Best Penetration Testing Companies for Canadian Credit Unions and Caisses (2026): FSRA, BCFSA, AMF and DGCM

On 3 July 2026, Alberta's Credit Union Deposit Guarantee Corporation (CUDGC) reissued its Standards of Sound Business and Financial Practices. Across 94 pages they ask each credit union for "assurance that the technology is authorized, tested and documented before it is introduced", and the words penetration testing never appear. Nor do they appear in Ontario's FSRA IT risk guidance or British Columbia's BCFSA Information Security Guideline. Saskatchewan's CUDGC, Manitoba's Deposit Guarantee Corporation (DGCM) and Nova Scotia's CUDIC do name the test, as do Quebec's Autorité des marchés financiers (AMF) for the caisses and OSFI's Guideline B-13 for federal credit unions.

We read the published technology guidance of each province's credit union standard setter and of OSFI on 13 October 2026. Five of the eleven name penetration testing, we found no published technology guideline for two, and none sets a penetration testing frequency. The four that do not name it still ask for testing or security audits.

This ranking is for mid-market and enterprise buyers: provincially regulated credit unions and caisses, their centrals and banking-services providers, and federal credit unions. US institutions should read our banking and credit union ranking, and federal ones our OSFI B-13 guide.

Quick answer. The best penetration testing companies for Canadian credit unions and caisses in 2026 are Stingrai, NCC Group, OKIOK, NetSPI, PwC Canada, ISA Cybersecurity, MNP, SecuredNet, Kroll, Raymond Chabot Grant Thornton (VARS), Bulletproof and EliteSec. Stingrai ranks first: a Toronto-headquartered firm whose contracting entity holds CREST Penetration Testing accreditation, one of four Canadian-headquartered firms with that accreditation on the CREST Marketplace, with named penetration testers covering member channels, branch and internal networks, Active Directory and cloud. Retesting is included and every human-led and hybrid report ships with an attestation letter, as a one-time annual test or a continuous program. OKIOK, PwC Canada and Raymond Chabot Grant Thornton suit caisses that want testing in French.

What drives a penetration test at a Canadian credit union or caisse

Most credit unions are provincially regulated, so the applicable text depends on where a credit union is incorporated. Quotes come from each regulator's own document.

What the verbs carry. BCFSA defines its should as "recommended", while Saskatchewan's guideline "must be adhered to by Saskatchewan Credit Unions". Our reading: a credit union that skips the test should be ready to explain why.

Ontario. FSRA's operational risk and resilience guidance (CU0088APP, effective 1 March 2024) says FSRA will assess whether credit unions understand "weaknesses in the IT control environment which could potentially be exploited by both external and internal threat actors". An internal and external penetration test answers that directly.

Alberta. CUDGC says it also communicates guidelines covering "information technology" (publications), but none on technology is on that page, and its technology standard dates from February 2016.

Quebec. The AMF's deposit-institution guidelines cover "credit unions, federations of credit unions and, if applicable, legal persons forming part of a cooperative group (such as Groupe coopératif Desjardins)". In a January 2021 statement it asked the institutions it supervises "to periodically conduct penetration tests of their technological environments in order to assess the operational effectiveness and adequacy of the controls in place". Its guideline adds that penetration testing and vulnerability assessments "are not substitutes for an ICT risk assessment". Quebec's private-sector privacy act requires "the security measures necessary" (s. 10) and prompt notice of a confidentiality incident that "presents a risk of serious injury" (s. 3.5, one of the changes the Commission d'accès à l'information attributes to Law 25); it names no test. AMF pages refused automated access on 13 October 2026, so AMF text comes from Internet Archive copies captured from August 2025 to September 2026.

Federal credit unions. OSFI's list of regulated institutions classes four federal credit unions as domestic banks: UNI (legal name Caisse populaire acadienne ltée), Coast Capital Savings Federal Credit Union, Innovation Federal Credit Union and Tru Cooperative Bank, which was First West Credit Union until 1 April 2026, so B-13 applies; it asks institutions to "set defined triggers, and minimum frequencies" for intelligence-led threat assessments.

New Brunswick and Newfoundland and Labrador. FCNB's credit union page links the act, a regulation, two rules and forms, but no technology guideline; the deposit insurer's 2020 to 2021 annual report says FCNB "issued cybersecurity guidance to the system", and we found no public copy. Newfoundland and Labrador's CUDGC reports that it began IT and cyber security examinations: "Two examinations were completed during the year."

