Cyberless
Let’s talk

We hack your company.
Before attackers do.

Black-box penetration testing, incident recovery, custom AI and consulting for Canadian small and medium-sized businesses.

Explore our services

Orillia, Ontario · Serving businesses across Canada.

Our services

Penetration testing

  1. We try to break in.

    From the outside, along the Unified Kill Chain. Then a report, the fix if you want it, and a retest.

Incident recovery

  1. We get you running again.

    After a breach: we contain it, find the way in, close it and tell you who to notify.

Custom AI solutions

  1. We build AI for your work.

    Custom tools around your data. Your team stays in control.

Consulting

  1. We advise on security and AI.

    Plans, policies and insurance forms. Prompt, loop, harness and agent engineering.

Black-box penetration testing.

We try to get in the way an outsider would: no supplied logins, no inside knowledge. With your permission, before a real attacker does.

We follow the Unified Kill Chain, from getting in to reaching what matters, within an agreed scope and with OWASP guidance for web applications. Source ↗

Nineteenth-century engraving of Chubb’s detector lock, its case cut away to show the bolt, levers and the two keys.

  1. Break in.

    From the outside, within the agreed scope.

  2. Report.

    Every finding, ranked so the important fixes come first.

  3. Fix, if you choose.

    Your team or ours makes the repair.

  4. Retest.

    The same attacks, run again.

  5. Report again.

    A final report of what is now closed.

What could an attacker do?

Illustration, not a live test.

An instruction
gets through.

A message appears on your site. The system has accepted an instruction from outside.

Ready

Protect intellectual property.

Find paths that could expose valuable information.

Keep work moving.

Prioritise weaknesses that could interrupt operations.

Protect eligibility.

Where applicable, unmet security duties can put government contracts and Controlled Goods Program registration at risk. Source ↗

Incident recovery.

If an attacker gets in, we come in after them: stop the damage, find how it happened, get you running again and help you report it.

We follow NIST incident-response guidance and keep the evidence intact for your insurer, and for police if you report it. Source ↗

A whorl fingerprint from Henry Faulds’s 1905 guide to fingerprint identification, its ridges spiralling in to a single core.

  1. Contain it.

    Cut off the attacker’s access and stop the spread.

  2. Find the way in.

    How they got in and what they touched, from the logs, accounts and files.

  3. Close it.

    Patch the hole and remove anything left behind.

  4. Get running.

    Restore systems and data from clean copies.

  5. Report and advise.

    A written account, and who to notify: police, the Cyber Centre, the Privacy Commissioner, your insurer.

Hacked now? Disconnect affected machines from the network, but don’t wipe them. Then email info@cyberless.ca with “Incident” in the subject.

Your business is connected.
So is its exposure.

Your security extends into the software and suppliers you depend on.

55%

of analyzed small and medium business breaches involved a third party.

7,152 breaches · businesses with fewer than 1,000 employees.

Third-party involvementOther analyzed breaches

Verizon, 2026 Data Breach Investigations Report. Method & source ↗

AI is changing the threat.

What the teams building and defending these systems are seeing. Published research and guidance, not customer endorsements.

Anthropic
“Non-experts can also leverage Mythos Preview to find and exploit sophisticated vulnerabilities.”
Frontier Red TeamModel evaluation
Read publication
Cloudflare
“AI is automating high-velocity attacker operations.”
2026 Cloudflare Threat ReportThreat intelligence
Read publication
Canadian Centre for Cyber Security / Centre canadien pour la cybersécurité
“We urge every organization in Canada to strengthen its cyber defences today.”
Rajiv Gupta · Head of the Cyber CentreOfficial guidance
Read publication
Microsoft
“Now, threat actors from nation states to cybercrime groups are embedding AI into how they plan, refine, and sustain cyberattacks.”
Sherrod DeGrippo · Microsoft SecurityObserved activity
Read publication
Google Cloud
“Threat actors are also increasingly targeting AI assets.”
Google Threat Intelligence GroupObserved activity
Read publication
OpenAI blossomOpenAI
“OpenAI disrupted a Cambodia-based scam operation using ChatGPT to support investment, romance, gambling, and impersonation schemes.”
Disrupting malicious uses of AIObserved fraud
Read publication
CrowdStrike
“AI-enabled adversaries increased operations by 89% year-over-year, weaponizing AI across reconnaissance, credential theft, and evasion.”
2026 Global Threat ReportObserved 2025 activity
Read publication
National Cyber Security Centre, United Kingdom
“Keeping pace with frontier AI cyber developments will almost certainly be critical to cyber resilience for the decade to come.”
National Cyber Security Centre · UKForecast to 2027
Read publication
01–02 / 08

