Ontario's health information custodians reported 785 privacy breaches to the Information and Privacy Commissioner of Ontario in 2025, up from 535 in 2021, and 50 of them were cyberattacks or ransomware, according to the statistics in the IPC's 2025 annual report. The most damaging recent attack did not start inside a hospital. In October 2023 a threat actor used compromised administrator accounts at TransForm Shared Service Organization, the IT provider for five southwestern Ontario hospitals, published patient records and encrypted servers, and all five hospitals declared a Code Grey, as the IPC recorded in PHIPA Decision 284.
Where Stingrai fits: Stingrai is a CREST-accredited penetration testing service provider at firm level, headquartered in Toronto and founded in 2021. Two named penetration testers holding certifications such as OSCE³, OSWE, OSEP, CREST CRT and CISSP run every human-led engagement, with 18 published CVEs across the team. For a Canadian health system that means remote access and vendor accounts, the Active Directory estate behind the hospital network, Microsoft 365 and Entra ID, and patient portals and their APIs tested across every role, as a one-time annual test or a continuous program, with retesting and an attestation letter included. Published pricing is US$3,000 for an Autonomous Pentest and US$6,800 for a Hybrid Pentest covering one web application and its APIs (pricing); hospital and health authority scopes are quoted.
This guide covers Canadian law for hospitals, Ontario Health Teams, health authorities, long-term care, labs, pharmacies and digital health vendors. For HIPAA, HITRUST and FDA premarket testing, read our US healthcare penetration testing ranking, the HIPAA-focused ranking and the medical device penetration testing ranking. Every vendor below was checked on its own website, and every CREST accreditation on the CREST Marketplace, on 25 September 2026.
Quick answer: who are the best healthcare penetration testing companies in Canada in 2026?
The best healthcare penetration testing companies in Canada in 2026 are Stingrai, Kroll, NetSPI, ISA Cybersecurity, CGI, MNP Digital, OKIOK, Bulletproof, eSentire, Kobalt.io, Vumetric and Packetlabs. Stingrai ranks first: a CREST-accredited penetration testing service provider headquartered in Toronto, with two named penetration testers on every human-led engagement, retesting and an attestation letter included, and published package prices, one-time or continuous. Kroll follows for testing next to an incident response retainer, NetSPI for medical device programs, and ISA Cybersecurity for Ontario hospitals buying threat and risk assessments and testing together.
What Canadian healthcare buyers are actually required to test
No Canadian health privacy statute uses the words penetration test. Every province asks for reasonable safeguards, and two instruments name the test outright: Ontario Health's standard for virtual visit solutions and Quebec's TGV certification. Each regime below is quoted from its own text.
Does PHIPA require penetration testing?
No. Section 12(1) of Ontario's Personal Health Information Protection Act, 2004 requires a custodian to "take steps that are reasonable in the circumstances" to protect personal health information "against theft, loss and unauthorized use or disclosure". It names no test, frequency or tester.
The closest obligation sits in O. Reg. 329/04. A health information network provider, one that serves two or more custodians so they can share information, "shall perform, and provide to each applicable health information custodian a written copy of the results of, an assessment" covering "threats, vulnerabilities and risks to the security and integrity of the personal health information" (section 6(3)). Ontario Health, which runs the provincial EHR, must assess every system that retrieves, processes or integrates EHR data the same way (section 55.3 of the Act). The IPC can impose administrative penalties of up to $500,000 on an organization (section 35 of the regulation), while the electronic audit log duty in section 10.1 of the Act is still not in force. For a network provider, the written threat and risk assessment is where the penetration test report belongs.
What does O. Reg. 51/26 require of Ontario hospitals?
O. Reg. 51/26, made under the Enhancing Digital Security and Trust Act, 2024, took effect on 1 July 2026 for Group A, B and C public hospitals and the University of Ottawa Heart Institute. Hospitals must name a primary and an alternate cyber security contact, complete a cyber security maturity assessment every two years and send a summary to the provincial Chief Information Security Officer, and report critical cyber security incidents within 72 hours. The implementation guidance says assessments "should align with NIST CSF 2.0", gives hospitals with no assessment since 1 July 2025 until 1 July 2027 to complete one, and does not mention penetration testing. A maturity assessment scores protection and detection; a penetration test shows whether those scores hold up.
What does Ontario Health require of hospitals and digital health vendors?