Centrals and banking-services providers. Saskatchewan's, Manitoba's and Nova Scotia's texts also reach SaskCentral, Credit Union Central of Manitoba and Atlantic Central. Nova Scotia names League Data and Celero, and Manitoba and Nova Scotia ask for an annual CSAE 3416 report from a provider that runs the banking system. That report speaks to the provider's controls; your penetration test covers your side of the connection.

Audit cycles. DGCM expects its section 4 controls "audited at least every three years", and Nova Scotia "at least every two years". Plan those IT audits and the penetration test on one calendar.

Incident clocks. Manitoba and Nova Scotia set theirs in separate reporting requirements we did not find published. Agree in the rules of engagement who decides whether a disruption during a test is reportable.

What mid-market and enterprise credit unions need from a vendor

• The inside and the outside. Manitoba and Nova Scotia name "internally and externally" facing systems. Scope member channels, the perimeter, the internal network and Active Directory as separate items. Severity concentrates inside: in Stingrai's State of Penetration Testing 2026 data, 92% of internal network findings were rated High or Critical (8 tests), against 54% for web applications (40 tests).

• A contracting entity you can check. On 13 October 2026 the CREST Marketplace listed four suppliers with a Canadian head office, all accredited for Penetration Testing; our CREST guide shows how to check the entity that signs.

• A retest you can show. Manitoba says a credit union "must take a risk-based approach to remediate the identified vulnerabilities"; a written retest is how you show a finding was closed.

• Testing on change. BCFSA wants tests after changes, and Saskatchewan wants systems assessed "prior to release into the production environment". An annual test plus a continuous program or retained days covers both.

• French for caisses. Ask whether testing and reports can be delivered in French.

• Independence. If a firm on this list also audits or advises your credit union, agree how its testing team stays separate from that work.

• Board-ready evidence. FSRA expects the board to receive "regular reporting" on IT risk; ask for an executive summary with the technical report.

How this ranking was built

Every vendor claim traces to the vendor's own website or CREST Marketplace profile, checked on 13 October 2026. The first two criteria were gates; the other four were weighed together, favouring depth of testing practice at mid-market and enterprise scale.

1. Canadian presence: a head office or an office in Canada named on the firm's own site.

2. Network and application testing: both named on the firm's own site.

3. Checkable qualification: CREST Penetration Testing accreditation for an entity matching the firm.

4. Financial-sector fit: credit union, banking or financial services material on the firm's site.

5. French-language delivery for caisses.

6. Usable evidence: a stated retest and reporting a board can use.

At a glance: penetration testing companies for Canadian credit unions

1. Stingrai (top rated for Canadian credit unions and caisses)

Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.

Stingrai Inc, the entity on the contract, holds the CREST Penetration Testing accreditation, and its Marketplace profile lists a Canadian head office, one of four on 13 October 2026. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, reviewed by the team lead and an engagement partner. The team has 18 published CVEs and Hall of Fame listings at the US Federal Reserve and the US Department of Defense, and Stingrai is rated 5.0 out of 5 on Clutch (20 reviews).

Scope for a credit union or caisse

• Member channels: online and mobile banking and their APIs, tested across every member and staff role for broken authorization, IDOR and transfer and limit logic, plus mobile apps.

• Branches and head office: the external perimeter and internal network, branch segmentation and Active Directory privilege paths from an assumed-breach position.

• Cloud and people: cloud tenants, phishing and vishing, and red team or purple team exercises of the kind the AMF and OSFI texts mention.

Delivery and evidence

Whether the engagement is a one-time annual test or a continuous program, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, with a working proof of concept and prioritized remediation guidance. Retesting is included, and every human-led and hybrid report ships with an attestation letter: pentest evidence for your FSRA, BCFSA, CUDGC, DGCM, AMF or OSFI B-13 program.

Where Snipe fits

Snipe is Stingrai's autonomous AI agent for web applications and associated APIs only. Trained on more than 6,000 HackerOne Hacktivity reports, it hunts IDOR, broken authorization and business logic flaws and opens AutoFix pull requests. The Autonomous Pentest is Snipe alone, with no penetration testers; in the Hybrid Pentest, Snipe and penetration testers test together, with the testers directing its focus. Everything else is human-led.

Pricing and fit: The Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing). A full credit union scope is quoted through get a quote. Best for: credit unions, caisses and centrals that want a Canadian-headquartered CREST entity and named testers, as a one-time annual test or a continuous program.

