Quick answer: Stingrai is a CREST-accredited penetration testing service provider headquartered in downtown Toronto, and its named two-person tester teams hold OSCE³, OSWE, OSEP, CREST CRT and CISSP. GTA engagements cover web applications and their APIs role by role, cloud including Entra ID, external and internal networks with segmentation testing, Active Directory, phishing and intelligence-led red teaming, with findings posted to the PTaaS portal as they are confirmed, included retesting, and an attestation letter that supports OSFI B-13, PHIPA and SOC 2 evidence. Other firms with verified Toronto or GTA delivery include Bulletproof, Cycura, Cyderes, ISA Cybersecurity, Kobalt.io and Kroll.
Toronto is the third-largest tech talent market in North America, ahead of New York Metro, according to CBRE's Scoring Tech Talent 2025. It is also where Canada's largest banks, insurers, pension funds and the Toronto Stock Exchange sit within a few blocks of each other, and where a dense population of health SaaS and fintech companies build on top of both. That combination is why penetration testing demand in the GTA looks different from the rest of the country: the buyer is usually answering to a named regulator, not just to a SOC 2 checklist.
The stakes have moved with it. IBM's Cost of a Data Breach Report 2025 puts the average Canadian breach at CA$6.98 million, up 10.4 percent from CA$6.32 million in 2024, with phishing-initiated breaches costing CA$7.91 million on average. Statistics Canada found that 30 percent of large Canadian businesses were hit by a cyber security incident in 2023, roughly double the 16 percent national rate, and that business recovery spending doubled to CA$1.2 billion.
What actually drives penetration testing purchases in Toronto
Four drivers cover most GTA buying, and one of them is brand new.
Figure 1: The compliance timeline behind most Toronto penetration testing purchases. Sources: OSFI, Legislative Assembly of Ontario, Government of Ontario.
OSFI Guideline B-13 (Bay Street). OSFI's Technology and Cyber Risk Management guideline came into force on January 1, 2024 and applies to every federally regulated financial institution: banks, foreign bank branches, life and property and casualty insurers, and trust and loan companies. B-13 expects institutions to regularly run tests and exercises that surface vulnerabilities or control gaps, and it names penetration testing and red teaming as the examples. It also expects regular vulnerability assessments and manual threat hunting to catch what automated tools miss. B-13 is outcome-based rather than prescriptive, so it sets no fixed cadence; independent testing is how institutions evidence that the controls work. Our guide to intelligence-led red teaming for Canadian financial institutions covers the threat-led end of this.
Ontario Regulation 51/26 (the new one). Ontario's Bill 194 received royal assent in November 2024 and enacted the Enhancing Digital Security and Trust Act. The cyber security regulation made under it, O. Reg. 51/26, took effect on July 1, 2026. In-scope organizations must designate a primary and alternate cyber security contact, conduct a cyber security maturity assessment every two years and submit a summary to the province's Chief Information Security Officer, and report critical cyber incidents within 72 hours of confirming them. It covers hospitals, colleges and universities, school boards, and children's aid societies and Indigenous child and family well-being agencies. In practical terms that is the University Health Network, Sinai Health, SickKids, the University of Toronto, Toronto Metropolitan University, York University, Seneca, George Brown, the TDSB and the TCDSB, all inside one city.
PHIPA (Ontario health). Ontario's Personal Health Information Protection Act makes health information custodians responsible for safeguards proportionate to the sensitivity of the data they hold, enforced by Ontario's Information and Privacy Commissioner. Toronto's hospital network and the health SaaS companies selling into it inherit that obligation through their contracts, which is why a health-tech vendor in Toronto is often asked for a penetration test report before a hospital will sign.
PIPEDA and customer security reviews. Federally, PIPEDA expects safeguards proportionate to sensitivity plus mandatory reporting of breaches that pose a real risk of significant harm. In practice the sharper pressure comes from enterprise procurement: a Toronto SaaS company selling to a Big Five bank will be asked for a current, independent penetration test long before a regulator asks.
The useful thing about this list is that one well-scoped engagement produces evidence for all of it. A report with per-finding reproduction steps, severity, remediation status and a retest satisfies a B-13 examiner, an Ontario maturity assessment, a PHIPA safeguards question and a SOC 2 auditor without four separate projects.
