threat_01
Ransomware
Ransomware can interrupt operations, encrypt systems, or accompany the exfiltration of sensitive data.
← IT SECURITY
Daillac / IT SECURITY
IT security, cybersecurity, and Law 25 support services
SECURITY,NO COMPROMISE.
Reduce risks affecting your applications, access, data, and operations. Security audits, authorized pentesting, IAM/MFA, Law 25 support, backups, and incident preparedness.
Security AuditAudit · Pentest · Law 25 · Incident response
Direct answer
Reduce IT risk before an incident and respond more effectively when one occurs
Based in Saint-Jerome and serving Greater Montreal, Daillac assesses the assets, access, data, and attack scenarios that matter to the business. The engagement turns findings into prioritized remediation, clear ownership, and evidence that technical teams and decision-makers can use.
- You are launching or expanding a web application, API, or customer portal.
- Accounts, SaaS tools, and remote access are multiplying without a complete view.
- A customer, insurer, or partner is requesting evidence of security controls.
- You hold personal information and need to structure privacy governance.
- A vulnerability, fraudulent message, or incident requires an organized response.
- Your backups, recovery procedures, or incident roles have not been tested.
security · diagnostic
security-audit
CRITICAL12s
Brute-force attempt blocked
CVE-2025-31 · edge-01
WARNING47s
Abnormal request spike
AUTH-RATE · api-gw
INFO1m
Certificate renewed
TLS-RENEW · cert-mgr
CRITICAL3m
Spoofed domain detected
PHISH-001 · mail
● controls activeweb · api · access · backups
Law 25 · Quebec
OWASP · Web/API
IAM · MFA
Tested backups
// threat-model
The risks are real
threat_02
Non-Compliance
Governance, consent, privacy impact assessments, retention, and incident practices may need to be documented and applied.
threat_03
Data Breach
Inappropriate access or an application flaw can expose confidential or personal information.
threat_04
Phishing
A fraudulent email, message, call, or website can bypass technical controls by targeting a person directly.
threat_05
Downtime
How much does a day without access to your systems cost?
threat_06
Technical Debt
Outdated components and deferred patches increase the attack surface and make remediation harder.
// arsenal
OUR ARSENAL
Concrete controls to reduce risk before it becomes an incident.
mod_01
Within an authorized and agreed scope, we examine selected web applications, APIs, infrastructure, configurations, or code to identify and prioritize vulnerabilities.
- Documented scope, method, and rules of engagement
- Reproducible findings with risk level and impact context
- Prioritized remediation plan and retesting when included
mod_02
We support the technical and organizational parts of your program based on the information you hold, the processing involved, and the markets you serve. This support does not replace legal advice.
- Mapping of data, access, vendors, and information flows
- Support for policies, registers, and consent processes
- Technical preparation for privacy impact assessments and follow-up
mod_03
We prepare the roles, procedures and first actions needed to limit the impact of a breach, ransomware attack or compromise.
- Response plan and escalation chain
- Scenario-based simulation exercises
- Containment, evidence and recovery
mod_04
We help teams recognize fraud attempts, protect their access, and apply the first actions defined for a potential incident.
- Simulated phishing campaigns
- Awareness workshops
- IAM/MFA access management
// scope-and-evidence
Usable deliverables, not just a list of vulnerabilities
Every engagement begins with an agreed scope, asset list, and objectives. Findings are connected to the business context so remediation, governance, and continuity decisions can be assigned and tracked.
Prioritized assessment
Findings, affected assets, risk levels, impact scenarios, and assumptions are clearly distinguished.
Remediation plan
Corrective actions ranked by urgency, effort, dependencies, and proposed owner to support execution.
Evidence and documentation
Tested scope, useful evidence, configurations, procedures, and decisions documented according to the engagement.
Readout and follow-up
Stakeholder presentation, team handoff, and validation of corrections when retesting is included.
// methodology
Defensive Approach
phase_0303
Detect
Monitoring, alerts, and weak signals on critical systems.
// faq
Frequently asked questions about IT security
01Does Law 25 apply to my business?+
A business operating in Quebec and holding personal information is subject to protection and governance obligations. The measures that apply depend on your activities and processing; legal counsel should confirm the applicable interpretation.
02What does an IT security audit cover?+
The scope may include a web application, API, infrastructure, configurations, access, backups, vendors, and selected governance practices. It is agreed before the work begins, and the report separates findings, risks, and remediation priorities.
03What is the difference between an audit and a pentest?+
An audit can examine a broad set of controls, configurations, processes, and evidence. A pentest actively attempts to exploit vulnerabilities within an authorized scope to validate exploitability and impact. The two can be combined.
04Can you secure an existing application?+
Yes. Depending on the engagement, Daillac can review code and configurations, test exposed functions, strengthen authentication and authorization, remediate priority vulnerabilities, and validate corrections.
05What deliverables do we receive after the engagement?+
Deliverables can include a prioritized report, supporting evidence, a remediation plan, a team readout, and retesting. The exact content is defined according to the scope, risk level, and intended readers.
06How much do security services cost and how long do they take?+
Budget and timing depend on the number and complexity of assets, available access, testing depth, and required deliverables. A short scoping phase makes it possible to propose a realistic perimeter and delivery sequence.
07Do you provide 24/7 monitoring or incident response?+
Preparation, exercises, and incident support can be included in an engagement. Continuous coverage or 24/7 availability is included only when explicitly agreed with the corresponding roles, channels, and response targets.
08Does Daillac serve businesses in Montreal?+
Yes. Daillac is a web, AI, and IT agency based in Saint-Jerome, serving businesses across Greater Montreal, including Montreal, Laval, the North Shore, and the Laurentians.
// related
Complementary Services
Integrate security into your digital ecosystem
// engagement