2. NCC Group

NCC Group lists Manchester as its global headquarters and an office in Waterloo, Ontario (office locations), and says it was "Founded in 1999" (about). Its Marketplace entry holds ten CREST accreditations and specialisms, including Penetration Testing and TLPT-FS Threat Led Penetration Testing, under a UK head office. Its testing page covers attacks on "networks, systems, and applications", and its financial services page lists banking and payments among its sectors.

Best for: larger credit unions, centrals and banking-services providers that want threat-led depth.

3. OKIOK

OKIOK lists its head office in Laval, Quebec (contact), and says it "started in 1973 maintaining mini-computers" (history). Its penetration testing page runs from external and internal, web, API, mobile, cloud and wireless testing to red and purple team operations. Its finance page says it "works with banks, financial groups, asset managers and fintechs" and lists "OSFI B-13, AMF and PCI DSS compliance", and it publishes its penetration testing page in French.

Best for: caisses that want a French-speaking tester already working to AMF and OSFI B-13 expectations.

4. NetSPI

NetSPI lists Minneapolis as its headquarters and Toronto among its offices (contact), and says it "has led security innovation since its inception in 2001" (home). Its Marketplace entry holds Penetration Testing and the Threat Led Penetration Testing specialism. It tests internal and external networks and web, API and mobile applications on its PTaaS platform and publishes a customer story about a US credit union, and its merger with Synack "officially closed in October 2026".

Best for: large credit unions that want an enterprise PTaaS platform and a threat-led specialism.

5. PwC Canada

PwC Canada's about pages name no head office; they say its people "are located coast to coast" (about). Its cyber managed services page offers "Penetration testing, red teaming and purple teaming" across "application landscapes, mobile apps" and "internal and external networks", with a French version, and its OSFI I-CRT article explains OSFI's use of "intelligence-led penetration testing".

Best for: large and federal credit unions that want testing beside OSFI-focused advisory work, in English or French.

6. ISA Cybersecurity

ISA Cybersecurity gives Toronto as its head office, with offices in Calgary and Ottawa (contact), and says it was "Founded in 1992" (about). Its penetration testing page lists internal, external, wireless, mobile and web application testing, and red and purple teaming. Its financial services page names credit unions among the institutions it secures and cites "GDPR, OSFI, and FSRA".

Best for: Ontario credit unions that want a Toronto-headquartered firm familiar with FSRA.

7. MNP

MNP gives its head office as Calgary, with 170 offices (about), and calls itself "a leading national accounting, tax and business consulting firm for Canada's credit unions" (credit unions). Its MNP Digital cyber practice offers offensive security: "We assess systems, networks (internal, external, and wireless), mobile and web applications, and even people to identify weaknesses."

Best for: credit unions that want a national firm with a long-standing credit union practice.

8. SecuredNet

SecuredNet (Secured Net Solutions Inc) describes itself as "a boutique IT consulting agency based in Calgary, Alberta" and lists a Toronto address on its home page. Its Marketplace entry holds Penetration Testing with a Canadian head office, and it calls itself "a PCI-listed QSA company". Its testing page lists network, web app, wireless, mobile, red and purple team, social engineering and physical testing, and banking appears among its industries.

Best for: credit unions that want a Canadian-headquartered CREST entity with PCI DSS assessment in the same firm.

9. Kroll

Kroll says it "Is Headquartered in New York" (about) and has a Toronto office. Its Marketplace entry, Kroll LLC, holds Incident Response, Penetration Testing and Security Operations Centre accreditations, and its penetration testing datasheet lists web application, API, internal and external network testing and red team services.

Best for: credit unions that want testing and incident response from one CREST-accredited entity.

10. Raymond Chabot Grant Thornton (VARS)

Raymond Chabot Grant Thornton lists its head office in Montreal (contact) and works "in some 90 offices across the province of Quebec" (about). Its testing comes from VARS, "the cybersecurity division of Raymond Chabot Grant Thornton (RCGT)" (cybersecurity), whose testing page lists internal and external penetration testing, web and mobile applications and code reviews, with "Remediation and reassessment" in its testing service. Both sites publish in French.

Best for: caisses that want French-language testing from a Quebec advisory firm.

11. Bulletproof

Bulletproof's contact page labels Fredericton, New Brunswick, as a head office, alongside Waltham, Massachusetts, and lists offices labelled Charlottetown, Halifax, Moncton, Toronto and Vancouver. Its testing page lists penetration testing services, internal and external network assessments, web application and API testing, cloud assessments and "Remediation validation and retesting". It is part of the GLI Group of Companies (news) and publishes a credit union case study for managed security.