Custom AI solutions for everyday work.

Automate routine tasks. Find answers in your information. Turn business data into useful decisions.

Nineteenth-century engraving of punched cards for a Jacquard loom: rows of holes that told the machine which threads to lift.

A routine task

Start with the work that repeats.

AI-assisted workflow

Connect tools and information.

Human review

Your team keeps decision-making control.

Built around your existing tools. Start with one problem, measure the result, then expand.

Discuss an AI project

AI is moving
into everyday work.

Nearly one in five Canadian businesses with employees reported using AI to produce goods or deliver services in the preceding year.

Use is growing. A useful application still starts with a real business need.

Canadian businesses using AI · %

Statistics Canada · Q2 surveys, 2024–2026. Each measures use during the preceding 12 months. Source ↗

Consulting for security and AI.

A second opinion, a plan, or hands-on help beside your team. By the hour or on retainer.

Security consulting.

  • Plans and policies. Incident, backup and access plans sized for a small team.
  • Insurance forms. We check that each answer on your cyber-insurance application is true.
  • Supplier reviews. What a new vendor or app could reach, before you sign.
  • Baseline controls. The Cyber Centre’s thirteen baseline controls for small organizations, put into practice.

Following the Canadian Centre for Cyber Security’s guidance. Source ↗

AI consulting.

  • Prompt engineering. Clear instructions, examples, and only the context a model needs.
  • Loop engineering. Agents that gather context, act, check their work and repeat.
  • Harness engineering. The tools, tests and progress notes that keep long-running agents on track.
  • Agent engineering. The simplest design that works, tools with one clear purpose, and evaluations before launch.

Grounded in Anthropic’s engineering guidance. Sources ↗

A test and a report, every year.

Your software, suppliers and access change. Each year we test again and give you a written report, so you can see what has changed and what has improved.

  1. Test and report.

    Agree the scope, test from outside, report what we found.

  2. Fix what matters.

    Your team or ours makes the repair. We check it.

  3. Repeat every year.

    And again after important changes.

Supporting Canadian
digital sovereignty.

Based in Orillia, Ontario, we help Canadian businesses strengthen control over their data, ideas and systems—through security testing, incident recovery, consulting and AI solutions.

Map of Lake Simcoe and Lake Couchiching with today’s municipal boundaries, drawn in the manner of an engraved survey. A red mark shows Orillia at the Narrows, where the two lakes meet.
Map data © OpenStreetMap contributors

Less uncertainty.
More peace of mind.

Start a conversation

info@cyberless.ca

Sources & notes

Industry data gives context. It does not measure your organisation’s risk or predict the results of an engagement.

