The penetration testing companies we recommend for Calgary and Alberta buyers in 2026 are Stingrai, Long View Systems, ISA Cybersecurity, Pure IT, OnSite I.T. and Lumen IT. Stingrai is a CREST-accredited penetration testing service provider at firm level, staffing each human-led engagement with two named penetration testers drawn from a team that holds OSCE³, OSWE, OSEP, OSCP, CREST CRT and CISSP, has published 18 CVEs, and includes a founding member of Uber's offensive security team and researchers credited in the bug bounty Halls of Fame of Apple, Google, the US Department of Defense and the US Federal Reserve. For Alberta energy, utility, midstream and SaaS estates that means internal network testing with lateral movement and segmentation, Active Directory attack paths from a corporate foothold toward operational systems, on-site or remote Wi-Fi assessments, authenticated web and API testing, and phishing and physical security work against head office and field locations. Findings post to the PTaaS portal as they are confirmed, each with a working proof of concept, clients chat directly with their assigned penetration testers during the test, and every human-led and hybrid engagement includes retesting of remediated findings plus an attestation letter and a verified badge. The five Alberta-based firms behind it each publish a Calgary street address on their own site and each sells penetration testing as a named service.
Alberta's private sector privacy statute is unusually blunt about what it wants. Section 34 of the Personal Information Protection Act reads in full: "An organization must protect personal information that is in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction." One sentence, no control list, and the word "penetration" appears nowhere in the Act. What decides whether your arrangements were reasonable is what a comparable Alberta organization would have done, judged after the fact by the Office of the Information and Privacy Commissioner.
Below is a ranking of the firms serving Calgary's energy producers, midstream operators, utilities, financial services companies and SaaS businesses, analysed by verified Calgary presence, testing depth, independent accreditation, fit with Alberta PIPA and the CIP Alberta Reliability Standards, operational technology coverage, remediation support and pricing transparency. We also include 2026 CAD pricing benchmarks and a buyer's checklist.
Penetration Testing Companies in Calgary at a Glance (2026)
# | Company | Calgary presence | Founded | Verifiable 2026 signal |
|---|---|---|---|---|
1 | Stingrai | Canadian incorporated, Toronto headquarters, serving Alberta remotely two hours ahead of Mountain Time | 2021 | CREST-accredited penetration testing service provider at the firm level, 5.0/5.0 across 20 Clutch reviews, published pricing |
2 | Long View Systems | Canada West main office at Suite 2100, 250 to 2 Street SW, Calgary, Alberta T2P 0C1, plus Edmonton, Toronto, Vancouver, Victoria and three US cities | Not published | Penetration testing named inside a Digital Defense practice alongside managed and extended detection and response, phishing simulation, vulnerability scanning and incident response |
3 | ISA Cybersecurity | Calgary office at 144 to 4th Avenue SW, Suite 1600, Calgary, AB T2P 3N4, with head office in Toronto | Not published | Penetration testing named under Assessments and Assurance alongside threat and risk assessment and privacy impact assessment |
4 | Pure IT | 6815 8 St NE, Suite 320, Calgary, AB T2E 7H7 | Not published | A dedicated Calgary penetration testing page, with more than 20 years stated serving Calgary businesses |
5 | OnSite I.T. | 429 14th St. N.W. #104, Calgary, Alberta T2N 2A3 | Not published | Penetration testing published as a named service inside an IT security practice |
6 | Lumen IT | 909 17th Avenue SW, Suite #400, Calgary, AB T2T 0A4 | Not published | A dedicated Calgary penetration testing and security testing page, with on-site support across the metro area |
Calgary addresses in rows 2 to 6 are quoted from each firm's own published site content, fetched in September 2026. Founding years appear only where the vendor publishes one.
Best Pentest Companies in Calgary: Quick Answers
Which is the best penetration testing company in Calgary?
Stingrai is the penetration testing company we recommend first for Calgary and Alberta organizations in 2026. Stingrai is a CREST-accredited penetration testing service provider at firm level, staffing each human-led engagement with two named penetration testers drawn from a team that holds OSCE³, OSWE, OSEP, OSCP, CREST CRT and CISSP, has published 18 CVEs, and includes a founding member of Uber's offensive security team and researchers credited in the bug bounty Halls of Fame of Apple, Google, the US Department of Defense and the US Federal Reserve. For Alberta energy, utility, midstream and SaaS estates that means internal network testing with lateral movement and segmentation, Active Directory attack paths from a corporate foothold toward operational systems, on-site or remote Wi-Fi assessments, authenticated web and API testing, and phishing and physical security work against head office and field locations. Findings post to the PTaaS portal as they are confirmed, each with a working proof of concept, clients chat directly with their assigned penetration testers during the test, and every human-led and hybrid engagement includes retesting of remediated findings plus an attestation letter and a verified badge. Retesting is included in every engagement and package pricing is published openly rather than gated behind a sales call.
What are the top penetration testing firms based in Calgary?
