Top Penetration Testing Companies for TGV Certification in Quebec (2026)

Santé Québec's register of certified technology products, in its October 2026 edition, carries 95 dated listings, 28 of them obtained in 2026. For any product that uses personal, health or social services data, the Bureau de certification calls the penetration test "un prérequis à l'obtention de la certification Trousse globale de vérification (TGV)", and its orientation states that the bureau "acceptera les résultats des tests d'intrusion ou tests de pénétration provenant uniquement d'un prestataire de service répondant minimalement aux exigences suivantes" (will accept penetration test results only from a provider that meets, at minimum, the following requirements). Six conditions follow, and the bureau publishes no list of the firms that meet them.

Quick answer. The top penetration testing companies for TGV certification in 2026 are Stingrai, OKIOK, GoSecure, Commissionnaires du Québec, NCC Group, Groupe CyberSwat, ISA Cybersecurity, Cyology Labs, EliteSec and SecuredNet. Stingrai ranks first: a Toronto-headquartered, CREST-accredited firm that performed the TGV-scoped penetration test for Bia Education, a Quebec healthtech platform. Its TGV engagements are scoped to the bureau's conditions: Canadian-based delivery, certified and background-checked testers, white box testing in production or a production-equivalent environment, and a report deliverable in French to the bureau at no cost with the client's agreement. There is no public list of providers the bureau recognises, so this ranking assesses what each firm publishes against the bureau's six conditions; it is not a list of Bureau-recognised firms. Confirm your provider with the bureau at certification@sante.quebec before you sign.

What makes a provider acceptable for TGV

Criterion S16.03, in the security domain of the criteria list dated 24 April 2026, reads: "Soumettre votre application à un test d'intrusion administré par un prestataire indépendant et reconnu par Santé Québec" (submit your application to a penetration test administered by an independent provider recognised by Santé Québec). The bureau's orientation on penetration tests says the tests "doivent être réalisés par des prestataires de services indépendants", then lists six minimum conditions under the heading "Caractéristiques des prestataires de services (firmes) autorisés par le BCH".

There is no public list. Neither the orientation nor the bureau's pages on Québec.ca name recognised firms. The orientation sets out the conditions "pour l'aider dans son choix de prestataire de service" (to help the supplier choose its provider), which leaves the choice with the supplier.

How to confirm a provider. Send the bureau, at certification@sante.quebec, the provider's legal name, its Canadian representatives, the certifications of your testers, its background-check capability and its commitment to a French report, and get written confirmation before you sign. The application form asks for the "Nom de la firme ayant réalisé le test", so the firm's name goes on your file either way.

The verifier is not the tester. The bureau's About page assigns verification to "une firme externe spécialisée", over 30 business days and under the bureau's supervision. That firm reviews your test report; the testing provider is a separate firm you hire.

What drives the TGV penetration test

The scope rules, the eight report elements and the remediation deadlines are covered in our TGV penetration test checklist and in the French guide to the test.

What mid-market and enterprise suppliers need from a TGV provider

• A contracting entity that answers condition 1. A contract with a US or European company does not settle "représentants légalement autorisés au Canada"; name the Canadian entity.

• A French report for the bureau. For teams that do not work in French, condition 5 is easy to overlook; put the French version in the contract.

• Named, certified testers with background checks. Testers are "appelés à accéder à de l'information extrêmement sensible", which is why condition 3 exists.

• Scale across products and versions. Certification attaches to "une version d'un produit", so each product and major version needs a provider that repeats the same method; our renewal guide covers what a change triggers.

• An audit calendar that works. A one-time annual test timed to the anniversary suits most suppliers; frequent releasers may prefer a continuous program.

For wider lists of firms testing health technology, see our healthtech ranking and Canadian healthcare ranking.

How this ranking was built

Every vendor fact comes from the firm's own website, and CREST status from marketplace.crest.org, all checked on 13 October 2026. Firms were weighed on six criteria together:

1. Gate: a Canadian office stated on the firm's own site, and penetration testing named as a service.

2. Evidence for condition 2: named tester certifications or CREST accreditation.

3. Coverage of TGV surfaces: web and API, mobile, cloud and AI testing.

4. TGV or Quebec health work described on the firm's own pages.

5. French-language service.

6. Capacity for multi-product, mid-market and enterprise programs.

"Not stated" means the firm's own pages are silent, not that it cannot meet the condition, and nothing here is a judgment by the bureau. Readiness consultancies that coordinate rather than perform the test were not ranked.