  1. Verizon, 2026 Data Breach Investigations Report. Third-party involvement: 55% of 7,152 analyzed breaches in businesses with fewer than 1,000 employees. Vulnerability exploitation: 31% in the known-initial-access analysis of non-Error, non-Misuse breaches (n = 19,905), across organization sizes. Different populations; these measures are not additive. Executive summary ↗Reporting window: 1 Nov 2024–31 Oct 2025. Not a random sample of all businesses.
  2. Statistics Canada, Canadian Survey on Business Conditions, Q2 2026, Table 2. Businesses with employees using AI to produce goods or deliver services in the preceding 12 months: Q2 2024, 6.1%; Q2 2025, 12.2%; Q2 2026, 19.2%. Analysis and table ↗Published 11 June 2026. Survey periods differ from calendar-year totals.
  3. Controlled goods and contract obligations. Controlled Goods Program registration and government contract security clearances are different requirements. Failure to meet applicable security or reporting duties can affect registration, clearances or dependent contracts; consequences are not automatic after an attack. PSPC: Controlled Goods breach reporting ↗ · Contract Security Manual, §3.6 ↗
  4. AI threat research and guidance. Anthropic (2026-04-07) · Cloudflare (2026-03-03) · Canada’s Cyber Centre (2026-06-24) · Microsoft (2026-04-02) · Google Cloud (2026-09-08) · OpenAI (2026-07-31) · CrowdStrike (2026-02-24) · UK National Cyber Security Centre (2025-05-07) Vendor observations and model evaluations describe the publishers’ own work. The NCSC item is a 2025 assessment to 2027. CrowdStrike’s 89% compares tracked AI-enabled operations in 2025 with 2024. Microsoft describes largely human-directed workflows; OpenAI’s example concerns fraud.
  5. Testing method. The Unified Kill Chain, Paul Pols, 2021: attacks in three stages, getting in, hacking through and taking it out. Unified Kill Chain ↗ · OWASP Web Security Testing Guide. A structured guide to testing web applications. We select relevant tests within the agreed scope; a black-box assessment does not certify compliance with every standard or establish that all vulnerabilities have been found. Testing guide ↗
  6. Incident response and breach reporting. NIST SP 800-61 Rev. 3, incident response recommendations, April 2025. NIST ↗ · Under PIPEDA, a business must report a breach that poses a real risk of significant harm, and keep a record of every breach for two years. Privacy Commissioner ↗ · Cybercrime and fraud go to local police and the RCMP’s national reporting system; cyber incidents to the Canadian Centre for Cyber Security, ideally within 24 hours. Report cybercrime and fraud ↗ · Cyber Centre ↗
  7. Baseline cyber security controls. Canadian Centre for Cyber Security, version 1.2: thirteen areas, from incident response planning to backups, for organizations with fewer than 500 employees. Cyber Centre ↗
  8. AI engineering guidance. Anthropic: Prompting best practices · Effective context engineering for AI agents (2025-09-29) · Building agents with the Claude Agent SDK (2025-09-29) · Effective harnesses for long-running agents (2025-11-26) · Building effective agents (2024-12-19) · Writing effective tools for agents (2025-09-11) · Demystifying evals for AI agents (2026-01-09)Summaries on this page are ours; the guidance is Anthropic’s.
  9. Archival plates. Chubb’s detector lock, wood engraving, about 1850, public domain. Source ↗ · Jacquard cards for weaving figured silk, engraving by G. Gladwin after C. Varley, Wellcome Collection, CC BY 4.0. Source ↗ · The Lake Simcoe map is drawn for this site from OpenStreetMap data, © OpenStreetMap contributors, available under the Open Database License, in the manner of William Chewett’s 1821 survey. Licence ↗ · A whorl fingerprint from Henry Faulds’s Guide to Finger-Print Identification, 1905, public domain. Source ↗Shown as negatives, cropped, with colour fields and marks added for this site.
  10. Opening figure. Hooded figure, photograph by MEHRAX on Unsplash, Unsplash License. Source ↗Cropped, with the hands and background removed, softened and grained for this site. An anonymous model, not a real attacker.
  11. Demonstration and assessment scope. The terminal instructions are fictional display text. The animation illustrates possible consequences and a scoped fix; it executes no commands or attacks. A retest checks the demonstrated path. Annual testing is a review cadence; it is not continuous protection or a guarantee that all systems are secure.

Sources reviewed 27–28 October 2026. Network and AI workflow figures are original explanatory illustrations, not recordings or client data. No client assessment material is published here.