Ontario Health's June 2023 operational direction requires every general hospital to use shared cyber security services from an assigned Local Delivery Group, and O. Reg. 329/04 lets Ontario Health set interoperability specifications that may cover "privacy or security" (section 26). The requirement that names the test applies to vendors. Ontario Health's Virtual Visits Solution Requirements, version 3.1 dated 15 September 2026, bind any virtual care solution seeking Ontario Health verification. Requirement 2.3.10 reads: "Penetration tests are to be done, at a minimum, on an annual basis, or when there has been a major software release or change in architecture or infrastructure. Penetration tests must include the application and application infrastructure." Requirement 2.3.9 adds quarterly vulnerability scans, and 2.3.14 requires personal health information, data and backups to be hosted in Canada. Ontario Health's own 2024/25 privacy and security report counts 8 penetration tests and 15 penetration test reviews among that year's assessments.
What have IPC Ontario decisions said about health cyberattacks?
In PHIPA Decision 284, issued 16 June 2025, the IPC examined the TransForm attack on Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare and Windsor Regional Hospital. The investigator found that "the lack of MFA for the three administrator accounts was a likely contributing factor", that one account, used by a hospital's third-party vendor, "could not be configured with MFA due to a technical limitation", and that the encryption itself was an unauthorized use and loss of personal health information requiring notice to patients. TransForm afterwards "performed penetration testing of all exposed systems and applications." The IPC's 2025 annual report summed it up: "Health information custodians can outsource services but not responsibility."
The LifeLabs report by the IPC and the BC Office of the Information and Privacy Commissioner, completed in June 2020 and published on 25 November 2024 after LifeLabs' court challenge failed, found that attackers entered through critical 2017 vulnerabilities in the online appointment booking system and took data on about 8.6 million people. The commissioners' eight technical findings include inadequate patch management, inadequate network segregation and vulnerability scans that "were insufficient and/or used inadequate scanning tools."
What does Alberta's Health Information Act require?
Section 60 of Alberta's Health Information Act requires a custodian to "take reasonable steps in accordance with the regulations to maintain administrative, technical and physical safeguards" that "protect against any reasonably anticipated (i) threat or hazard to the security or integrity of the health information". Section 8(3) of the Health Information Regulation requires custodians to "periodically assess" those safeguards, with no frequency set, and section 64 of the Act requires a privacy impact assessment before a new information system that handles identifying health information is introduced. Neither mentions penetration testing. Fines reach $1,000,000 for an organization.
Recovery Alberta became fully operational on 1 September 2024, Primary Care Alberta on 1 February 2025, Acute Care Alberta on 1 April 2025 and Assisted Living Alberta on 1 September 2025, according to the Government of Alberta; Alberta Health Services now answers to Acute Care Alberta, and Connect Care, the provincial clinical information system built with Epic, runs across all of them. Amendments in force since mid-2026 also require custodians to comply with security standards the Minister may set under a new section 108.1, so watch for them.
What do British Columbia's FIPPA and health authorities require?
Section 30 of BC's Freedom of Information and Protection of Privacy Act requires a public body to protect personal information "by making reasonable security arrangements against such risks as unauthorized collection, use, disclosure or disposal", and section 36.3 has required breach notification since 1 February 2023. Private clinics fall under PIPA section 34, which uses the same language. We found no public vendor security schedule on the Provincial Health Services Authority's supplier pages, so for health authorities the requirement arrives in the contract. The BC government's own contract Security Schedule for ministries, in its February 2020 version, required contractors to "conduct regular: (a) vulnerability scans; (b) web application scans; and (c) penetration tests". It binds ministries, not health authorities, but a vendor selling to both should expect the same questions.
What does Quebec require: the health information act, Law 25 and TGV?
Quebec's Act respecting health and social services information came into force on 1 July 2024. Section 99 requires security measures that are "reasonable given, in particular, the sensitivity of the information", and its governance regulation sets a cadence no other province matches: a yearly assessment of "the effectiveness of the security measures put in place by the body" (section 6) and an evaluation of technology products against the network's standards at least every other year (section 17). Neither names a penetration test. Since 1 December 2024, 30 establishments have been integrated into Santé Québec.
For vendors, the certification bureau's penetration testing orientation makes a penetration test a prerequisite for TGV certification of any technology product or service using personal, health and social services information, and the April 2026 criteria list places it at criterion S16.03. The orientation accepts white box testing in every case and does not accept black box testing, requires every role to be tested in production or a production-equivalent environment, and accepts reports only from firms with legally authorized representatives in Canada, certified staff and criminal record checks, able to provide the report in French. Private clinics, laboratories and vendors also carry Law 25, whose section 3.3 requires a privacy impact assessment for new information systems. Our TGV certification guide and Law 25 penetration testing guide go further.