Long View Systems, ISA Cybersecurity, Pure IT, OnSite I.T. and Lumen IT are the Alberta-based firms we recommend, and each publishes a Calgary street address alongside a named penetration testing service. Long View Systems is the largest, running its Canada West main office downtown with a Digital Defense practice. ISA Cybersecurity brings a national Canadian security practice with threat and risk assessment beside testing. Pure IT, OnSite I.T. and Lumen IT are Calgary managed service providers that publish penetration testing as a named service, which suits mid-sized Alberta organizations buying testing and IT support together.
Do Alberta companies legally need a penetration test?
No Alberta statute names penetration testing. Section 34 of the Personal Information Protection Act requires an organization to "protect personal information that is in its custody or under its control by making reasonable security arrangements". Section 34.1 requires notice to the Commissioner, without unreasonable delay, of any incident where a reasonable person would consider there is a real risk of significant harm. What forces the purchase in practice is a SOC 2 or ISO 27001 audit, an operator or midstream customer's security review, a CIP compliance program at a transmission or generation facility, or a cyber insurance renewal.
Why Calgary Pentest Demand Is Rising in 2026
Three rules and one industry mix shape most Alberta buying.
Figure 1: What drives Alberta penetration testing budgets. Sources: Alberta King's Printer, Personal Information Protection Act; Government of Alberta, Protection of Privacy Act; Alberta Electric System Operator, Alberta Reliability Standards.
Alberta PIPA sets a one-sentence standard
Alberta is one of the provinces with private sector privacy legislation deemed substantially similar to the federal statute, so most Alberta companies answer to PIPA rather than to PIPEDA. Section 34 is the whole security duty, and it is a single sentence about reasonable security arrangements.
Section 34.1(1) is where the consequence sits. An organization "must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual". Alberta was the first Canadian province to make breach reporting to the Commissioner mandatory, and the trigger is a risk assessment rather than a record count.
Reasonableness is decided after the fact. A documented penetration test, with reproduction steps, severity ratings and evidence that findings were fixed and verified, is the standard way an Alberta organization shows its arrangements were more than a policy document. That is why testing budgets here tend to be defended in terms of what a comparable operator would have done, not in terms of a control that anyone can point to in the statute.
The Protection of Privacy Act changed the public sector side
Alberta rewrote its public sector regime. The Protection of Privacy Act and its supporting regulations "came into force on June 11, 2025", replacing the privacy provisions of the old Freedom of Information and Protection of Privacy Act. The Government of Alberta describes the Act as implementing "requirements for privacy management programs, privacy impact assessment and privacy breach reporting" and making it "mandatory for Albertans to be notified if their personal information is involved in a privacy breach". It also claims "the strictest penalties in Canada for the misuse of Albertans' personal information".
This matters well beyond government offices. Alberta public bodies include municipalities, post-secondary institutions, health authorities and the vendors that hold their data. If you sell software to any of them, their privacy management programme and privacy impact assessment obligations arrive on your desk as contract clauses and questionnaire rows.
CIP standards make vulnerability work a compliance artifact
Alberta runs its own reliability standards regime. The Alberta Electric System Operator develops proposed Alberta Reliability Standards and, in its own words, "we then recommend the Alberta Utilities Commission (Commission) approve the ARS". The published Cyber Security family runs from CIP-002 through CIP-014, plus two supplemental standards, and one identifier matters more than the others for a testing buyer: CIP-010, "Cyber Security - Configuration Change Management and Vulnerability Assessments".
Note the precision. The standard names vulnerability assessments, not penetration testing. A registered entity operating cyber assets on the Alberta Interconnected Electric System is being asked to assess vulnerabilities and manage configuration change, and a penetration test is one of the ways organizations generate the evidence and find what an assessment alone misses. Do not describe a penetration test to an auditor as CIP-010 compliance. Describe it as how you found the issues your assessment programme then has to track.
Operational technology is the scope most Calgary buyers miss
Calgary's industrial base changes what a testing scope has to reach. Producers, midstream operators and utilities run control networks, historians, remote terminal units and vendor-managed field equipment that never appear in a web application test. Those environments cannot always be tested the same way as IT, because availability is the primary safety property and an aggressive scan can be an outage.
That is why an Alberta scope conversation should separate three things: the corporate IT estate, the applications and cloud services that face customers and partners, and the operational technology environment. They need different methodologies, different scheduling, and often different testers. A supplier that offers one price for "a penetration test" without asking which of the three you mean has not understood the estate.
What testing actually finds
Stingrai's State of Penetration Testing 2026 report analysed 1,206 verified findings across 55 penetration tests. 51 of the 55 tests, or 92.7 percent, surfaced at least one High or Critical finding. Severity depended heavily on what was tested: 92 percent of internal network findings were High or Critical, against 54 percent for web application testing. Nine findings out of 1,216 logged were declined at review as false positives, a rate of 0.74 percent, and the median Critical issue was fixed in 10.5 days.
For an Alberta buyer, the second number is the useful one. An energy company that only ever tests the public web application leaves the higher-severity half of the corporate estate unexamined, before you even reach the control network.