How we evaluated firms serving Toronto
We applied five checks to every firm in this guide.
Verified Toronto or GTA delivery. A published office address in Toronto or the GTA, or a stated Ontario service footprint, confirmed on the firm's own site rather than a directory listing. Firms whose Canadian presence could not be confirmed from a primary source were dropped.
Penetration testing as a named service. The firm must productize penetration testing, not adjacent categories such as vulnerability scanning, managed detection or IT resale.
Independent credentials. Firm-level accreditation such as CREST, verified customer reviews, published CVEs and conference research, weighted over self-declared claims.
Report quality. Whether findings arrive with reproduction steps and evidence, and whether a retest is part of the engagement rather than a change order.
Current corporate status. Acquisitions matter. A firm that sold its testing practice is not a testing provider any more, however strong the brand recall.
Research pass cutoff was August 2026. Every figure in this guide links to the primary publisher that produced it, and any claim we could not trace to a named source was left out rather than estimated.
1. Stingrai
World-Class Offensive Security.
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
It is headquartered in downtown Toronto with a London, UK office and is one of only a handful of CREST-accredited firms headquartered in Canada. Every human-led engagement runs with a named two-person tester team reviewed by the team lead and an engagement partner. The team behind them holds OSCE³, OSWE, OSEP, CREST CRT and CISSP, has published 18 CVEs, and is listed in the bug bounty Halls of Fame of Apple, Google, the US Department of Defense and the US Federal Reserve; one team member was a founding member of Uber's offensive security team. Explore the PTaaS platform.
Attackers don't just run scanners, and neither does Stingrai. Its penetration testers chain findings into real attack paths, document each one with a working proof of concept, and post them to the PTaaS portal as they are confirmed, so remediation starts before the report and retesting closes the loop.
Headquartered in Toronto with a London, UK office, Stingrai serves Toronto and GTA organizations with one-time assessments and continuous testing programs.
Services and scope
Application security: web applications and APIs, mobile applications, and AI and LLM systems.
Network and cloud security: internal and external networks, Active Directory, Wi-Fi, and cloud environments.
Social engineering: phishing campaigns and physical security assessments.
Adversary simulation: red teaming and purple teaming.
Delivery and evidence
Every engagement produces prioritized remediation guidance, a redactable PDF report, retesting of fixed issues, and an attestation letter and verified badge you can put in front of an OSFI examiner, an Ontario maturity assessment, a PHIPA safeguards question or a SOC 2 auditor. The PTaaS platform gives clients findings as they are confirmed, live chat with the assigned penetration testers, Jira and Slack integration, and an executive dashboard. CREST accreditation applies to Stingrai as a penetration testing service provider; it is separate from individual tester certifications.
Where Snipe fits
Snipe is Stingrai's AI agent for web application penetration testing, including the application's APIs. It runs black-box, authenticated grey-box and white-box code review, hunts broken authorization, IDOR and business logic flaws rather than only known-class bugs, and opens AutoFix pull requests. The Autonomous package is Snipe alone; in a Hybrid engagement Snipe and Stingrai's penetration testers test the application together throughout. Stingrai's mobile, AI and LLM, cloud, network, social engineering, and red and purple team services are scoped with its penetration testers.
Pricing and fit: Published packages cover one web application and its APIs at US$3,000 for an Autonomous assessment and US$6,800 for a Hybrid one. Mobile, AI and LLM, cloud, network, Active Directory, Wi-Fi, social engineering and red team scopes are quoted individually, so request a scoped quote. Best for: Toronto and GTA organizations that want one CREST-accredited provider for the annual test a regulator, hospital or bank procurement asks for, and for continuous testing between releases.
Other firms serving Toronto and the GTA
The firms below all have verified Toronto or GTA delivery. They are listed alphabetically, not ranked. Fit depends on your scope, your regulator and whether you need testing bundled with other services, so treat this as a shortlist to scope against rather than an ordering.
