Canadian penetration testing directory

The directory is empty. It launched with no firms in it, and rather than pad it with scraped names we would rather explain what will go in it, how a firm gets listed, and what to check before you sign with anyone.

Last reviewed 2026-08-16Written by Jacob Masse, TrazTech Inc.

There are no firms listed here yet. This page will list Canadian penetration testing firms: the boutiques, the independents, the mid-market security consultancies and the testing practices inside the national accounting firms. Nothing has been added because nothing has been verified, and a directory that opens with a hundred scraped company names is a lead list wearing a directory's clothes.

If you came here to find a tester today, the fastest route is the quote form, which puts one written scope in front of firms that do the work you described. If you run a testing firm, the section on getting listed is at the foot of this page. If you are trying to work out whether the firm already quoting you is any good, the middle of this page is the part worth reading.

What this directory will list

Firms that perform manual penetration testing for Canadian clients. That is the whole inclusion rule, and it is narrower than it sounds. Managed security providers who resell someone else's scanner, marketplaces that subcontract to whoever is free that week, and consultancies whose testing offer is a compliance gap analysis with a scanner attached are all out of scope, because a buyer who finds them here would be worse off than one who found nothing.

Each listing will carry the province and city the firm operates from, the engagement types it performs, the certifications its testers hold, whether it issues a shareable attestation letter, and whether a retest is included as standard. Those are the fields buyers actually compare, and several of them are awkward to find on a firm's own website, which is the point of collecting them.

How listings work

Verified is not an endorsement and does not mean the work is good. It means the things a firm says about itself have been checked against documents rather than taken from a marketing page. No tier can be bought, and paying for placement is not a thing we offer, because the moment position is for sale the ordering stops carrying information.

What a listing will look like

The two rows below are illustrations, not firms. The names are invented and no company by either name has been assessed.

How to tell a testing firm from a scan-and-reformat shop

This is the most useful thing this page can do for you, and it does not depend on the directory having anyone in it. A large share of what is sold in Canada as a penetration test is a commercial vulnerability scanner run by someone who exports the output into a branded template. It is a legitimate product at a legitimate price. It is not a penetration test, and telling an auditor or an enterprise customer that it was one is a claim that unravels under a follow-up question.

Six questions separate the two, and you can ask all of them before you sign anything.

Ask for a redacted sample report. Every serious firm has one. Read the findings. If each item maps to a CVE identifier, a missing HTTP security header, or a TLS configuration note, a tool wrote it. A human test produces findings a tool cannot express: a low-privilege user reaching another tenant's records, a password reset flow that can be replayed, an approval step that can be skipped by changing a value in a request. If there is no sample report, there is usually no report worth sampling.

Ask how many tester days are in the quote and how they split. Testing is priced in days. A firm that will not tell you the day count is hiding either a very small number or the fact that it does not think in days because the work is a scan. Divide the fee by a plausible Canadian day rate and see what you get. The arithmetic is set out on penetration testing cost in Canada.

Ask which methodology they follow, by name. The OWASP testing guide, the PTES stages, NIST SP 800-115. A named methodology means there is a checklist that has to be walked and coverage that has to be shown. An answer along the lines of "our own proven approach" means the coverage is whatever the tester felt like doing that week.

Ask who will actually do the work and what they hold. A name, not a team page. OSCP, OSWE, GXPN, CREST registered or certified tester, GPEN. Certifications are a floor rather than a ceiling, but the absence of any of them, combined with an inability to say who is assigned, is a reliable signal. Ask specifically whether the named person is an employee or a subcontractor you have not been told about.

Ask whether findings are manually verified before they appear in the report. Scanners produce false positives at a rate that makes raw output unusable. A firm that reruns and confirms each finding will say so immediately and will be able to describe what it does with the ones that do not reproduce. A firm that does not understand the question is passing tool output to you unfiltered, and you will spend engineering weeks chasing findings that were never real.

Ask what happens after the report. Whether a retest is included and inside what window, whether an attestation letter is issued, and whether someone will sit with your engineers to walk through the findings. The readout call is where the report gets sharper, because that is where your team argues with a finding and either it survives or it does not.

What this directory will not carry

No star ratings, no review scores and no firm counts. Ratings on a directory with a handful of entries are noise dressed as data, and a review system worth having needs a volume of verified buyers that does not exist yet. When there is something real to publish, it will be specific: what a firm was engaged to do and what the buyer said about the report, attributed and dated.

Nor will there be a "top ten" ordering. The best firm for an authenticated SaaS test and the best firm for an industrial control system assessment are almost never the same firm, and any ranking that pretends otherwise is selling placement or guessing. The filters that will exist are the ones that narrow by engagement type, province and evidence, and that is deliberate.

Add your firm

If you perform penetration testing for Canadian clients and want to be listed, send the firm name, the city and province you operate from, the engagement types you perform, the certifications your testers hold, and whether you issue an attestation letter and include a retest. Send it to [email protected]. For a Verified entry, add a redacted sample report and evidence of professional liability insurance. Listing is free and there is no placement to buy.

Buyers looking for firms by city can start from penetration testing companies in Canada, which links to every city page on this site.

Common questions