Quick Comparison: Best Pentest Firms in Calgary
Company | Best for | Methodology | Key differentiators |
|---|---|---|---|
1. Stingrai | Energy, utility, midstream and SaaS teams that need internal network, Active Directory and Wi-Fi depth alongside application testing | Two named penetration testers per engagement, lateral movement and segmentation on internal scopes, one-time or continuous through PTaaS | Canadian incorporated; firm-level CREST accreditation; 18 published CVEs; findings in the portal as confirmed with live tester chat; retest and attestation letter included; Snipe for web applications |
2. Long View Systems | Larger Alberta organizations that want testing inside a national managed services relationship | Testing inside a Digital Defense practice with detection and response attached | Calgary Canada West main office, penetration testing plus MDR, XDR, phishing simulation, vulnerability scanning and incident response, offices across Western Canada and the US |
3. ISA Cybersecurity | Alberta buyers who need testing alongside a threat and risk assessment or privacy impact assessment | Assessment-led testing inside a national Canadian security practice | Calgary office plus Toronto head office, threat and risk assessment and privacy impact assessment named next to penetration testing, incident response in the same firm |
4. Pure IT | Calgary mid-market companies buying their first or second serious test alongside IT support | Managed IT provider with a dedicated penetration testing offering | Northeast Calgary office, a dedicated Calgary penetration testing page, more than 20 years stated serving Calgary businesses |
5. OnSite I.T. | Calgary organizations that want testing from the provider already running their helpdesk | Penetration testing published inside an IT security overview | Northwest Calgary office, testing named as a distinct service rather than bundled |
6. Lumen IT | Downtown and Beltline Calgary businesses that want fast on-site support alongside testing | Managed and co-managed IT with a security testing practice | 17 Avenue SW office, a dedicated Calgary penetration testing page, stated on-site coverage across the metro area and out to Airdrie, Cochrane and Okotoks |
How We Ranked These Companies
Every firm in this guide had to clear three eligibility gates. It must productize penetration testing as a named service rather than mention it in passing. It must have a verifiable Calgary presence, meaning a Calgary street address published on its own site, or a stated ability to deliver to Alberta buyers. And its core claims must be verifiable on its own website or in a public registry.
Ranking then weighed six criteria:
Verified Calgary presence, confirmed from a street address on the firm's own site rather than a directory listing or a city landing page.
Testing depth and range, specifically which scopes are advertised as named services, including whether operational technology is addressed at all.
Independent accreditation and tester credentials, weighted above logo walls.
Fit with Alberta PIPA, the Protection of Privacy Act and CIP vulnerability assessment expectations, including whether the firm covers internal as well as external scopes.
Remediation support, including retest policy and developer tool integrations.
Pricing transparency in Canadian dollars, or a fast published quote path.
Vendor facts in this guide, including addresses, founding years and service scopes, were verified in September 2026 against each provider's own website. Claims that could not be reached on at least one verification pass against a named primary source were dropped rather than estimated, which is why several firms that appear on other Calgary lists are absent here. Founding years appear only where the vendor publishes one. No firm in this ranking publishes a dedicated operational technology or industrial control system testing practice, which is a genuine gap in the local market and is called out again in the checklist below.
1. Stingrai (Top Rated for Alberta Buyers)
World-Class Offensive Security.
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For Alberta energy, utility, midstream and SaaS buyers, the work that matters is the corporate estate an attacker crosses first: internal network lateral movement and segmentation, Active Directory attack paths toward operational systems, Wi-Fi at head office and field sites, physical entry testing, and the web applications and APIs exposed to the internet. Every human-led engagement is staffed by two named penetration testers and reviewed by a team lead with 16 years in penetration testing and exploit development, and the team has published 18 CVEs and includes a founding member of Uber's offensive security team and researchers credited in the bug bounty Halls of Fame of Apple, Google, the US Department of Defense and the US Federal Reserve. Explore the PTaaS platform.
The methodology is what separates it from a scan. Internal network engagements chain lateral movement and privilege escalation and include segmentation testing between corporate and restricted zones, and Active Directory assessments trace ACL abuse, Kerberos and delegation paths through to domain admin. Wi-Fi assessments run on site or remotely with a Wi-Fi Pineapple. Web and API testing is authenticated across every user role, so broken authorization, IDOR and business logic abuse surface, and cloud work runs control plane to workload across AWS, Azure with Entra ID and Google Cloud.
Stingrai is Canadian incorporated, with a London, UK office alongside the Toronto head office, and serves Calgary and Alberta organizations two hours ahead of Mountain Time. It delivers both one-time annual engagements and continuous programs that test every release, and on-site work at head office or field sites is agreed during scoping.
Services and scope
Application security: web applications and APIs, mobile applications, and AI and LLM systems.
Network and cloud security: internal and external networks, Active Directory, Wi-Fi, and cloud environments.
Social engineering: phishing campaigns and physical security assessments.
Adversary simulation: red teaming and purple teaming.