Where does PIPEDA apply in Canadian healthcare?
PIPEDA covers commercial activity, which in healthcare means private clinics, laboratories and digital health vendors where no substantially similar provincial law applies, plus data that crosses borders. The Office of the Privacy Commissioner treats Ontario's PHIPA, New Brunswick's PHIPAA, Newfoundland and Labrador's PHIA and Nova Scotia's PHIA as substantially similar. PIPEDA Principle 4.7 requires "security safeguards appropriate to the sensitivity of the information", and section 10.1 requires reporting breaches that create "a real risk of significant harm". Bill C-36, which would replace PIPEDA's privacy part, was at second reading in the House of Commons on 25 September 2026.
What do Newfoundland and Labrador, Manitoba and the other provinces require?
Newfoundland and Labrador's Personal Health Information Act, section 15(1)(a), requires "steps that are reasonable in the circumstances". After the October 2021 attack, the province's privacy commissioner found in Report P-2023-001 that the health bodies breached that section and that the vulnerabilities "were known within the health care system, but there was a failure to take sufficient and timely steps to remedy them". NL Health Services has been the single provincial health authority since 1 April 2023. Manitoba sets a fixed interval: "A trustee shall conduct an audit of its security safeguards at least every two years" (Personal Health Information Regulation, section 8(1)). It says audit, not penetration test, but an audit of technical safeguards is hard to defend without technical testing. Nova Scotia, New Brunswick and Saskatchewan use reasonable safeguards language.
What do Canada Health Infoway and the Canadian Centre for Cyber Security add?
Neither creates a legal obligation. Canada Health Infoway's 2014 privacy and security requirements for digital health solutions say that "effective security vulnerability management of new or significantly upgraded systems and software should also include penetration testing" (Security Requirement 82), and its AI Scribe Program funds up to 10,000 one-year licences from vendors pre-qualified partly on privacy and security standards. The Canadian Centre for Cyber Security's National Cyber Threat Assessment 2025-2026 charts a 75 percent rise in the Canadian healthcare ransomware incidents it observed from 2022 to 2023, names the October 2023 attack on five southern Ontario hospitals, and warns that an incident at one dominant service provider can affect an entire sector.
Canadian vendors selling into US health systems
A Canadian vendor with US customers answers to a different file: the HIPAA Security Rule does not name penetration testing, and the FDA's premarket cybersecurity guidance does for connected devices. Our US healthcare ranking covers both, and one well-scoped test can usually serve both files.
Regime | Names penetration testing? | Cadence | Who it binds |
|---|---|---|---|
PHIPA s. 12 and O. Reg. 329/04 | No; threat and risk assessment for network providers | None set | Ontario custodians and network providers |
O. Reg. 51/26 (EDSTA) | No; maturity assessment | Every two years; incidents in 72 hours | Ontario public hospitals |
Ontario Health Virtual Visits Solution Requirements v3.1 | Yes, requirement 2.3.10 | Annually and after major change | Verified virtual care solutions |
Quebec TGV certification | Yes, criterion S16.03 | Before certification, then yearly | Technology vendors in Quebec's network |
Quebec health information act and governance regulation | No | Yearly review; products every other year | Santé Québec and other bodies |
Alberta HIA s. 60 and Regulation s. 8 | No | Periodic, no frequency set | Alberta custodians |
BC FIPPA s. 30 and PIPA s. 34 | No | None set | BC public and private bodies |
Manitoba PHIA Regulation s. 8 | No, an audit | At least every two years | Manitoba trustees |
PIPEDA Principle 4.7 | No | None set | Commercial activity |
The attack surface in Canadian healthcare
The three best-documented Canadian health breaches entered through three different doors, and none of them was the front door a scanner watches.
A good healthcare scope in Canada covers:
Clinical systems and their integration layer. Epic runs Alberta's Connect Care, Oracle Health and Meditech run hospital systems elsewhere, and the Newfoundland and Labrador attacker took data from the Meditech data repository. Test integration engines, HL7 and FHIR endpoints and EHR connections, not only the screens.
Patient portals, booking and virtual care apps. The LifeLabs breach began in an online appointment booking system, and Ontario Health's requirement 2.3.10 covers "the application and application infrastructure". Test every role, patient, substitute decision-maker, clinician and administrator, for broken authorization and IDOR on record identifiers.