What each firm publishes against the six conditions

Among the ten firms, only Stingrai's site states, for TGV work, background-checked testers (condition 3), a French report to the bureau at no cost (condition 5) and testing in production or a production-equivalent environment (condition 6). NCC Group, ISA Cybersecurity and Cyology Labs cite security clearances, quoted in their entries, which are not the criminal background evidence the orientation names. Condition 4 is a contract term for every firm; EliteSec ("No outsourcing") and SecuredNet ("0% outsourcing") address subcontracting, and Stingrai's social engineering and physical security pages say it uses "its own penetration testers rather than subcontracting".

1. Stingrai (top rated for TGV penetration testing)

Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.

Stingrai performed the TGV-scoped penetration test for Bia Education, a Quebec healthtech platform, as part of its certification. The published case study records the client's goal as "Penetration testing to certify our app for a cybersecurity requirement", six vulnerabilities identified and "a communication system for retesting", from December 2025 to January 2026.

Engagements are scoped to the bureau's conditions: Canadian-based delivery, certified and background-checked testers, white box testing in production or a production-equivalent environment, full role-matrix coverage, and a report structured around the orientation's eight elements, deliverable in French to the bureau at no cost with the client's agreement. Firm recognition itself is confirmed by the supplier with the bureau before the engagement begins, and Stingrai provides whatever the bureau asks for to support that confirmation.

The CREST accreditation is held by Stingrai Inc, the company that signs the contract (Marketplace profile), one of four CREST Penetration Testing head offices in Canada as of 13 October 2026 (CREST-accredited companies in the USA and Canada). Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team, and Stingrai is rated 5.0 out of 5 on Clutch (20 reviews).

• Scope: the web application and APIs tested role by role, mobile clients against OWASP MASVS and MASTG, AI and LLM components and the cloud environment behind them.

• Evidence: every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, on one-time annual tests and continuous programs alike, with a working proof of concept and remediation guidance. Retesting is included, and every human-led and hybrid report ships with an attestation letter.

• Cadence: a one-time annual test timed to the certification anniversary, or a continuous program that tests every release.

• Where Snipe fits: for the web application and associated APIs only, Snipe, Stingrai's autonomous AI agent, works alongside the penetration testers in a Hybrid Pentest, hunting IDOR and broken authorization. Mobile, cloud, AI-layer and network testing is human-led.

Pricing and fit: Stingrai's published fixed prices cover one web application and associated APIs: the Autonomous Pentest is US$3,000 per assessment or US$650 per month, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month (pricing). The Autonomous Pentest has no penetration testers, and conditions 2 and 3 concern the testing staff, so a TGV test is scoped as human-led or hybrid and quoted through get a quote. Best for: suppliers, in Canada or abroad, that want one CREST-accredited Canadian firm to run the white box, role-by-role S16.03 test and hand the bureau a French report, annually or continuously.

2. OKIOK

OKIOK's history page dates the company to 1973, and its head office is in Laval, Quebec. Its health care page names "health network suppliers" among its clients and lists "Penetration tests required for TGV certification" and "Preparation and support for TGV certification". Its penetration testing page reports "2,500+ tests performed", covers web application and API, mobile, cloud and LLM-powered application testing, and lists OSCP, OSCE, OSEP, OSWE, GPEN, GWAPT, CRTO, CEH and CISSP among "Credentials held across the team".

Best for: suppliers that want a Quebec firm already selling TGV tests and TGV preparation.

3. GoSecure

GoSecure lists a Canadian headquarters in Montreal and an office in Quebec City, alongside a US headquarters in San Diego. Its penetration testing page, also available in French, refers to "the Offensive Security Certified Professional (OSCP) team at GoSecure", covers applications, networks, endpoints and social engineering, and offers "code reviews, cloud testing, SAP testing and industrial/embedded devices" on request. A Privacy Practices Assessment speaks to the privacy half of condition 2.

Best for: larger suppliers that want application testing, code review and cloud coverage from a Montreal-based team.

4. Commissionnaires du Québec

Commissionnaires du Québec, a non-profit in security services since 1925, lists its head office in Montreal and offices in Quebec City, Trois-Rivières, Saguenay and Sherbrooke. Its Law 25 and TGV page offers TGV certification support that can include "la réalisation de tests d'intrusion et l'accompagnement dans la correction des vulnérabilités identifiées". Its penetration testing page covers internal and external networks, "web, mobile, or SaaS applications", cloud systems, social engineering and physical testing by "Certified professionals using industry-standard methodologies such as OWASP, NIST, and PTES", without naming a certification.

Best for: Quebec suppliers that want TGV readiness support and the test, in French, from one organization.

5. NCC Group

NCC Group's office locations page lists a Waterloo, Ontario office and its global headquarters in Manchester. Its penetration testing page covers "web and mobile applications", cloud security assessments and "Artificial Intelligence Testing", and its technical assurance page names "CHECK, CREST, and OSCP certified consultants, plus testers cleared to SC and DV levels". Its CREST Marketplace entry lists ten accreditations, including Penetration Testing, under a United Kingdom head office, so ask which entity would sign a Canadian contract.