Delivery and evidence
Findings appear in the PTaaS portal as they are confirmed, each with a working proof of concept and prioritized remediation guidance, so fixing starts before the report. Clients chat directly with their assigned penetration testers during the test, push findings into Jira or Slack, and receive a redactable PDF report they can share with a customer or an auditor, plus an attestation letter and a verified badge. Retesting of remediated findings is included rather than sold afterwards as a change order. For an Alberta buyer that record is the documentation behind the reasonable security arrangements PIPA section 34 expects, and it feeds the configuration change management and vulnerability assessment cycle CIP-010 runs on, alongside SOC 2, ISO 27001 and PCI DSS 4.0 programs. CREST accreditation applies to Stingrai as a penetration testing service provider at firm level; it is separate from the individual CREST CRT certifications its testers hold.
Where Snipe fits
Snipe is Stingrai's autonomous AI agent for web application penetration testing, including the application's APIs. It runs a swarm of specialized agents across recon, authentication, access control, business logic and injection, hunting the IDOR and broken authorization classes generic scanners miss, and it opens AutoFix pull requests for confirmed vulnerabilities and can gate merges as a required check. The Autonomous package is Snipe alone, with no penetration testers assigned; the Hybrid package puts Snipe and Stingrai's penetration testers on the same application throughout the test, with the testers directing where it digs. Mobile, AI and LLM, cloud, network, Active Directory, Wi-Fi, social engineering, and red and purple team work is human-led.
Pricing and fit: The published Autonomous and Hybrid packages, US$3,000 and US$6,800 per assessment, cover one web application and associated APIs; network, cloud, mobile, Active Directory, social engineering and red team scopes are quoted. Best for Alberta energy, utility, midstream and SaaS teams that want a Canadian-incorporated, CREST-accredited firm with named penetration testers, internal network and Active Directory depth, and on-site Wi-Fi and physical testing available, as an annual engagement or a continuous program.
2. Long View Systems
Long View Systems publishes its Canada West main office on its contact page as Suite 2100, 250 to 2 Street SW, Calgary, Alberta T2P 0C1, alongside offices in Edmonton, Toronto, Vancouver, Victoria, Dallas, Denver and Houston. It does not publish a founding year there.
Penetration testing is a named service inside its Digital Defense practice, which also covers managed detection and response, extended detection and response, user monitoring and alerting, cloud security, compliance services, phishing simulation and education, vulnerability scanning, dark web assessment, cybersecurity assessment, and incident response and forensics. The firm's services navigation separately lists PCI DSS, ISO 27001 and SOC reporting work under security, compliance and risk.
For a large Alberta organization, the practical argument is coverage. A downtown Calgary main office plus Edmonton, Vancouver and three US cities means the same supplier can reach sites across Western Canada and the US energy corridor without subcontracting.
Pros
The largest Alberta-headquartered option in this ranking, with a downtown Calgary main office.
Testing next to detection and response, so findings can flow into a team already watching the estate.
Western Canada and US coverage from one supplier, useful for operators with assets on both sides of the border.
Compliance work in the same house, including PCI DSS, ISO 27001 and SOC reporting.
Cons
Managed services are the centre of gravity. Confirm which team is assigned and what proportion of the engagement is manual offensive work.
No published firm-level testing accreditation, founding year or pricing.
No published operational technology testing practice, so a control network scope needs a separate conversation.
Best for: Larger Alberta organizations that want penetration testing inside a national managed services relationship with detection and response attached.
3. ISA Cybersecurity
ISA Cybersecurity publishes a Calgary office on its contact page as 144 to 4th Avenue SW, Suite 1600, Calgary, AB T2P 3N4, alongside a Toronto head office, an Ottawa office and a London, UK office. It does not publish a founding year there.
Its service navigation places penetration testing under Assessments and Assurance, directly beside threat and risk assessment, privacy impact assessment and vulnerability management, with governance, risk and compliance, threat protection, and detection, response and recovery practices around it. That grouping is directly useful in Alberta, because the Protection of Privacy Act names privacy impact assessments explicitly for public bodies, and a supplier that can deliver the assessment and the technical evidence together keeps one narrative in front of the Commissioner.
Pros
Privacy impact assessment and threat and risk assessment named alongside testing, which matches the artifacts Alberta public bodies and their vendors now have to produce.
A real Calgary office plus national coverage, which suits organizations with sites in more than one province.
Incident response capability in the same firm, so a finding that turns into an incident does not need a new supplier.
Canadian owned and operated, which shortens the data residency conversation under PIPA.
Cons
Assessment-led rather than testing-first. Ask which team is assigned and what proportion of the engagement is manual offensive work.
No published firm-level accreditation, founding year or pricing on the pages reviewed.
No published operational technology testing practice.
Best for: Alberta organizations, especially public bodies and their suppliers, that want penetration testing alongside a privacy impact assessment or threat and risk assessment.
4. Pure IT
Pure IT publishes its address as 6815 8 St NE, Suite 320, Calgary, AB T2E 7H7, and states it has been "Serving Calgary businesses for over 20 years". It does not publish a founding year.
Its Calgary penetration testing page sells testing as a distinct engagement rather than a bundled add-on, alongside managed IT, breach recovery services and co-pilot consulting. The firm states a Channel Futures MSP 501 ranking, Microsoft Solutions Partner and Sophos Platinum Partner status, and an A+ Better Business Bureau rating for Alberta.
