Frequently asked questions

Cybersecurity is the practice of protecting an organization's systems, networks, devices, applications, and data from unauthorized access, damage, disruption, or theft. It spans technology (firewalls, endpoint protection, identity controls), processes (policies, incident response, patching), and people (training and awareness).

The goal is not to make an organization "unhackable," since no system is, but to reduce risk to an acceptable level: to make successful attacks harder, to detect them quickly when they happen, and to recover with minimal damage. Modern cybersecurity is therefore as much about resilience and response as it is about prevention.

Almost every organization now depends on digital systems to operate: email, files, finance, customer records, and cloud applications. That dependence makes those systems a target. A single ransomware incident, business email compromise, or data breach can halt operations, expose sensitive information, trigger regulatory and legal consequences, and damage trust with customers and partners.

Attackers do not only target large enterprises. Small and mid-sized organizations, non-profits, and public sector bodies are frequently hit precisely because they often have leaner defences. Cybersecurity is what keeps an incident from becoming an existential event.

See how FioSec helps

The CIA triad is the foundational model that defines what security is trying to protect. Most controls map back to one or more of these three properties:

• Confidentiality: keeping information accessible only to those who are authorized to see it (for example, through encryption and access controls).
• Integrity: ensuring data is accurate and has not been altered or tampered with (for example, through checksums, immutable backups, and change controls).
• Availability: ensuring systems and data are accessible when legitimate users need them (for example, through resilient infrastructure, backups, and DDoS protection).

Defence in depth means putting multiple, independent layers of protection between an attacker and what they are trying to reach, so that if one control fails, others still stand. No single technology can stop every threat, so a layered program combines controls across people, devices, the network, identity, data, monitoring, and response.

FioSec organizes this into seven security layers (Human, Devices, Network, Identity, Data, Monitoring, and Response), each with its own set of controls. The strength of the model is that an attacker who gets past one control still faces several more, and each layer also creates an opportunity to detect them.

Explore the seven security layers

Mostly one-to-one. Network security lives in the Network layer, endpoint security in Devices, identity and access control in Identity, data security in Data, and monitoring and logging in Monitoring.

A few don't map so neatly. Email and web security span two layers: email protection sits in the Human layer because email attacks target people, while SASE filters web traffic in the Network layer. Incident response is the Response layer drawing on the others: EDR for containment, the SIEM for investigation, immutable backups for recovery. Application security tooling is delivered through our technology partners. And physical security (buildings, server rooms) complements the layered model but sits outside FioSec's cybersecurity portfolio; it needs its own program.

See the seven layers and their controls

These three terms are often used interchangeably, but they mean different things, and the distinction matters when prioritizing security work:

• A threat is something that could cause harm, such as a ransomware group, a phishing campaign, or a malicious insider.
• A vulnerability is a weakness that a threat could exploit, such as an unpatched server, a weak password, or a misconfigured cloud bucket.
• Risk is the combination of the two: the likelihood that a threat exploits a vulnerability, and the impact if it does. Security programs aim to reduce risk by removing vulnerabilities and limiting impact.

Security posture is the overall strength of an organization's cybersecurity: the sum of its controls, policies, processes, and the people who run them, measured against the threats it faces. A strong posture means risks are well understood and well managed; a weak posture means significant gaps remain.

Posture is not static. It changes as you add systems, adopt new cloud services, onboard staff, and as the threat landscape evolves. Assessments such as a maturity gap analysis exist to measure posture at a point in time and chart how to improve it.

Take the free Security Posture Check

The threats organizations face have grown more frequent, more automated, and more financially motivated. A few dominate the current landscape:

• Ransomware: malware that encrypts your data and demands payment, increasingly paired with data theft and extortion.
• Phishing and business email compromise (BEC): fraudulent emails that trick staff into handing over credentials or money.
• Identity-based attacks: stolen or guessed credentials used to log in rather than "break in."
• Cloud and SaaS misconfiguration: exposed data and over-permissive access in cloud environments.
• Supply chain and third-party risk: attacks that reach you through a trusted vendor or software provider.
• Exploitation of unpatched, internet-facing systems: attackers scanning for and breaking in through known vulnerabilities in exposed servers and edge devices such as VPN and firewall appliances.

Not anymore. Antivirus and firewalls remain useful, but they were designed for a world where the threat was mostly known malware crossing a clear network boundary. Today, attackers log in with stolen credentials, hide in encrypted traffic, target cloud apps that never touch your office network, and use techniques that signature-based antivirus does not recognize.

That is why a layered approach is essential: identity controls, endpoint detection and response, email protection, monitoring, and backups all cover gaps that a firewall and antivirus alone leave open.