Best for: enterprise suppliers that already use a global testing firm and want its Canadian office on the contract.

6. Groupe CyberSwat

Groupe CyberSwat lists offices in Quebec City and Montreal and runs a French site with an English version. Its TGV page describes readiness support in three phases (preparation, verification, then decision and follow-up) for health technology suppliers, without mentioning the penetration test. Its penetration testing page offers web, application and API, internal, external and Wi-Fi tests, and its why-us page names "CISSP, CISA, CCNA, OSCP" among the team's certifications.

Best for: smaller Quebec suppliers that want TGV readiness coaching in French, with testing as a separate service.

7. ISA Cybersecurity

ISA Cybersecurity's About page says it was "Founded in 1992, by Rick Uhrich, Neil Baker and Brian Gibson in Toronto, Ontario", and its contact page lists Toronto, Calgary and Ottawa offices. Its assessment and assurance page lists CISSP and CISM and cites consultants with "Top Secret," "Secret" and "Reliability" clearance levels. Its penetration testing page covers internal, external and wireless tests, "iOS and Android mobile applications and service APIs", web applications, and red and purple team engagements, and it runs a healthcare sector page.

Best for: suppliers with Ontario operations that want a long-established Canadian firm for web, mobile and API testing.

8. Cyology Labs

Cyology Labs calls itself, on its About page, "a nationally recognized Canadian cybersecurity firm headquartered in Montreal" and "certified under the Controlled Goods Program (CGP) authorized by Public Services and Procurement Canada". Its home page says client environments are "evaluated by professionals cleared to work with sensitive and controlled information"; ask separately for criminal background evidence. Its penetration testing page centres on internal and external infrastructure testing on a platform for monthly or on-demand assessments, lists web application testing, and cites experts "holding certifications ranging from CISSP, eCPPT, OSCP, OSCE, CEH, and more".

Best for: suppliers whose hosting infrastructure is a large part of the scope.

9. EliteSec

EliteSec is a founder-led firm on King Street South in Waterloo, Ontario. Its penetration testing page covers web application, network, mobile, native application and cloud infrastructure testing with "5 free re-tests included with every engagement", lists "OSCP, OSWP, CISSP, CISM certified consultants" and states "All testing is performed by full-time EliteSec employees. No outsourcing." Its CREST Marketplace entry shows Penetration Testing with a Canadian head office.

Best for: mid-market suppliers that want a founder-led, CREST-accredited firm whose own employees do the testing.

10. SecuredNet

SecuredNet's About page states "Founded in 2006, SecuredNet (a.k.a. Secured Net Solutions Inc.) is a boutique cybersecurity and compliance consulting firm", based in Calgary, and its home page calls it "a PCI-listed QSA company". Its penetration testing page covers network, web application, mobile, wireless, physical and social engineering testing, red and purple teaming and code security reviews; its home page adds AI pentesting of "AI-enabled, LLM-based, and agentic applications" and "0% outsourcing", and its CREST Marketplace entry shows Penetration Testing with a Canadian head office.

Best for: suppliers that also need PCI DSS assessment and want a CREST-accredited Canadian firm.

Also considered

Two Quebec consultancies sell TGV readiness rather than testing. Sentrix's TGV service coordinates the penetration test, including "la sélection d'un prestataire au besoin", and Factero's TGV support includes "coordinating the penetration test" and "vendor selection if you don't have one". Either can manage the file, but the six conditions apply to the firm that runs the test.

What a TGV penetration test costs

Santé Québec's agreement template sets the certification cost at "15 000 $, excluant les taxes applicables", payable to Santé Québec within 30 days of the invoice for the verification stage, and the About page adds that certification costs "varient en fonction de la complexité du produit" and "ne sont pas remboursables". The penetration test is a separate cost, paid to the testing firm every year. It moves with roles, applications and APIs, mobile clients, cloud, AI components, the French deliverable and the retest; the pentest cost calculator gives a scoped range. Stingrai's published fixed prices cover one web application and associated APIs; a TGV test, which needs penetration testers who meet conditions 2 and 3, is scoped as human-led or hybrid and quoted through get a quote.

How to choose: questions to ask a TGV provider

Two cautions apply to every firm. The orientation requires "prestataires de services indépendants", so if the firm preparing your file also offers the test, ask the bureau whether it treats that as independent. And because black box testing is "non acceptée par le BCH", a quote for an unauthenticated external test does not answer S16.03.

Frequently Asked Questions

Who are the best penetration testing companies for TGV certification?