Bulletproof, a GLI company
Head office in Fredericton, New Brunswick, with a GTA office at 90 Burnhamthorpe Road West in Mississauga and additional Canadian offices in Halifax, Moncton, Charlottetown and Vancouver. Part of Gaming Laboratories International, which folded Bulletproof's information systems security assessment work into its global compliance network. Offers penetration testing, social engineering, infrastructure and vulnerability assessment. The gaming and lottery compliance heritage makes it a natural fit for Ontario's regulated gaming operators, and the national footprint suits buyers with sites outside the GTA.
Cycura
Toronto-founded offensive security firm. WELL Health Technologies acquired Cycura's services division in August 2020 and now runs it as its cyber security business unit, which in 2023 added Seekintoo for managed detection and response and Proack for offensive security assessments including penetration testing, red teaming, social engineering and infrastructure testing. The health data lineage is the differentiator: if your Toronto engagement is PHIPA-driven and you want a provider whose parent company operates health technology at scale, Cycura is worth a conversation.
Cyderes
Toronto office at 180 Duncan Mill Road, with corporate offices in Kansas City. Cyderes was formed from the merger of Herjavec Group, the veteran Toronto security firm, and Fishtech Group, and runs security operations centres across the United States, Canada, the United Kingdom and India. Positioned around identity and access management, managed detection and response, and exposure management. Best considered by large enterprises that want testing to sit next to a managed detection contract and can absorb enterprise procurement cycles.
ISA Cybersecurity
Corporate office at 3280 Bloor Street West in Toronto, with more than 30 years in the Canadian market. Penetration testing sits inside its Assure 360 line and covers internal, external and wireless testing, mobile and web application testing, and red and purple teaming. ISA is also an OECM supplier partner, which matters if you are an Ontario college, university or school board. A reasonable fit for Ontario buyers who want assessment work and managed detection from the same vendor.
Kobalt.io
Headquartered in Vancouver and founded in 2018, serving clients across North America including Ontario. Penetration testing sits in its Trust line alongside tabletop exercises and incident response planning, next to compliance work for SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS, and a vCISO service. Note that delivery to Toronto is remote rather than from a local office. A sensible option for an early-stage company pairing a first penetration test with a compliance program, less so for internal network or physical scopes that benefit from someone in the building.
Kroll
Kroll acquired Toronto-headquartered Security Compass Advisory on December 15, 2021, and with it red team, penetration testing and cloud security capability, including close to 100 certifications tied to AWS, Azure and offensive security. If your requirement pairs offensive testing with incident response, forensics or a breach retainer, Kroll's scale is the argument. This acquisition is also the reason many Toronto buyers still search for Security Compass and cannot find a testing service: Security Compass itself no longer sells penetration testing. The Toronto company now focuses on its SD Elements software, which generates security requirements before code is written. Both are legitimate businesses; only one of them will run a test for you.
How Ontario public sector buyers procure penetration testing
Ontario colleges, universities, school boards, hospitals, municipalities and community services organizations have a shortcut that private-sector buyers do not: a pre-qualified supplier agreement that removes the need for a competitive process. OECM, the Ontario Education Collaborative Marketplace, holds a re-tendered Vulnerability Assessment and Penetration Testing Services agreement that covers vulnerability assessment, network penetration testing, web application and application penetration testing, and social engineering testing.
Seven suppliers were awarded onto it: 3Tenets Consulting, BDO Canada, Bell Canada, CDW Canada, Computacenter Canada, IBM Canada and iVedha. The agreement runs to January 30, 2027 with no extension options remaining, which is worth noting if your maturity assessment cycle under O. Reg. 51/26 runs past that date. Buying through OECM shortens procurement considerably; running your own process gives you a wider field, including firms that are not on the agreement. Both routes are legitimate, and the deciding factor is usually how much time you have before the assessment is due.
What a penetration test costs in Toronto
Toronto pricing tracks the national picture, because most GTA providers quote against the same scope units. Our Canadian cost guide reconciles published market ranges into entry, standard and complex bands for each engagement type.