PACS, medical devices and segmentation. The LifeLabs commissioners found network segregation inadequate. Test whether a compromised workstation can reach imaging archives and device networks, under rules agreed with clinical engineering.
Shared regional infrastructure. TransForm serves five hospitals, and Newfoundland and Labrador's managed environment covered four regional authorities. Test shared domains, administrative tiers and paths from one member organization into another.
Microsoft 365 and Entra ID. Newfoundland and Labrador's commissioner concluded initial access was likely gained through email phishing. Test Conditional Access, MFA coverage, app consent grants and legacy authentication, and phish staff.
Vendor remote access. The Newfoundland and Labrador attacker logged in through a VPN on single-factor authentication, and at TransForm a vendor's administrator account could not take MFA. Test every inbound path, including vendor support accounts, jump hosts and remote management tools.
AI scribes and clinical AI. The IPC's January 2026 guidance, AI Scribes: Key Considerations for the Health Sector, names prompt injection, model inversion and jailbreaking, and says that before enabling Model Context Protocol functionality "organizations should perform rigorous security assessments". Test the scribe's EMR integration, cross-patient exposure and prompt injection through transcripts; our clinical LLM and AI scribe scoping guide has the detail.
How we ranked them
Twelve vendors were scored against nine criteria, each read from the vendor's own website on 25 September 2026.
Verified Canadian presence. A Canadian headquarters or office on the vendor's own site.
Published healthcare work. A healthcare page or medical device practice.
Independent accreditation. Firm-level CREST accreditation or an equivalent. Every CREST accreditation in this guide was checked on the CREST Marketplace, and the one customer rating we print, Stingrai's Clutch score, was checked on Clutch itself; other certifications are as each vendor states them.
Named testers. Whether penetration testers and their certifications are named before the engagement.
Depth where Canadian health breaches start. Remote access, privileged and vendor accounts, Active Directory, Microsoft 365 and patient-facing web applications.
Evidence that fits Canadian regimes. Reports that can feed a PHIPA threat and risk assessment, an Ontario Health verification file or a TGV submission.
Retesting. Included, optional or billed.
Delivery model. One-time and continuous options, and a findings portal.
Pricing transparency. Whether a buyer can see a number before a sales call.
Five firms were considered and not ranked. KPMG Canada and Deloitte Canada did not describe a penetration testing service on their Canadian cyber security pages when we checked. Clearwater and Fortified Health Security, both US healthcare specialists, list no Canadian office or Canadian delivery on their own sites; they appear in our US ranking. Digital Boundary Group's domain now redirects to its parent DRT Cyber's site, where the Digital Boundary Group page lists a Minneapolis address and the CREST listing sits under DRT Cyber Inc in the United States.
The 12 companies at a glance
# | Company | HQ | Accreditations verified | Delivery model | Named testers | Retest | Published pricing | Best for |
|---|---|---|---|---|---|---|---|---|
1 | Stingrai | Toronto, ON (London, UK office) | CREST Penetration Testing, firm level | Human-led or hybrid; one-time or continuous; PTaaS portal | Yes, two per human-led engagement | Included | Yes, US$3,000 and US$6,800 per web app assessment | Named testers and evidence for PHIPA, Ontario Health or TGV |
2 | Kroll | New York; Toronto office | CREST Penetration Testing, Incident Response, SOC (Kroll LLC); ISO 27001 | Consulting-led, alongside incident response | Not published | Not stated | No | Testing from the incident response firm |
3 | NetSPI | Minneapolis; Toronto office | CREST Penetration Testing, Threat Led Penetration Testing | PTaaS platform, in-house bench | Not published | Not stated | No | Medical device makers and large health systems |
4 | ISA Cybersecurity | Toronto, ON | None on the CREST Marketplace | Project-based, with TRA, PIA and managed services | Not published | Not stated | No | TRA, PIA and testing together |
5 | CGI | Montréal, QC | CREST via its UK entity only | Program-based consulting; continuous offensive validation | Not published | Fix verification described | No | Provincial health organizations |
6 | MNP Digital | Calgary, AB (MNP head office) | None on the CREST Marketplace | Consulting-led offensive security | Not published | Not stated | No | Clinics and western Canada |
7 | OKIOK | Laval, QC | None on the CREST Marketplace | Project-based consulting | Not published | Not stated | No | Local Quebec testing and identity work |
8 | Bulletproof | Fredericton, NB | Canadian entity not on the CREST Marketplace | Project-based, inside managed IT and security | Not published | Not stated | No | Atlantic Canadian health organizations |
9 | eSentire | Waterloo, ON | None on the CREST Marketplace | Autonomous, continuous validation inside MDR | No, AI operatives | Re-validation stated | No | Existing eSentire MDR customers |
10 | Kobalt.io | Vancouver, BC | None on the CREST Marketplace | Project-based, inside a compliance practice | Certifications published, names not | Optional, 20 percent of original cost | Yes, from US$3,000 | Health tech startups |
11 | Vumetric | Toronto, ON (Canadian HQ; TELUS) | ISO 9001; none on the CREST Marketplace | Project-based with PTaaS platform | Not published | Requested in platform | Quote tool, no rate card | Medical device makers |
12 | Packetlabs | Toronto, ON | CREST Penetration Testing, AI-Enabled Penetration Testing; SOC 2 Type 2 | Project-based, manual-led; continuous option | Not published | Built into continuous service | No | EHR, telehealth and IoMT scopes |
"Not stated" and "Not published" mean the vendor's own website did not say so on 25 September 2026. Ask for it in writing during scoping.