For a mid-sized Calgary company without an internal security team, the draw is proximity and continuity: the people who find the finding know the environment, and remediation does not stall waiting for a third party to be briefed. That is also the trade-off, because a supplier testing an environment it also operates needs a documented separation of duties.
Pros
A long-standing Calgary presence, stated at more than 20 years.
Testing sold as its own engagement, with a dedicated Calgary page rather than a line in a bundle.
Breach recovery capability, so an escalation has somewhere to go.
Partner credentials published, which is a reasonable proxy for delivery maturity in the mid-market.
Cons
Managed IT is the core business, so for deep offensive work a testing-first firm will go further.
Independence question. If the same supplier operates the environment, define separation of duties and reporting lines in writing.
No published firm-level accreditation, founding year or pricing.
Best for: Calgary mid-market companies buying their first or second serious penetration test alongside managed IT support.
5. OnSite I.T.
OnSite I.T. publishes its address as 429 14th St. N.W. #104, Calgary, Alberta T2N 2A3. It does not publish a founding year.
Penetration testing sits as a named service inside its IT security overview, alongside the managed IT services that make up the rest of the catalogue. The proposition is straightforward: a northwest Calgary office, a published testing service, and a team already on site for other work.
Pros
A published Calgary street address and a named testing page, so both eligibility gates are met in one click.
Northwest Calgary base, convenient for organizations outside the downtown core.
Testing named separately rather than folded into a security bundle.
Local delivery, so on-site elements do not carry travel.
Cons
Thin published detail on scope and methodology. Define web, mobile, network and cloud coverage in the statement of work.
Managed IT centre of gravity, with the same independence question as any provider testing its own environment.
No published firm-level accreditation, founding year or pricing.
Best for: Calgary organizations that want penetration testing from the provider already running their IT, with a local office nearby.
6. Lumen IT
Lumen IT publishes its office location as 909 17th Avenue SW, Suite #400, Calgary, AB T2T 0A4, and states on-site coverage across the metro area including downtown Calgary, the Beltline and Kensington, plus Airdrie, Cochrane and Okotoks. It does not publish a founding year.
Its Calgary penetration testing page presents security testing as a named service alongside managed and co-managed IT. The stated business hours and after-hours support for urgent matters are worth noting for a testing engagement, because an out-of-hours test window is common for organizations that cannot take availability risk during the working day.
Pros
Published on-site coverage across Calgary and the surrounding towns, which matters when part of the scope has to be done in the building.
A dedicated Calgary penetration testing page rather than a generic services list.
Co-managed IT option, useful for an internal team that wants help rather than replacement.
After-hours support stated, which helps when a test window has to sit outside business hours.
Cons
Smallest firm in this ranking. Confirm capacity, tester credentials and lead time against your audit date.
Thin published methodology detail, so define scope and reporting format in writing.
No published firm-level accreditation, founding year or pricing.
Best for: Downtown, Beltline and surrounding Calgary businesses that want testing from a local provider with fast on-site support.
National and Global Platforms Serving Calgary
Penetration testing is delivered remotely, so an Alberta buyer's shortlist is rarely limited to Alberta suppliers. These firms deliver into Calgary but are not headquartered here. They are listed alphabetically, not ranked.
Firm | Headquarters | Where it fits |
|---|---|---|
Deloitte, EY, KPMG and PwC | Calgary offices of the Canadian firms | Board-level programs where testing is one workstream inside an audit or transformation contract |
MNP | Calgary headquarters, national footprint | Large Canadian advisory firm with a cyber security and privacy practice attached to audit and consulting work |
Plurilock Security | Vancouver, British Columbia | Publicly traded Canadian supplier with a cyber adversary simulation practice covering SCADA scopes |
What Alberta Energy and Regulated Buyers Should Put in the Statement of Work
Reading Alberta PIPA, the Protection of Privacy Act and the CIP standards together produces a short, concrete checklist.
Split the estate into three scopes. Corporate IT, customer-facing applications and cloud, and operational technology. Price and schedule them separately. A single line item called "penetration test" hides the scope that matters most at a producing asset.
Cover both directions on the IT side. External testing of internet-facing systems plus internal testing from inside the boundary. Internal findings skew far more severe.
Be precise about CIP. CIP-010 is titled configuration change management and vulnerability assessments. Do not present a penetration test as CIP compliance. Present it as how you find the issues your assessment programme then tracks, and say so in the report's scope statement.
Ask what happens on an availability-sensitive network. For control systems, agree in advance what is passive, what is active, what is done on a test bench, and who has authority to stop.
Document tester qualification. Firm-level accreditation such as CREST, plus named individual certifications such as OSCP, OSWE and CREST CRT on the assigned testers, is the cleanest way to evidence competence to a commissioner, an auditor or an operator's vendor reviewer.
Retest, record the outcome and keep the artifacts. Scope documents, methodology, findings with reproduction steps, severity ratings, remediation status and retest results are the package that answers a section 34 reasonableness question after an incident.