_Figure 2: Typical 2026 penetration testing price spans for Toronto buyers by engagement type, in CAD, with the standard scope band highlighted. Source: Stingrai Canadian penetration testing cost guide, anchored to published 2025 Canadian market pricing._
What moves a quote between bands is scope, not postal code: authenticated roles and business logic depth for applications, host count and segmentation for networks, account count and IAM complexity for cloud, and whether a retest and compliance-mapped reporting are included. A proposal without a retest is incomplete, because the artifact your auditor actually wants is evidence that the findings were fixed.
How to choose a penetration testing company in Toronto
Confirm the firm actually delivers from or into Toronto. Several nationally marketed providers list a Toronto address that resolves to a virtual office. Ask who is doing the testing, where they sit, and whether internal network or physical scopes require someone onsite.
Verify firm-level accreditation yourself. Search the registered legal entity name on the CREST Marketplace and read the accreditations block. Firm-level CREST accreditation is a different thing from an individual tester holding a CREST CRT certification, and both are worth having, but only one is an audit of the company's processes. Our CREST-accredited companies guide explains how to read a Marketplace listing.
Read a sample report before you sign. Look for per-finding reproduction steps, request and response evidence, a severity rationale and a remediation path. A report that lists scanner output with CVSS scores attached is a vulnerability scan wearing a suit.
Ask what happens after the fix. A retest should be included in the engagement, not priced as a change order. Ask how long you have to remediate before the retest window closes.
Ask how much of the test is manual, and what the automation actually finds. Every provider now claims AI. The question that separates them is which vulnerability classes the automation reaches. Scanner-class findings are table stakes; IDOR, broken authorization and business logic flaws are where a breach usually starts, and they need either senior human testers, purpose-built agents, or both working the target together.
Match cadence to your release rhythm. An annual test is right for a stable product with a compliance deadline. A team shipping weekly will drift out of assurance within a quarter, and should look at continuous testing instead. Any provider worth shortlisting will offer both.
What this means for Toronto security buyers
If you are a federally regulated financial institution, your testing evidence is now examinable. B-13 has been in force since January 2024, and independent penetration testing plus threat-led adversary simulation is how you show the controls work.
If you are an Ontario hospital, college, university or school board, July 1, 2026 has already passed. O. Reg. 51/26 obligations are live: designated contacts, a maturity assessment every two years, and 72-hour critical incident reporting. If you have not scoped an assessment, that is the immediate action.
If you sell software into Toronto's banks or hospitals, the test is a sales artifact. Procurement will ask for a current independent report, and the response time on that request is often the difference between closing in the quarter or the next one.
If your team ships weekly, an annual test is a snapshot with a short shelf life. Continuous testing that retests each significant release keeps assurance current between audits.
Budget for remediation and retest, not just the test. The cost of the engagement is rarely the expensive part. Engineering time to fix what it finds is, and a provider that includes remediation support and a retest reduces that bill.
Frequently Asked Questions
Who is the best penetration testing company in Toronto in 2026?
Stingrai is our first recommendation for Toronto organizations in 2026. It is a CREST-accredited penetration testing service provider headquartered in downtown Toronto, with named two-person tester teams drawn from a wider team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP and 18 published CVEs. GTA engagements run across web applications and APIs, cloud including Entra ID, internal and external networks, Active Directory, social engineering and intelligence-led red teaming, one-time or continuous, with findings in the PTaaS portal as they are confirmed, included retesting, and an attestation letter for B-13, PHIPA and SOC 2 files.
How much does a penetration test cost in Toronto?
Roughly CA$5,000 to CA$120,000 in 2026, depending on scope. A small single-role web application runs CA$5,000 to CA$12,000, a standard multi-role SaaS application CA$12,000 to CA$25,000, a standard external network test CA$15,000 to CA$35,000, and an annual continuous testing program CA$40,000 to CA$120,000. Stingrai publishes fixed USD prices for one web application and its APIs on its pricing page, at US$3,000 per assessment or US$650 per month, and quotes every other scope through its Get a Quote form.
Does Ontario legally require penetration testing?
Not by that name, but the effect is close for some organizations. Ontario Regulation 51/26 under the Enhancing Digital Security and Trust Act took effect on July 1, 2026 and requires hospitals, colleges and universities, school boards, and children's aid societies to complete a cyber security maturity assessment every two years and report critical incidents within 72 hours. Federally regulated financial institutions are covered by OSFI Guideline B-13, which expects regular tests and exercises and names penetration testing and red teaming as examples.