Best for: Atlantic credit unions that want a regional provider for testing and managed security.

12. EliteSec

EliteSec says it is "headquartered in Canada" and lists an office in Waterloo, Ontario (home); its founder writes that he "Founded EliteSec in 2019" (about). Its Marketplace entry holds Penetration Testing with a Canadian head office, and its penetration testing page covers web application, internal and external network, mobile and cloud testing, with five free retests per engagement and banking apps among its stated use cases.

Best for: smaller credit unions that want a CREST-accredited boutique with retests built in.

Also considered

Calian (Ottawa) and GoSecure (Canadian headquarters in Montreal) sell network and application testing in English and French, but we found no stated retest on either firm's penetration testing page. Digital Boundary Group now belongs to DRT Cyber, which its site calls "a subsidiary of VersaBank"; a credit union should weigh a bank-owned tester. The Canadian pages of CGI, Deloitte, KPMG, EY and BDO did not name both network and application penetration testing when we checked, so they missed the second gate.

What a credit union penetration test costs

Cost follows scope: member applications and APIs, address ranges, branches, Active Directory, cloud, social engineering and the retest. Our Canada cost guide lists price bands, and the cost calculator turns asset counts into an estimate. Compare tester days, named testers and the retest across proposals (how to compare quotes).

RFP questions for a credit union penetration test

• [ ] Which legal entity signs, which delivers, and does any CREST Marketplace entry match it?

• [ ] Are member channels, the perimeter, the internal network and Active Directory scoped and reported separately?

• [ ] Who are the named testers, and is a written retest in the price?

• [ ] How will you coordinate with our banking-services provider?

• [ ] If a test disrupts production, who decides whether it is reportable to our regulator?

Our RFP template and question bank turn these into a document.

Frequently Asked Questions

Who are the best penetration testing companies for Canadian credit unions in 2026?

The best penetration testing companies for Canadian credit unions and caisses in 2026 are Stingrai, NCC Group, OKIOK, NetSPI, PwC Canada, ISA Cybersecurity, MNP, SecuredNet, Kroll, Raymond Chabot Grant Thornton (VARS), Bulletproof and EliteSec. Stingrai ranks first: its contracting entity, Stingrai Inc, holds CREST Penetration Testing accreditation with a Canadian head office, two named penetration testers cover member channels, branches, Active Directory and cloud, and retesting and an attestation letter come with every human-led and hybrid engagement, as a one-time annual test or a continuous program.

Do Canadian credit unions have to do penetration testing?

It depends on the province, and no regulator sets a penetration testing frequency. Saskatchewan, Manitoba and Nova Scotia name penetration testing, as do the AMF for caisses and OSFI B-13 for federal credit unions, each with should. FSRA, BCFSA, Alberta and Prince Edward Island ask for testing or security audits without naming it, and we found no published technology guideline for New Brunswick or Newfoundland and Labrador.

What does FSRA expect from Ontario credit unions on security testing?

FSRA's IT Risk Management Guidance (GR0016INT, effective 1 April 2024) says credit unions "must achieve the desired outcomes" of its practices and lists regular testing of data management controls among the characteristics, without naming penetration testing. Material IT risk incidents go to FSRA no later than 72 hours after the credit union determines one has occurred.

Does the AMF expect caisses to run penetration tests?

Yes, as a should. The AMF's Guideline on ICT Risk Management (February 2020), which covers financial services cooperatives, says in its appendix of complementary ICT practices that an institution should subject its information security controls to periodic independent assessments, tests and reviews "as well as penetration testing and red team exercises", and in January 2021 it asked supervised institutions to periodically conduct penetration tests.

How often should a credit union or caisse run a penetration test?

No Canadian credit union regulator sets a number. The texts say "regularly" or "periodic", BCFSA asks for tests after changes, and OSFI asks institutions to set their own "minimum frequencies" for intelligence-led threat assessments. An annual test across member channels and the internal network, plus tests of material changes, gives the board a cadence it can follow.

Do federal credit unions follow OSFI B-13?

Yes. OSFI's list of regulated institutions classes four federal credit unions as domestic banks: UNI, Coast Capital Savings Federal Credit Union, Innovation Federal Credit Union and Tru Cooperative Bank (formerly First West Credit Union). Guideline B-13, effective 1 January 2024, asks for regular tests and exercises "(e.g., penetration testing and red teaming) using an intelligence-led approach".