The top penetration testing companies for TGV certification in 2026 are Stingrai, OKIOK, GoSecure, Commissionnaires du Québec, NCC Group, Groupe CyberSwat, ISA Cybersecurity, Cyology Labs, EliteSec and SecuredNet, assessed on what each firm publishes against the bureau's six provider conditions. Stingrai ranks first: it performed the TGV-scoped test for Bia Education, a Quebec healthtech platform, and its reports are deliverable in French to the bureau at no cost with the client's agreement. Santé Québec publishes no list of recognised providers, so confirm your choice with the bureau before signing.

Does Santé Québec publish a list of recognised penetration testing providers for TGV?

No. The orientation sets out six minimum conditions to help the supplier choose, and neither it nor the bureau's Québec.ca pages name firms. Send your provider's details to certification@sante.quebec and get written confirmation before the engagement starts.

What are the six conditions a TGV penetration testing provider must meet?

Legally authorised representatives in Canada; a cybersecurity and privacy specialisation with certified testers; criminal background evidence for its testers; accountability for the results, subcontractors included; a French report to the bureau at no cost, with the client's agreement; and testing in production or an equivalent environment.

Can a US or European penetration testing firm run the TGV test?

The orientation does not require a Canadian head office. It requires "des représentants légalement autorisés au Canada" and the five other conditions. A foreign firm qualifies only if it meets all six; confirm the arrangement with the bureau first.

Does the TGV penetration test report have to be in French?

The provider must be able, with your agreement, to provide the report in French to the bureau at no cost. Your team can work from an English report; write the French version into the statement of work.

Is the firm that verifies my TGV file the same as the penetration testing firm?

No. Verification is done by "une firme externe spécialisée" over 30 business days, under the bureau's supervision. The penetration testing provider is a separate firm you hire, and its report is part of the evidence the verifier reviews.

How much does a TGV penetration test cost?

The test is priced by scope: roles, applications and APIs, mobile clients, cloud, AI components, the French deliverable and the retest. It is separate from the C$15,000 certification fee, excluding taxes, in Santé Québec's agreement template. Stingrai's published fixed prices cover one web application and associated APIs; because a TGV test needs penetration testers who meet conditions 2 and 3, it is scoped as human-led or hybrid (the Hybrid Pentest is US$6,800 per assessment) and quoted.

How often does the TGV penetration test have to be repeated?

At application, the form asks whether the product had a penetration test less than six months old. After certification, the attestation requires at least one test a year with an independent firm, with results and proof of fixes sent by the annual self-declaration.

Related reading

• TGV Certification in Quebec (2026)

• TGV Penetration Test Checklist (2026)

• Test d'intrusion pour la certification TGV (2026)

• Keeping TGV Certification in 2026

• TGV Certification for AI Health Tools in Quebec (2026)

• Penetration Testing Companies in Montreal and Quebec (2026)

References

1. Bureau de certification. Orientation concernant les tests d'intrusion (PDF, last modified 10 May 2024). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/orientation-tests-intrusion.pdf

2. Ministère de la Santé et des Services sociaux. Critères de vérification de la TGV, version 2026-04-24, criterion S16.03. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/liste-criteres-TGV_v2026-04-24.xls

3. Gouvernement du Québec. Orientations, procédures et documents pour la certification des produits et services technologiques (last updated 8 June 2026). https://www.quebec.ca/sante/professionnels/certification-produits-services-technologiques/orientations-procedures-documents-certification

4. Gouvernement du Québec. Certification des produits et services technologiques en santé et services sociaux (last updated 5 May 2025). https://www.quebec.ca/sante/professionnels/certification-produits-services-technologiques/a-propos

5. Bureau de certification de Santé Québec. Attestation, certification TGV (BC-D0001-01). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/BC_TGV_ATTESTATION.pdf

6. Santé Québec. Entente, certification TGV (BC-D0002-01). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/BC_TGV_ENTENTE_SQ_Fournisseur.pdf

7. Bureau de certification. Formulaire pour une demande de certification TGV (XLSM). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/Formulaire-demande-certification-tgv.xlsm

8. Bureau de certification de Santé Québec. Tableau des produits et services technologiques certifiés par familles, Octobre 2026. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/ListeDesPSTCertifiesActifs.pdf

9. CREST. CREST Marketplace supplier profiles and head office filter, checked 13 October 2026. https://marketplace.crest.org/suppliers/

10. Stingrai. Penetration Testing Services for Medical Software Company (case study). https://www.stingrai.io/case-studies/penetration-testing-medical-software

11. Vendor pages linked in each entry, checked 13 October 2026.

Talk to Stingrai

Stingrai scopes the S16.03 test to the bureau's conditions: Canadian-based delivery, certified and background-checked testers, white box testing in production or a production-equivalent environment across every role, and a report built on the eight elements, deliverable in French to the bureau at no cost with your agreement, with retesting and an attestation letter. Get a quote for your TGV scope, or see the published pricing.