Buyers scoping this for the first time will find our guide to penetration testing versus vulnerability assessment useful, because CIP-010 asks for one of them by name and Alberta PIPA asks for neither.
How Much Does a Penetration Test Cost in Calgary?
Your city does not change the price. Penetration testing is delivered remotely, so a Calgary client's cloud environment is tested the same way a Toronto client's is, and the national CAD bands apply. The genuine regional variables are on-site work and operational technology: a facility walk-through at a compressor station, a plant floor assessment or testing scheduled around a turnaround adds travel, escorting and coordination.
Figure 2: Typical 2026 price spans by engagement type in Canadian dollars. Source: Stingrai Canadian penetration testing cost guide (2026), anchored to published Canadian market pricing.
Calgary Pentest Pricing Benchmarks (2026)
Engagement type | Entry scope | Standard scope | Complex scope |
|---|---|---|---|
Web application | CA$5,000 to 12,000 | CA$12,000 to 25,000 | CA$25,000 to 40,000+ |
API | CA$8,000 to 15,000 | CA$15,000 to 25,000 | CA$25,000 to 40,000 |
Mobile (per platform) | CA$10,000 to 18,000 | CA$18,000 to 30,000 | CA$30,000 to 45,000 |
External network | CA$8,000 to 15,000 | CA$15,000 to 35,000 | CA$35,000 to 50,000+ |
Internal network | CA$12,000 to 20,000 | CA$20,000 to 35,000 | CA$35,000 to 50,000+ |
Active Directory | CA$15,000 to 25,000 | CA$25,000 to 35,000 | CA$35,000 to 50,000+ |
Cloud (IaaS and PaaS) | CA$13,000 to 25,000 | CA$25,000 to 40,000 | CA$40,000 to 65,000+ |
Red team | CA$30,000 to 45,000 | CA$45,000 to 65,000 | CA$65,000 to 80,000+ |
Annual continuous program | CA$40,000 to 60,000 | CA$60,000 to 90,000 | CA$90,000 to 120,000+ |
Operational technology and industrial control system assessments are quoted individually and typically sit above the equivalent IT scope, because the work has to be scheduled around production and often runs partly on site.
Stingrai publishes its package pricing openly on the pricing page: an Autonomous Pentest driven by Snipe is US$3,000 as a one-time engagement or US$650 per month on a continuous plan for one web application and associated APIs, and a Hybrid Pentest that adds certified penetration testers is US$6,800 one-time or US$1,275 per month, with Enterprise scoped on request. A fuller CAD breakdown by engagement type sits in our guide to the average cost of a pentest in Canada.
Want a firm number for your scope? Get a free 24-hour quote from Stingrai. No sales-call gatekeeping required.
How to Choose a Penetration Testing Company in Calgary
Whether you are a downtown producer, a Foothills midstream operator or a Calgary SaaS company, the same six checks separate a useful engagement from an expensive PDF.
Check firm-level accreditation, then check the people. CREST accreditation held by the firm answers the qualified-party question an auditor will ask. Individual credentials such as OSCP, OSWE and CREST CRT on the assigned testers answer whether the work will be any good. Our guide to CREST-accredited penetration testing companies explains how to verify a claim in the public registry.
Verify the Calgary presence yourself. Open the contact page and look for a street address and a postal code. A provider that genuinely operates in Calgary will publish one; a city landing page will not.
Name the operational technology scope, or exclude it explicitly. Silence in a statement of work becomes an argument later. If control networks are out of scope, say so in writing.
Insist on manual validation. Automated scanners miss business logic flaws, IDOR and chained exploits, which are the defects behind most reportable privacy breaches. Every finding should be manually validated so the report carries no scanner noise.
Confirm the retest policy in writing. Ask whether retesting is included in the fee, how long the window is, and whether the retest result appears in a document you can hand a commissioner or an auditor. Stingrai includes retesting in every engagement.
Check developer integration and reputation. Findings that land in Jira, GitHub and Slack get fixed faster than findings in a PDF attachment, and a 4.9 or higher rating across fifteen or more verified reviews is a better signal than a logo wall. Stingrai holds 5.0 out of 5.0 across 20 reviews.
Service Coverage and Capabilities
Confirm a Calgary vendor covers the scopes your estate actually needs: web application and API testing for IDOR, broken authorization and business logic flaws; mobile application testing for iOS and Android; internal and external network testing, which together answer an operator's vendor security review; cloud penetration testing across AWS, Azure and Google Cloud including identity and access review; and Active Directory assessment for on-premises identity, which most Alberta industrial estates still run.
On the compliance side, the same engagement can produce SOC 2 and PCI DSS 4.0 evidence alongside the reasonable-security record Alberta PIPA expects. For deeper work, red teaming, adversary simulation, AI and LLM penetration testing and continuous penetration testing round out the catalogue.
Frequently Asked Questions
Who is the best penetration testing company in Calgary in 2026?