1. Stingrai
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
Stingrai Inc. is listed for Penetration Testing on the CREST Marketplace, rates 5.0 out of 5 across 19 reviews on Clutch, and has further client reviews on G2. Two named penetration testers run each human-led engagement, reviewed by the team lead and an engagement partner. The team has published 18 CVEs, including CVE-2025-50674 and CVE-2024-32136, and founder Arafat Afzalzada has spent 11 years leading engagements for healthcare, financial services and government clients.
For a hospital, network and Active Directory testing follows the path Canadian attackers used: remote access and vendor accounts, lateral movement, ACL abuse, Kerberos and delegation paths to domain admin, and segmentation from clinical, imaging and device networks. Cloud work covers Entra ID app registrations, consent grants and Conditional Access gaps. Patient portals and their APIs are tested authenticated across every role for broken authorization, IDOR and business logic, and AI scribes for prompt injection and cross-patient exposure under the OWASP LLM Top 10. Phishing and vishing test the staff side.
Findings post to the PTaaS portal as they are confirmed, each with a working proof of concept, with live chat to the assigned testers and Jira and Slack integration. Retesting is included, and every report ships with an attestation letter and a verified badge. Stingrai delivers both one-time annual tests and continuous programs. Snipe, Stingrai's autonomous agent, covers web applications and their APIs, such as a patient portal: the Autonomous tier is Snipe alone, with no penetration testers, and in a Hybrid engagement Snipe and the penetration testers test together throughout.
HQ: Toronto, with a London, UK office. Delivery model: human-led or hybrid; one-time or continuous; PTaaS portal. Named testers: yes, two per human-led engagement. Retest: included. Pricing: published; US$3,000 Autonomous and US$6,800 Hybrid per assessment for one web application and its APIs, or US$650 and US$1,275 per month on 12-month plans. Accreditations: CREST Penetration Testing at firm level. Strength: every claim is publicly checkable, from the CREST listing to the CVE records. Limitation: a smaller bench than the national consultancies, so programs across several hospitals in one quarter need scheduling agreed early. Best for: Canadian hospitals, OHTs, health authorities, labs and digital health vendors that need named, certified penetration testers and evidence for PHIPA, Ontario Health and TGV reviews, one-time or continuous.
2. Kroll
Kroll is a global risk advisory firm headquartered in New York, with a Toronto office at 333 Bay Street. Its Toronto-based Managing Director, Krishna Raja, spent eight years performing penetration tests and building application security programs for financial, government, retail and health care organizations in Canada and the US.
HQ: New York, with a Toronto office. Delivery model: consulting-led, next to incident response and forensics. Named testers: not published. Retest: not stated. Portal: not described. Pricing: not published. Accreditations: Kroll LLC holds CREST Penetration Testing, Incident Response and SOC, and ISO 27001. Strength: the firm that tests a health system can also run the incident response and root-cause investigation the IPC expects after an attack. Limitation: no published pricing, retest terms or named testers. Best for: hospitals that want testing from the same firm as their incident response retainer.
3. NetSPI
NetSPI is headquartered in Minneapolis and lists a Canadian office in Toronto. Its medical device penetration testing combines threat modeling and testing across firmware, hardware, wireless configuration, thick client and mobile applications, sensor data, privacy and potential patient safety issues, framed against FDA premarket guidelines. It states a bench of more than 350 in-house penetration testers.
