Top 7 Best Penetration Testing Companies in Canada
Quick answer: This guide covers seven penetration testing providers whose own websites we could check, listed alphabetically and not ranked. Only some state a Canadian office, so we show what each site says and leave out what we could not confirm. Pick by your rules (PIPEDA, OSFI Guideline B-13, customer contracts), tester credentials and proposal quality.
Penetration Testing Companies in Canada: Seven Providers to Consider
Most “top 10” lists rank companies on marketing, not on evidence. This one is different: we read each provider’s own website on 23 October 2026 and recorded only what it states about its services, locations and credentials.
How we chose. We started with the firms named on our earlier version of this page, added Canadian specialists, and kept the ones whose sites confirmed penetration testing services. We removed SecureWorks, Herjavec Group, Tenable, KPMG, Deloitte, PwC and IBM from the list because we could not confirm a penetration testing service from the pages we could open. That does not mean they do not offer one. Check them directly if they are on your shortlist.
Disclosure. CyberSapiens is on this list and has a commercial interest in it. We have given every provider, including us, the same format, and “stated” means the firm says so on its own site. Credentials are the firm’s own claims, so verify them with the issuing body before you sign.
Providers at a Glance
What each provider’s own site states, in alphabetical order. Scroll sideways on a phone.
| Provider | Type | Canadian presence (as stated) | Credentials (as stated) |
|---|---|---|---|
| CyberSapiens | Consultancy with testing and compliance support | Hamilton, Ontario office (236 Pritchard Rd, Hamilton, ON L8W 3P7) | No third-party accreditation is claimed in this guide |
| eSentire | Managed security provider | Canada office not stated on the page we read | None stated on the page |
| Kroll | Global risk and security advisory | Headquartered in New York per its site. Toronto appears as the location of two listed experts, not as an office | States CREST accreditation as a global penetration testing provider |
| NCC Group | Global security consultancy | No Canadian office stated on the page we read. Shows a US and Canada contact line | Displays accreditation marks, including CREST. Confirm on the issuer’s site |
| Packetlabs | Specialist penetration testing firm | Toronto headquarters, with offices in San Francisco and Sydney per its site | States it is CREST-accredited and SOC 2 Type II attested, and cites OSCP-minimum staffing |
| Trustwave | Global security services provider | No Canadian presence stated on the page we read | None stated on the page |
| Vumetric | Specialist penetration testing firm | Toronto office (25 York Street) and Las Vegas per its site, and describes itself as a Canadian provider | States ISO 9001 certified processes and shows staff certification logos such as OSCP and OSEP |
This is a snapshot of public websites, not an assessment of quality. Offices, services and accreditations change, so confirm each point with the provider.
The Seven Providers
Alphabetical, not a ranking. Each entry sets out what the provider states, then a point to check before you buy.
1. CyberSapiens
Offers vulnerability assessment and penetration testing alongside ISO 27001 and other compliance services. Useful if you want testing and readiness work from one team.
Type: Consultancy with testing and compliance support.
Canadian presence (as stated): Hamilton, Ontario office (236 Pritchard Rd, Hamilton, ON L8W 3P7).
Credentials (as stated): No third-party accreditation is claimed in this guide.
Check before you buy: We also advise on certification, so keep your certification body separate. We do not issue certificates.
2. eSentire
The page lists “Autonomous Pen Testing & Continuous Threat Exposure Management”, which it describes as AI operatives that continuously validate attack paths.
Type: Managed security provider.
Canadian presence (as stated): Canada office not stated on the page we read.
Credentials (as stated): None stated on the page.
Check before you buy: Autonomous testing is not the same as a human-led engagement. Ask whether human testers and a written report are included.
3. Kroll
Lists web, cloud, API, mobile, network, IoT and hardware testing, plus red and blue team exercises and social engineering.
Type: Global risk and security advisory.
Canadian presence (as stated): Headquartered in New York per its site. Toronto appears as the location of two listed experts, not as an office.
Credentials (as stated): States CREST accreditation as a global penetration testing provider.
Check before you buy: Confirm where the testers delivering your work are located and who staffs the engagement.
4. NCC Group
Lists penetration testing and continuous penetration testing services.
Type: Global security consultancy.
Canadian presence (as stated): No Canadian office stated on the page we read. Shows a US and Canada contact line.
Credentials (as stated): Displays accreditation marks, including CREST. Confirm on the issuer’s site.
Check before you buy: Check which team and office would deliver your engagement, and what is in the Canadian scope.
5. Packetlabs
Lists application penetration testing, penetration testing, adversary simulation and security assessments.
Type: Specialist penetration testing firm.
Canadian presence (as stated): Toronto headquarters, with offices in San Francisco and Sydney per its site.
Credentials (as stated): States it is CREST-accredited and SOC 2 Type II attested, and cites OSCP-minimum staffing.
Check before you buy: Verify the CREST listing and SOC 2 report scope yourself, and ask for the tester profiles for your engagement.
6. Trustwave
Lists testing of IT, OT and IoT, physical and people targets, on-demand testing as a service, and retesting included at no extra charge for findings validation.
Type: Global security services provider.
Canadian presence (as stated): No Canadian presence stated on the page we read.
Credentials (as stated): None stated on the page.
Check before you buy: Ask where work is delivered from and how data is handled for Canadian clients.
7. Vumetric
Lists network, application, hardware, red team and social engineering testing, compliance-focused testing and a testing-as-a-service platform.
Type: Specialist penetration testing firm.
Canadian presence (as stated): Toronto office (25 York Street) and Las Vegas per its site, and describes itself as a Canadian provider.