Stingrai is our first recommendation for Calgary and Alberta buyers in 2026. Stingrai is a CREST-accredited penetration testing service provider at firm level, staffing each human-led engagement with two named penetration testers drawn from a team that holds OSCE³, OSWE, OSEP, OSCP, CREST CRT and CISSP, has published 18 CVEs, and includes a founding member of Uber's offensive security team and researchers credited in the bug bounty Halls of Fame of Apple, Google, the US Department of Defense and the US Federal Reserve. For Alberta energy, utility, midstream and SaaS estates that means internal network testing with lateral movement and segmentation, Active Directory attack paths from a corporate foothold toward operational systems, on-site or remote Wi-Fi assessments, authenticated web and API testing, and phishing and physical security work against head office and field locations. Findings post to the PTaaS portal as they are confirmed, each with a working proof of concept, clients chat directly with their assigned penetration testers during the test, and every human-led and hybrid engagement includes retesting of remediated findings plus an attestation letter and a verified badge. Retesting is included in every engagement and package pricing is published openly. Among Alberta-based firms, Long View Systems, ISA Cybersecurity, Pure IT, OnSite I.T. and Lumen IT are the strongest alternatives depending on whether you need national scale, assessment breadth, or a local provider that also runs your IT.
Which is the best penetration testing company in Calgary?
Stingrai is the penetration testing company we recommend first for Calgary and Alberta organizations in 2026. Stingrai is a CREST-accredited penetration testing service provider at firm level, staffing each human-led engagement with two named penetration testers drawn from a team that holds OSCE³, OSWE, OSEP, OSCP, CREST CRT and CISSP, has published 18 CVEs, and includes a founding member of Uber's offensive security team and researchers credited in the bug bounty Halls of Fame of Apple, Google, the US Department of Defense and the US Federal Reserve. For Alberta energy, utility, midstream and SaaS estates that means internal network testing with lateral movement and segmentation, Active Directory attack paths from a corporate foothold toward operational systems, on-site or remote Wi-Fi assessments, authenticated web and API testing, and phishing and physical security work against head office and field locations. Findings post to the PTaaS portal as they are confirmed, each with a working proof of concept, clients chat directly with their assigned penetration testers during the test, and every human-led and hybrid engagement includes retesting of remediated findings plus an attestation letter and a verified badge. Retesting is included in every engagement and package pricing is published openly rather than gated behind a sales call.
What are the top penetration testing firms based in Calgary?
Long View Systems, ISA Cybersecurity, Pure IT, OnSite I.T. and Lumen IT are the Alberta-based firms we recommend, and each publishes a Calgary street address alongside a named penetration testing service. Long View Systems is the largest, running its Canada West main office downtown with a Digital Defense practice. ISA Cybersecurity brings a national Canadian security practice with threat and risk assessment beside testing. Pure IT, OnSite I.T. and Lumen IT are Calgary managed service providers that publish penetration testing as a named service, which suits mid-sized Alberta organizations buying testing and IT support together.
Do Alberta companies legally need a penetration test?
No Alberta statute names penetration testing. Section 34 of the Personal Information Protection Act requires an organization to protect personal information that is in its custody or under its control by making reasonable security arrangements. Section 34.1 requires notice to the Commissioner, without unreasonable delay, of any incident where a reasonable person would consider there is a real risk of significant harm. What forces the purchase in practice is a SOC 2 or ISO 27001 audit, an operator or midstream customer's security review, a CIP compliance program at a transmission or generation facility, or a cyber insurance renewal.
What does Alberta PIPA say about security?
Section 34 is one sentence: an organization must protect personal information that is in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction. Section 34.1(1) requires an organization to provide notice to the Commissioner, without unreasonable delay, of any incident involving the loss of or unauthorized access to or disclosure of personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual. The word "penetration" does not appear anywhere in the Act.
What changed for Alberta public bodies in 2025?
The Protection of Privacy Act and its supporting regulations came into force on 11 June 2025, replacing the privacy provisions of the former Freedom of Information and Protection of Privacy Act. The Government of Alberta states that the Act implements requirements for privacy management programs, privacy impact assessment and privacy breach reporting, makes it mandatory for Albertans to be notified if their personal information is involved in a privacy breach, and enforces what it describes as the strictest penalties in Canada for the misuse of Albertans' personal information. Vendors holding a public body's data inherit those expectations through contract.
Do CIP standards in Alberta require penetration testing?
Not by that name. The Alberta Electric System Operator develops proposed Alberta Reliability Standards and recommends that the Alberta Utilities Commission approve them, and the published Cyber Security family runs from CIP-002 through CIP-014 plus two supplemental standards. The relevant identifier for a testing buyer is CIP-010, titled Cyber Security - Configuration Change Management and Vulnerability Assessments. It names vulnerability assessments, not penetration testing. A penetration test is one of the ways organizations find the issues an assessment programme then has to track, and it should be described that way in a report's scope statement rather than presented as CIP compliance.
How should operational technology be scoped in an Alberta test?
Separately from IT, and explicitly. Control networks, historians, remote terminal units and vendor-managed field equipment have availability as their primary safety property, so an aggressive scan can be an outage. Agree in advance what is passive, what is active, what is done on a test bench rather than a live asset, who has authority to stop, and how the work is scheduled around production or a turnaround. If control networks are out of scope, say so in writing rather than leaving it unstated.