HQ: Minneapolis, with a Toronto office. Delivery model: PTaaS platform and program delivery. Named testers: not published. Retest: not stated. Portal: yes. Pricing: not published. Accreditations: CREST Penetration Testing and Threat Led Penetration Testing, with ten years of membership. Strength: device depth plus threat-led accreditation, a rare pair. Limitation: the device page is framed around FDA submissions, so Canadian evidence requirements must be written into the statement of work. Best for: medical device makers and large health systems running multi-scope programs.
4. ISA Cybersecurity
ISA Cybersecurity has its head office at 3280 Bloor Street West in Toronto, with offices in Calgary, Ottawa and London, UK, and cites more than 30 years in cyber security. It tests internal and external networks, wireless, mobile and web applications, and runs red and purple team engagements. It also sells threat and risk assessments and privacy impact assessments, and its healthcare page lists work for large Ontario hospitals.
HQ: Toronto. Delivery model: project-based, with TRA, PIA and managed detection from the same firm. Named testers: not published. Retest: not stated. Portal: not described. Pricing: not published. Accreditations: none on the CREST Marketplace. Strength: the TRA, the PIA and the test from one Canadian firm with Ontario hospital references. Limitation: no published tester credentials, retest terms or pricing. Best for: Ontario hospitals that want the TRA, the PIA and the penetration test together.
5. CGI
CGI, founded in 1976 with its head office on René-Lévesque Boulevard West in Montréal, says on its Canadian healthcare page that it works with provincial health organizations, health regions and hospitals, with 500 health IT professionals in Canada. Its continuous offensive security validation combines autonomous penetration testing with offensive security expertise and remediation support, with repeatable testing and verification of fixes.
HQ: Montréal. Delivery model: program-based consulting. Named testers: not published. Retest: fix verification described. Portal: not described. Pricing: not published. Accreditations: CGI IT UK Ltd is on the CREST Marketplace for Europe and Asia Pacific; the Canadian entity is not. Strength: scale, bilingual delivery and relationships with provincial health organizations. Limitation: the CREST accreditation sits with the UK entity, and a small clinic or vendor will not be a priority account. Best for: provincial health organizations and health regions running large programs.
6. MNP Digital
MNP Digital is the technology arm of MNP, founded in 1958 with its head office in Calgary. Its offensive security service assesses systems, internal, external and wireless networks, mobile and web applications, and people, and its healthcare practice publishes guidance for independent physicians and dentists.
HQ: Calgary. Delivery model: consulting-led, inside a national advisory firm. Named testers: not published. Retest: not stated. Portal: not described. Pricing: not published. Accreditations: none on the CREST Marketplace. Strength: a national footprint, including Alberta and the West, and an advisory relationship many practices already have. Limitation: its healthcare content targets practices rather than hospitals. Best for: physician and dental practices, clinics and western Canadian health organizations.
7. OKIOK
OKIOK is a Quebec security firm headquartered at 655 Promenade du Centropolis in Laval. It says its team performs several hundred penetration tests and vulnerability assessments a year across external, internal, web, mobile, Wi-Fi, social engineering and physical scopes, using its own Percutio methodology, and its health care page describes identity governance and cryptographic work for the transition to electronic health records, including unique identifiers for patient databases.
HQ: Laval, Quebec. Delivery model: project-based consulting, often alongside identity governance work. Named testers: not published. Retest: not stated. Portal: not described. Pricing: not published. Accreditations: none on the CREST Marketplace. Strength: a Quebec firm with health sector identity experience and a French-language site, useful where a TGV report must be delivered in French. Limitation: its health care page describes identity and data projects rather than penetration testing, and it publishes no retest terms, tester credentials or pricing. Best for: Quebec health organizations and vendors that want a local firm for testing and identity work.
8. Bulletproof
Bulletproof, part of Gaming Laboratories International since 2016, has its head office at 150 Knowledge Park Drive in Fredericton, with offices including Charlottetown and Halifax. Its testing line covers penetration testing, vulnerability and threat risk assessments, web application assessments and secure code assessments, and its healthcare page frames the offer around ransomware disrupting care, PHI exposure and audit failures.
HQ: Fredericton. Delivery model: project-based testing inside a managed IT and security business. Named testers: not published. Retest: not stated. Portal: not described. Pricing: not published. Accreditations: the Canadian entity is not on the CREST Marketplace. Strength: an Atlantic Canadian base and a long Microsoft partnership, useful for Microsoft 365-heavy organizations. Limitation: testing is one line inside a managed IT business. Best for: Atlantic Canadian health organizations that want testing alongside managed security.