Does a banking-services provider's controls report replace a penetration test?

No. Manitoba and Nova Scotia ask for an annual CSAE 3416 report from a provider that runs the banking system, and Nova Scotia names League Data and Celero. The same guidelines separately expect penetration testing of internally and externally facing systems: the report covers the provider, your test covers your own estate.

How much does a credit union penetration test cost?

Cost follows scope and the retest. Stingrai's fixed packages are US$3,000 (Autonomous) and US$6,800 (Hybrid) per assessment for one web application and associated APIs; a full credit union scope is quoted.

Related reading

• OSFI B-13 and Penetration Testing (2026)

• CREST-Accredited Penetration Testing Companies in the USA and Canada

• Best Banking and Credit Union Penetration Testing Companies

• Top Penetration Testing Companies in Canada (2026)

References

1. FSRA, IT risk management, GR0016INT, 2024. https://www.fsrao.ca/regulation/guidance/information-technology-it-risk-management

2. FSRA, Operational risk and resilience, CU0088APP, 2024. https://www.fsrao.ca/industry/credit-unions-and-caisses-populaires/regulatory-framework/guidance-credit-unions-and-caisses-populaires/operational-risk-and-resilience

3. BCFSA, Information Security Guideline, 2025. https://www.bcfsa.ca/media/4042/download

4. CUDGC Alberta, Standards of Sound Business and Financial Practices, 2026. https://cudgc.ab.ca/wp-content/uploads/SSBFPs2026.pdf

5. CUDGC Saskatchewan, Technology and Cyber Risk Management Guideline and Prudential Standard, 2024. https://cudgc.sk.ca/wp-content/uploads/2024/11/Technology-Cyber-Risk-Management-Guideline-Prudential-Standard.pdf

6. DGCM, Information Technology and Information Security Guidelines, 2024. https://dgcm.ca/wp-content/uploads/publications/InformationTechnology%20%28IT%29%20and%20Information%20Security%20%28IS%29%20Guidelines.pdf

7. AMF, Guideline on ICT Risk Management, 2020, and incident management page. https://lautorite.qc.ca/fileadmin/lautorite/reglementation/lignes-directrices-toutes-institutions/ld-gestion-tic_an.pdf and https://lautorite.qc.ca/en/professionals/deposit-institutions-and-trust-companies/information-security-incident-management

8. Quebec, Act respecting the protection of personal information in the private sector, CQLR c P-39.1. https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1

9. CUDIC Nova Scotia, Information Technology and Outsourcing Guideline, 2024. https://nscudic.org/wp-content/uploads/2024/05/Information-Technology-IT-and-Outsourcing-Guidelines-CUDIC-FINAL-Effective-June-1-2024.pdf

10. CUDIC Prince Edward Island, Standards of Sound Business Practice. https://www.peicudic.com/annualreport_files/standardsofsoundbusiness.pdf

11. NBCUDIC, Annual Report 2020 to 2021; CUDGC Newfoundland and Labrador, Annual Business Report 2024 to 2025. https://legnb.ca/content/house_business/60/1/tabled_documents/8/ar-2020-2021-nbcudic.pdf and https://assembly.nl.ca/business/electronicdocuments/CreditUnionDepositGuaranteeCorporationAnnualBusinessReport2024-25.pdf

12. OSFI, Guideline B-13 and Technology and Cyber Security Incident Reporting advisory; UNI and Tru Cooperative Bank federal charter releases. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-risk-management and https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-security-incident-reporting and https://www.uni.ca/en/news/press-release/uni-becomes-the-first-canadian-credit-union-to-obtain-a-federal-charter and https://www.trucooperativebank.ca/news-stories/media/First-West-becomes-a-federal-credit-union-and-officially-launches-as-Tru-Cooperative-Bank

13. CREST Marketplace supplier profiles linked in each entry, opened 13 October 2026. https://marketplace.crest.org/suppliers/

14. Stingrai, State of Penetration Testing 2026. https://www.stingrai.io/reports/state-of-penetration-testing-2026

15. Vendor pages linked in each entry, fetched 13 October 2026.

Talk to Stingrai

Bring your risk assessment and last year's report. Stingrai will scope your member channels, branches, internal network, Active Directory and cloud, name the penetration testers and retest the fixes, as a one-time annual test or a continuous program. Get a quote or see the pricing page.