How much does a penetration test cost in Calgary?
Roughly CA$5,000 to CA$120,000 in 2026, depending on scope. A small single-role web application runs CA$5,000 to CA$12,000, a standard multi-role application CA$12,000 to CA$25,000, a standard external network test CA$15,000 to CA$35,000, internal network testing CA$20,000 to CA$35,000 at standard scope, and an annual continuous program CA$60,000 to CA$90,000. Operational technology and industrial control system assessments are quoted individually and typically sit above the equivalent IT scope. Stingrai publishes fixed USD prices at US$3,000 one-time or US$650 per month for one web application and associated APIs.
Do I need a Calgary based penetration tester?
Only for work that physically requires someone on site, such as a facility walk-through, badge cloning, on-site social engineering or a plant floor assessment. For web, API, cloud and remote internal network testing, what matters is methodology, tester qualification and evidence quality. Where location does matter for Alberta buyers is data residency and scheduling: ask where report data and exported evidence will be stored, and confirm the test window works around your operational calendar.
How often should an Alberta company run a penetration test?
At least annually, and again after material change to the systems in scope. That cadence lines up with what a SOC 2 or ISO 27001 auditor expects, with what an operator's vendor security review will ask for, and with the reasonableness standard Alberta PIPA applies after the fact. Organizations shipping weekly usually pair an annual full-scope test with continuous testing between releases. Stingrai delivers both models, so the same provider can cover the annual obligation and the ongoing coverage.
What do penetration tests actually find?
Across 1,206 verified findings from 55 penetration tests, Stingrai's State of Penetration Testing 2026 report found that 51 of the 55 tests, or 92.7 percent, surfaced at least one High or Critical finding. Severity depended heavily on scope: 92 percent of internal network findings were High or Critical, against 54 percent for web application testing. Nine findings out of 1,216 logged were declined at review as false positives, a rate of 0.74 percent, and the median Critical issue was fixed in 10.5 days.
References
Alberta King's Printer. Personal Information Protection Act, SA 2003, c. P-6.5. https://kings-printer.alberta.ca/documents/Acts/P06P5.pdf. Section 34 reasonable security arrangements and section 34.1(1) notification to the Commissioner where a real risk of significant harm exists.
Government of Alberta. Strengthening the protection of personal information. https://www.alberta.ca/strengthening-the-protection-of-personal-information. The Protection of Privacy Act and its regulations in force 11 June 2025, and the stated requirements for privacy management programs, privacy impact assessment and privacy breach reporting.
Alberta Electric System Operator. Alberta Reliability Standards. https://www.aeso.ca/rules-standards-and-tariff/alberta-reliability-standards/. The published Cyber Security CIP standards, the title of CIP-010, and the AESO statement that it recommends the Alberta Utilities Commission approve Alberta Reliability Standards.
Long View Systems. Contact and Digital Defense. https://www.longviewsystems.com/contact/ and https://www.longviewsystems.com/digital-defense/. The Calgary Canada West main office address, the office list, and penetration testing as a named service.
ISA Cybersecurity. Contact Us and Penetration Testing. https://www.isacybersecurity.com/contact-us/ and https://www.isacybersecurity.com/assessment-assurance/penetration-testing/. The Calgary, Toronto, Ottawa and London office addresses and the Assessments and Assurance service grouping.
Pure IT. Penetration Testing in Calgary. https://www.pureit.ca/penetration-testing-in-calgary/. The Calgary address, the dedicated testing page and the stated 20 years serving Calgary businesses.
OnSite I.T. Penetration Testing. https://www.onsiteit.ca/it-services/it-security-overview/penetration-testing. The Calgary address and penetration testing as a named service.
Lumen IT. Pen Testing Calgary. https://www.lumenit.ca/penetration-testing-calgary. The Calgary office address and the stated metro on-site coverage.
Stingrai. The State of Penetration Testing 2026. https://www.stingrai.io/blog/state-of-penetration-testing-2026. 1,206 verified findings across 55 penetration tests, the 92.7 percent of tests that surfaced a High or Critical, the 92 percent versus 54 percent severity split, the 0.74 percent false-positive rate and the 10.5 day median Critical fix.
Stingrai. Average Cost of a Pentest in Canada 2026. https://www.stingrai.io/blog/average-cost-of-pentest-canada-2026. CAD scope bands by engagement type.
Stingrai. Pricing. https://www.stingrai.io/pricing. Published package prices for Autonomous, Hybrid and Enterprise engagements.
Related Reading
Ready to scope a Calgary penetration test?
Alberta PIPA asks for reasonable security arrangements and gives you no control list to hide behind, the Protection of Privacy Act put privacy management programs and breach reporting on every public body in the province, and CIP-010 wants vulnerability assessments your programme can actually evidence. Stingrai is a Canadian, CREST-accredited penetration testing service provider that covers internal and external scopes in one engagement, includes retesting, and publishes its prices. Book a Free Scoping Call, Get a Quote, or see pricing.