9. eSentire
eSentire, founded in 2001, runs its security operations centre from 451 Phillip Street in Waterloo, Ontario, and issues its news releases from Waterloo. Atlas Preempt, its autonomous pen testing and continuous threat exposure management service, uses AI operatives to validate attack paths, sends findings to ServiceNow or Jira and re-validates fixes. Its healthcare page centres on managed detection and response.
HQ: Waterloo. Delivery model: autonomous, continuous validation inside the Atlas MDR platform. Named testers: no, AI operatives. Retest: re-validation stated. Portal: the Atlas platform. Pricing: not published for testing. Accreditations: none on the CREST Marketplace. Strength: offensive findings feed the team that runs detection and response. Limitation: not a like-for-like substitute where a verifier expects a scoped test by certified, background-checked staff, as the TGV orientation does. Best for: existing eSentire MDR customers that want continuous validation.
10. Kobalt.io
Kobalt.io operates from Vancouver, where its terms of use place the company's office, and its testers hold certifications including OSCP and GWAPT. Its health tech page offers penetration testing and code analysis for health platforms, and the firm also sells PIPEDA, HIPAA and Law 25 compliance services.
HQ: Vancouver. Delivery model: project-based, inside a compliance practice. Named testers: certifications published, individuals not named. Retest: optional, within three months at 20 percent of the original cost. Portal: not described. Pricing: published, from US$3,000. Accreditations: none on the CREST Marketplace. Strength: price transparency and speed for early-stage health tech. Limitation: compliance-first; hospital-scale Active Directory and red team work is not its focus. Best for: health tech startups that need an auditor-ready report for a first customer or a SOC 2 audit.
11. Vumetric
Vumetric, now part of TELUS, lists its Canadian headquarters at 25 York Street in Toronto and describes itself as an ISO 9001-certified platform powered by TELUS security professionals. It publishes a medical device penetration testing service covering hardware, software, network protocols and hosting infrastructure against FDA requirements, a healthcare page and a PTaaS platform with real-time progress and retest requests.
HQ: Toronto. Delivery model: project-based with a PTaaS platform. Named testers: not published. Retest: requested through the platform. Portal: yes. Pricing: quote tool, no rate card. Accreditations: ISO 9001; none on the CREST Marketplace. Strength: a published medical device practice with English and French service pages. Limitation: no firm-level CREST listing, and being part of a telecom group changes the relationship for small buyers. Best for: medical device makers selling into Canadian and US markets.
12. Packetlabs
Packetlabs is headquartered at 401 Bay Street in Toronto, with outposts in Calgary, San Francisco and Sydney. Its healthcare page covers EHR access controls, telehealth platforms and patient portals, supply chain exposure, privileged access and connected device risk, and its continuous service is described as human-led with live findings and built-in retesting.
HQ: Toronto. Delivery model: project-based and manual-led, with a continuous option. Named testers: not published. Retest: built into the continuous service. Portal: live findings on the continuous service. Pricing: not published. Accreditations: CREST Penetration Testing and AI-Enabled Penetration Testing, the CREST AI Charter and SOC 2 Type 2. Strength: a domestic headquarters with a checkable CREST listing that includes AI-enabled testing. Limitation: no published pricing or named testers. Best for: health organizations that want a CREST-listed domestic firm for EHR, telehealth and connected device scopes.
How much does healthcare penetration testing cost in Canada in 2026?
Only Stingrai's own prices here are fixed figures. An Autonomous Pentest, Snipe only and with no penetration testers, is US$3,000, and a Hybrid Pentest, where Snipe and penetration testers test together, is US$6,800, each per assessment for one web application and its APIs. The same tiers run as 12-month continuous plans at US$650 and US$1,275 per month. Every other scope, including hospital networks, Active Directory, cloud tenancies, device work and red team engagements, is quoted through get a quote; current figures are on the pricing page.
The bands below are indicative Stingrai 2026 benchmark ranges from our guide to the average cost of a penetration test in Canada, reconciled from published Canadian market pricing, covering entry to standard scope.