What does OSFI Guideline B-13 expect regarding penetration testing?
B-13 came into force on January 1, 2024 and applies to all federally regulated financial institutions. It expects institutions to regularly perform tests and exercises that identify vulnerabilities or control gaps in their cyber security programs, naming penetration testing and red teaming as the examples, alongside regular vulnerability assessments and manual threat hunting. The guideline is outcome-based and sets no fixed cadence, so institutions define frequency by risk profile. Read the OSFI guideline directly.
Is Stingrai a Toronto penetration testing company?
Yes. Stingrai is headquartered at 1 Adelaide Street East in downtown Toronto and has a London, UK office. It is a CREST-accredited penetration testing service provider and tests web and mobile applications and their APIs, AI and LLM systems, cloud, internal and external networks, Active Directory and Wi-Fi, plus social engineering and red teaming, for clients across the GTA and beyond, delivered through its PTaaS portal with retesting included.
Which Toronto penetration testing companies are CREST-accredited?
Stingrai and Packetlabs both hold firm-level CREST accreditation and are headquartered in Toronto. Only four companies headquartered in Canada were listed on the CREST Marketplace with firm-level Penetration Testing accreditation as of August 2026, so the domestic accredited pool is small. Verify any provider's status yourself by searching its registered legal entity name on the CREST Marketplace and reading the accreditations block on its profile.
Does Security Compass still do penetration testing in Toronto?
No. Security Compass sold its Advisory business, which delivered penetration testing, red team exercises and cloud security, to Kroll on December 15, 2021. Security Compass remains a Toronto company but now focuses on its SD Elements software, which generates security requirements before code is written. If you are looking for the team that used to deliver those tests, the capability sits inside Kroll.
How do Ontario public sector organizations buy penetration testing?
Many buy through the OECM Vulnerability Assessment and Penetration Testing Services agreement, which is open to Ontario colleges, universities, school boards, healthcare facilities, municipalities and community services organizations. Seven suppliers are pre-qualified on it: 3Tenets Consulting, BDO Canada, Bell Canada, CDW Canada, Computacenter Canada, IBM Canada and iVedha. The agreement runs to January 30, 2027 with no extensions remaining. Running your own procurement is still an option and gives you a wider field of providers.
How often should a Toronto organization run a penetration test?
At least annually and after any significant change to applications, infrastructure or identity, which is also the PCI DSS cadence. Organizations releasing software frequently generally move to a continuous program that retests every significant release. Ontario public sector entities in scope of O. Reg. 51/26 have a separate two-year maturity assessment obligation that sits alongside, not instead of, technical testing.
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan is automated and reports what might be exploitable. A penetration test proves what is, by chaining findings into a demonstrated attack path with reproduction steps. Auditors and enterprise procurement teams increasingly ask for the second and reject the first. The practical test is whether the deliverable shows a tester reaching data or privileges they should not have, or just lists CVE identifiers with severity scores.
References
IBM. Cost of a Data Breach Report 2025, Canada findings. July 30, 2025. https://canada.newsroom.ibm.com/2025-07-30-IBM-Report-Canadians-Data-Security-Under-Increased-Threat,-While-Breach-Costs-Surge. Canadian cut of IBM's annual breach cost study, covering average breach cost, initial attack vectors and detection times.
Statistics Canada. Canadian Survey of Cyber Security and Cybercrime, 2023. October 21, 2024. https://www150.statcan.gc.ca/n1/daily-quotidien/241021/dq241021a-eng.htm. National survey of business cyber incident impact, recovery spending and prevention measures by business size.
Office of the Superintendent of Financial Institutions. Guideline B-13: Technology and Cyber Risk Management. In force January 1, 2024. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-risk-management. Sets OSFI's expectations for technology and cyber risk management at federally regulated financial institutions, including security testing.
