerous? What the LastPass breach means, why people still use them, and how cloud and local password managers compare.
5 min
• 
How To Prevent Ex-Employees From Compromising IT Security: 12 Strategies For IT Security - Toronto
Twelve ways to keep former employees from compromising IT security, from disabling accounts and changing admin passwords to reviewing suspicious activity.
11 min
• Fractional CISO vs. Interim CISO vs. Temporary CISO: Weigh The Pros And Cons
How fractional, interim and temporary CISOs differ, how each fits into your organization, and how a virtual CISO supports risk, strategy and compliance.
13 min
• 
Why A Virtual CISO Makes Sense For Small To Mid-Sized Businesses
What a virtual CISO does for small and mid-sized businesses in Canada, from risk reduction and security strategy to compliance audits and budget planning.
7 min
• Find The Best Penetration Testing Service In Waterloo
What to look for in a penetration testing service in Waterloo, from the types of testing to when your business needs one, and how EliteSec works.
13 min
• How To Find A Penetration Testing Service in Toronto
How to choose a penetration testing service in Toronto: the five phases a competent firm follows, the types of testing on offer and what to expect.
14 min
• 
Announcing Second Opinion for Penetration Tests
EliteSec now offers second opinions on penetration tests and vulnerability assessments whose findings look questionable or leave questions unanswered.
2 min
• 
Security Table Stakes - Some Important Bare Necessities
The security basics any organization can adopt without a big program: enforcing 2FA, using a password manager, patching and installing anti-virus software.
8 min
• Supply Chain Threats - The Solar Winds Hack
What the SolarWinds supply chain attack means for your own security program: how to rethink supply chain risk, ask the right questions and respond calmly.
7 min
• 
Cyber Security Awareness Month - IoT Week
IoT Week of Cyber Security Awareness Month: changing default credentials, using a guest network, updating firmware and limiting device connections.
5 min
• 
Cyber Security Awareness Month - Network Week
Network Week of Cyber Security Awareness Month: securing Wi-Fi, setting up a guest network and using a VPN on public Wi-Fi as more people work from home.
5 min
• 
Cyber Security Awareness Month - Computer Week
Computer Week of Cyber Security Awareness Month: passphrases, anti-virus software and spotting phishing emails, skills that carry over to work.
7 min
• Cyber Security Awareness Month - Phone Week
Phone Week of Cyber Security Awareness Month: OS updates, smishing scams and multi-factor authentication, and why personal habits carry over to work.
4 min
• 
The Cyber Security Skills Gap
There is a shortage of qualified cyber security professionals, so what can you do to ensure your own organization doesn't fall between the cracks.
4 min
• The Threat Is Inside The Organization!
We often focus on the external threat, but ignore the insider threat. Not all insider threats are malicious, some are well intentioned.
4 min
• It Starts At The Top - Executives & Security
Why security needs executive backing to succeed. Written for business leaders, with practical steps on what to do and where to start.
5 min
• 
Security Is Like An Onion
No single product covers everything. The layers of security every organization should have, from patching and firewalls to MFA and a password manager.
7 min
• Dealing With Security Researchers
What to do when an external security researcher contacts your organization: how to respond, validate the finding and decide on next steps.
8 min
• Let's Talk About The CRA Hack
The Canada Revenue Agency breach that affected just over 11,000 accounts, what the attackers did and how to protect your own organization.
3 min
• 
News Alert - EliteSec Founder Quoted in vpnranks.com Article
The Founder and Principal Consultant of EliteSec shares his thoughts on cyber security awareness training for employees over on vpnranks.com
1 min
• 
News Alert - EliteSec Founder Quoted in BestCompany
EliteSec's Founder and Principal Consultant, John Svazic, shares his thoughts on password management for everyday users over on BestCompany.com
1 min
• 
All Your Employees Are Working From Home - Now What?
A work-from-home security checklist for organizations: endpoint protection, VPN use, home Wi-Fi, company equipment policy and regular check-ins.
8 min
• So you need a security program - Part 1
Part 1 of a series on building a security program: what one is, what sits at its core and how to start, for organizations of any size.
4 min
• You Don't Need a Penetration Test (Yet)
Why you may not need a penetration test yet, even though buyers often require one, and what a test does and does not cover.
3 min
• I'm Not A Target!
When organizations think about security, they often have the same reaction: I'm Not A Target! Unfortunately the statistics do not support this thought.
4 min
• 
Welcome to EliteSec
Meet EliteSec, a boutique cybersecurity consultancy offering security programs and penetration testing with pragmatic advice and candid discussions.
4 min
•