Healthcare scope | Indicative range (CAD) | What moves the number |
|---|---|---|
Patient portal or virtual care app and its APIs | C$5,000 to C$25,000 | Roles tested, integrations, business logic in booking and results flows |
External network, one hospital | C$8,000 to C$35,000 | Live hosts, remote access gateways, vendor entry points |
Internal network and Active Directory, one hospital | C$12,000 to C$35,000 | Sites, VLANs, clinical and device segmentation, domain trusts |
Cloud tenancy (Azure and Entra ID, AWS) | C$13,000 to C$40,000 | Subscriptions, identity complexity, managed services |
Red team across a health system | C$30,000 to C$65,000 | Objectives, vectors and duration |
Annual continuous program | C$40,000 to C$120,000 | Assets under coverage, release cadence |
In US dollars, our global penetration testing cost guide gives indicative ranges of US$5,000 to US$30,000 for a web application, US$5,000 to US$40,000 for a network test and US$10,000 to US$50,000 for cloud. Healthcare scopes sit in the upper half of each band.
Buyer checklist: 10 questions to put to a vendor
Which named penetration testers will work on our engagement, and what certifications do they hold?
Where can we verify your firm-level accreditation?
Will you test every remote access path, including vendor support accounts, and confirm multi-factor authentication on each?
How will you test lateral movement and privilege escalation in our Active Directory and any shared services domain?
How will you test segmentation between user networks and clinical, imaging and device networks, and what are the rules of engagement for live clinical systems?
Will you test our patient portal and APIs across patient, substitute decision-maker, clinician and administrator roles?
Can your report feed our PHIPA threat and risk assessment, an Ontario Health verification or a TGV submission?
Where will testers work, and where will evidence be stored?
Is retesting included, and within what window?
Can we buy both a one-time annual test and a continuous program from you, and what does each cost?
Frequently asked questions
Who are the best penetration testing companies for healthcare in Canada in 2026?
The best healthcare penetration testing companies in Canada in 2026 are Stingrai, Kroll, NetSPI, ISA Cybersecurity, CGI, MNP Digital, OKIOK, Bulletproof, eSentire, Kobalt.io, Vumetric and Packetlabs. Stingrai ranks first: a CREST-accredited penetration testing service provider headquartered in Toronto, with two named penetration testers on every human-led engagement, retesting and an attestation letter included, and published package prices, delivered one-time or continuously. Kroll, NetSPI and ISA Cybersecurity follow.
Does PHIPA require penetration testing?
No. Section 12(1) of Ontario's Personal Health Information Protection Act, 2004 requires a custodian to take steps that are reasonable in the circumstances to protect personal health information, and names no test or frequency. O. Reg. 329/04 section 6(3) requires a health information network provider to give each custodian a written assessment of threats, vulnerabilities and risks, and a penetration test report is the natural technical evidence for it. The IPC can impose administrative penalties of up to $500,000 on an organization.
Do Ontario hospitals have to run penetration tests under O. Reg. 51/26?
Not by name. O. Reg. 51/26, in force since 1 July 2026, requires Ontario's Group A, B and C public hospitals and the University of Ottawa Heart Institute to name a cyber security contact, complete a cyber security maturity assessment every two years and report critical cyber security incidents within 72 hours. The government's guidance aligns assessments with NIST CSF 2.0 and does not mention penetration testing, which is how a hospital shows its maturity scores hold up.
Which Canadian healthcare rules name penetration testing outright?
Two. Ontario Health's Virtual Visits Solution Requirements, version 3.1, require penetration tests at a minimum annually, or after a major software release or change in architecture or infrastructure, covering the application and its infrastructure (requirement 2.3.10). Quebec's TGV certification requires a test by an independent provider recognised by Santé Québec (criterion S16.03), white box, with every role tested in a production or production-equivalent environment. Manitoba's two-year safeguards audit and Quebec's yearly review of security measures do not name a penetration test.
How much does healthcare penetration testing cost in Canada?
Stingrai publishes fixed prices of US$3,000 for an Autonomous Pentest (Snipe only, no penetration testers) and US$6,800 for a Hybrid Pentest, each for one web application and its APIs, or US$650 and US$1,275 per month on 12-month continuous plans; other scopes are quoted. Indicative Canadian ranges from our cost guide run from C$5,000 to C$25,000 for a patient portal and its APIs, C$12,000 to C$35,000 for an internal network and Active Directory test, and C$40,000 to C$120,000 for an annual continuous program.
Can a US penetration testing firm test a Canadian hospital or health vendor?
Yes, for most scopes, but check three things. Quebec's TGV orientation accepts reports only from providers with legally authorized representatives in Canada, certified staff and criminal record checks, able to provide the report in French. Ontario Health's virtual visits standard requires personal health information, data and backups to be hosted in Canada, which shapes how test data is handled. And the IPC holds custodians responsible even when they rely on vendors, so the contract should say where testers work and how evidence is stored.