Credentials (as stated): States ISO 9001 certified processes and shows staff certification logos such as OSCP and OSEP.
Check before you buy: Treat the “80+ certifications” figure as a marketing claim. Ask who will test your systems.
Canadian Rules That Drive Penetration Testing
There is no single Canadian law that says every business must run a penetration test. What applies to you depends on your sector, your data and your contracts.
PIPEDA
If your organization collects, uses or discloses personal information in the course of commercial activity, PIPEDA expects safeguards that suit the sensitivity of the information. Breaches of security safeguards that create a real risk of significant harm must be reported to the Privacy Commissioner and to affected individuals, and breach records must be kept. Testing is one way to evidence your safeguards.
Check: provincial laws, such as Quebec’s, may also apply. Take legal advice. See the Office of the Privacy Commissioner of Canada.
OSFI Guideline B-13
Applies to federally regulated financial institutions. It says they should regularly perform tests and exercises to find vulnerabilities and control gaps, using penetration testing and red teaming with a clearly defined scope and potential impacts (para 3.1.2). It also expects regular vulnerability assessments (para 3.1.3) and scanning or testing of new or changed systems before production (para 3.2.9).
Source: OSFI Guideline B-13, published 31 July 2022. If you supply a regulated institution, expect these expectations to appear in your contract.
Canadian Program for Cyber Security Certification
A federal program for defence suppliers. Level 1 was introduced on 14 April 2026 and is expected to be required in select defence contracts from summer 2026. Level 1 is completed through a checklist that suppliers affirm they meet.
Note: it is not, on that description, a penetration test requirement. Read your contract. See the Government of Canada announcement.
Customer and insurer requirements
Many Canadian buyers, including those that must follow the rules above, ask suppliers for a recent independent test report in security questionnaires and contracts. Cyber insurers may ask about testing too.
Do: ask each customer or insurer what evidence they accept before you buy.
This section is general information, not legal advice. Check the current text of each rule and take advice for your situation.
Six Checks Before You Sign
Use these against every proposal. They tell you more than a provider’s ranking.
1. Where the work and data sit
Ask where testers are located, where your findings and reports are stored, and whether any of it leaves Canada. This matters if your contracts or privacy obligations limit cross-border handling.
2. Credentials of the testers
Ask who will do the work and what they hold, such as OSCP or equivalent hands-on certifications. If a provider cites CREST, check the current member listing on CREST’s own site.
3. Scope and method
The proposal should list targets, techniques, environments and exclusions, and say how business logic is tested, not just automated scanning.
4. Rules of engagement
Agree testing windows, emergency contacts, a stop condition and a signed authorization before testing starts.
5. Report quality
Look for evidence, clear risk ratings, fix guidance and an executive summary you can hand to a regulator or customer.
6. Retest and independence
Confirm a retest is included, and use a tester independent of the team that built the system. Keep any ISO 27001 consultant separate from the certification body.
If your report will support an ISO 27001:2022 audit, note that control 8.29 expects security testing in development and acceptance. Penetration testing is one accepted method, not a mandated one.
Firms We Did Not List and Why
The earlier version of this page named SecureWorks Canada, Herjavec Group, Tenable, KPMG Canada, Deloitte Canada, PwC Canada and IBM Canada. We removed them for these reasons.
- For SecureWorks, KPMG Canada and IBM, the pages we opened did not describe a penetration testing service, so we could not confirm one. For Herjavec Group we opened the Cyderes site, which did not mention Herjavec Group or penetration testing, so it is unconfirmed.
- The Deloitte Canada page did not load, and we did not check PwC Canada, so we have nothing to report on either.
- Tenable is known mainly for vulnerability management products. Scanning is not the same as a penetration test.
If any of these is on your shortlist, ask them directly what testing they offer, from which office, and with which credentials.
Content Reviewed By
Ketki Tidke
Cyber Security and GRC Lead Auditor
ISO 27001 Lead Auditor
Ketki is a certified ISO 27001 Lead Auditor specialised in Governance, Risk and Compliance, with experience consulting public, private, and government clients. She evaluates threats, risk impacts, and regulatory requirements across multiple industry frameworks.
Penetration Testing in Canada: Frequently Asked Questions
How did you choose these penetration testing companies?
We read each provider’s own website on 23 October 2026 and kept firms whose sites state a penetration testing service. The list is alphabetical, not ranked, and CyberSapiens is included with a disclosure.
Which providers have an office in Canada?
Based on their own sites, Packetlabs lists a Toronto headquarters, Vumetric lists a Toronto office, and CyberSapiens has a Hamilton, Ontario office. For the others, the pages we read did not state a Canadian office, so ask them.
Is penetration testing mandatory in Canada?
There is no single Canadian law requiring every business to run one. Federally regulated financial institutions are expected to test under OSFI Guideline B-13, and customer contracts and insurers often ask for test evidence.
How often should we test?
At least once a year for important systems and after significant changes, such as a major release or infrastructure move. Regulators and customers may set their own frequency.
Should the provider be based in Canada?
Not necessarily, but ask where the testers are located and where your findings are stored, because contracts or privacy obligations may limit cross-border handling.
Can I trust a provider’s credentials?
Treat them as claims until you verify them. Check any CREST claim on CREST’s own member listing, and ask for the profiles of the testers who will work on your engagement.
Planning a Penetration Test in Canada?
Talk to CyberSapiens about scope, rules of engagement and retesting. We will help you work out what your regulator, customers and insurer expect.
Email us
[email protected]Our Canada office
236 Pritchard Rd, Hamilton, ON L8W 3P7