Government of Ontario. Strengthening Cyber Security and Building Trust in the Public Sector. Cyber security regulation O. Reg. 51/26 effective July 1, 2026. https://www.ontario.ca/page/strengthening-cyber-security-and-building-trust-public-sector. Sets out the maturity assessment, contact designation and 72-hour incident reporting obligations for in-scope Ontario public sector entities.
Legislative Assembly of Ontario. Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024. Royal assent November 2024. https://www.ola.org/en/legislative-business/bills/parliament-43/session-1/bill-194. The statute that enacts the Enhancing Digital Security and Trust Act and amends Ontario's freedom of information legislation.
CBRE. Scoring Tech Talent 2025. 2025. https://www.cbre.com/insights/books/scoring-tech-talent-2025. Annual ranking of North American tech talent markets by labour pool size, growth, cost and quality.
OECM. Vulnerability Assessment and Penetration Testing Services agreement. Agreement expires January 30, 2027. https://oecm.ca/marketplace/vulnerability-assessment-and-penetration-testing-services/. Pre-qualified supplier agreement for Ontario education, healthcare, municipal and community services buyers.
CREST. CREST Marketplace. Accessed August 2026. https://marketplace.crest.org/. Searchable register of firm-level CREST accreditations, including Penetration Testing.
Packetlabs. Company website. Accessed August 2026. https://www.packetlabs.net/. Toronto headquarters address, service catalogue and accreditation claims.
ISA Cybersecurity. Penetration testing services. Accessed August 2026. https://www.isacybersecurity.com/services/penetration-testing/. Service catalogue for internal, external, wireless, mobile, web application and red and purple team testing.
Cyderes. Contact and office locations. Accessed August 2026. https://www.cyderes.com/contact. Published global office list including the Toronto office.
Bulletproof, a GLI company. Contact us. Accessed August 2026. https://www.bulletproofsi.com/contact-us. Published office list including the Mississauga GTA office and the Fredericton head office.
Kroll. Kroll Acquires Security Compass Advisory. December 15, 2021. https://www.kroll.com/en/about-us/news/kroll-acquires-security-compass-advisory. Announcement of the acquisition that moved Security Compass Advisory's penetration testing, red team and cloud security capability into Kroll.
WELL Health Technologies. WELL Health Completes Acquisition of Cycura's Services Division and Forms New Cybersecurity Business Unit. August 4, 2020. https://well.company/news-releases/well-health-completes-acquisition-of-cycuras-services-division-and-forms-new-cybersecurity-business-unit/. Confirms the acquisition of the Toronto firm's services division and the formation of WELL's cyber security unit.
Kobalt.io. Company website. Accessed August 2026. https://www.kobalt.io/. Vancouver headquarters, founding year and service lines including penetration testing.
Stingrai. Pricing. Accessed August 2026. https://www.stingrai.io/pricing. Published package pricing, scope and guarantee terms.
Related Reading
Best Penetration Testing Companies in Ireland (2026): Dublin, Cork and Remote Providers
Best Penetration Testing Companies in Ottawa (2026): Federal and Public Sector Providers
Best Penetration Testing Companies in Calgary (2026): Energy, Utilities and Alberta Firms
Ready to scope a penetration test in Toronto?
World-Class Offensive Security. Stingrai Inc. is a CREST-accredited penetration testing service provider, founded in 2021 and headquartered in downtown Toronto with a London, UK office. Its named two-person tester teams hold OSCE³, OSWE, OSEP, CREST CRT and CISSP, have published 18 CVEs, and are listed in the bug bounty Halls of Fame of Apple, Google, the US Department of Defense and the US Federal Reserve. For GTA scopes that means authorization and business logic testing across every user role in a banking, fintech or health SaaS application and its APIs, AWS, Azure with Entra ID and Google Cloud reviews from control plane to workload, external perimeter and internal lateral movement, Active Directory attack paths, phishing and vishing, and intelligence-led red teaming of the kind OSFI Guideline B-13 points at. Findings reach the PTaaS portal as they are confirmed, each with a working proof of concept, alongside live chat with the assigned testers, Jira and Slack push, included retesting, and an attestation letter and verified badge that feed B-13, PHIPA, O. Reg. 51/26 and SOC 2 evidence. Get a Quote or book a 30-minute discovery call to scope the services your organization needs.