A firewall is a security control that sits between your network and the outside world (or between segments of your own network) and decides which traffic is allowed through based on a set of rules. It is the most basic form of perimeter control: it blocks unsolicited and malicious connections while permitting legitimate business traffic.

You need one because every device connected to the internet is constantly probed by automated scans looking for a way in. Without a firewall enforcing a boundary, internal systems are directly exposed to those probes. A firewall reduces the attack surface and gives you a single point at which to enforce and log network policy.

A Next-Generation Firewall goes beyond simply allowing or blocking traffic by port and address. It inspects the actual content and application of traffic and integrates several advanced security features into one platform, providing far more comprehensive protection by detecting and blocking threats while controlling web and network traffic.

• Intrusion Prevention/Detection (IPS/IDS): spotting and stopping known attack patterns.
• DNS and URL filtering: blocking connections to malicious or inappropriate sites.
• Application awareness: controlling specific apps, not just ports.
• Deep packet inspection: examining traffic content, including encrypted traffic where TLS inspection is enabled.

The Network Layer

An Intrusion Detection System (IDS) monitors network or system activity and raises an alert when it sees patterns that match known attacks or suspicious behaviour. An Intrusion Prevention System (IPS) does the same thing but can also act automatically to block the malicious traffic in real time.

In short: IDS watches and warns; IPS watches and stops. Both are commonly built into modern Next-Generation Firewalls and are a key part of catching attacks as they cross the network.

SASE (pronounced "sassy") integrates cloud-delivered network and security services, such as SD-WAN, secure web gateways, cloud access security brokers, and Zero Trust Network Access, into a single framework that secures access to apps and data from any device or location.

It exists because the old model of routing all traffic back through a corporate office no longer fits a world of remote workers and cloud applications. SASE applies consistent security policy at the edge, close to the user, wherever they are, rather than assuming everyone sits behind the office firewall.

The Network Layer

Zero Trust is a security model summarized as "never trust, always verify." Instead of assuming that anything inside the network is safe, every access request, from any user or device, inside or outside the network, must be authenticated, authorized, and continuously validated before access is granted.

It is a direct response to the reality that perimeters are porous and attackers who get inside should not have free rein. In practice, Zero Trust is delivered through strong identity controls, least-privilege access, device health checks, and continuous monitoring rather than a single product.

The Network Layer

SD-WAN (Software-Defined Wide Area Network) is a way of connecting an organization's locations (offices, data centres, and cloud) that uses software to intelligently route traffic across multiple links for better performance and reliability. It often serves as the networking foundation that SASE layers security on top of.

Network segmentation divides a network into smaller, isolated zones so that systems are grouped by sensitivity and function rather than sitting on one flat network. If an attacker compromises one zone, say a guest Wi-Fi or a single workstation, segmentation limits how far they can move toward critical systems.

It is one of the most effective ways to contain an incident and is a practical expression of the Zero Trust principle of limiting implicit trust between systems.

The Network Layer

Email remains one of the most common ways attacks begin, whether a phishing message, a fake invoice, a credential-harvesting link, or a malware attachment. The filtering built into standard email platforms catches the obvious noise, but targeted phishing and impersonation routinely get through, so dedicated email security is essential.

Email protection refers to the measures and tools used to safeguard email from threats such as phishing, malware, and spam. It filters dangerous messages before they reach a user, neutralizes malicious links and attachments, and helps prevent impersonation of your domain and staff.

The Human Layer

Phishing is a fraudulent message, usually email, designed to trick the recipient into doing something harmful: clicking a malicious link, entering their password on a fake site, opening malware, or paying a fraudulent invoice. It works by impersonating someone or something the victim trusts.

• Phishing: broad, untargeted messages sent to many people.
• Spear phishing: highly targeted messages tailored to a specific person, often using details about their role or organization.
• Business Email Compromise (BEC): an attacker impersonates an executive, supplier, or colleague to trick staff into transferring money or sensitive data. These attacks are responsible for enormous financial losses and often involve no malware at all.

Modern email security inspects messages before and after delivery and applies multiple layers of defence:

• Filtering spam, malware, and known-malicious senders.
• Scanning and "detonating" attachments and links in a safe environment to catch threats that only activate when opened.
• Detecting impersonation and business email compromise attempts.
• Enforcing authentication standards (SPF, DKIM, DMARC) so others cannot easily spoof your domain.

Cloud security is the set of controls that protect data, applications, and infrastructure hosted in cloud services such as Microsoft 365, Google Workspace, and public cloud platforms. The principles are the same as traditional security, but the environment is different: there is no fixed network boundary, resources can be created and changed in seconds, and access is primarily controlled by identity rather than location.

That shift means cloud security leans heavily on identity and access management, configuration management, and monitoring of cloud activity. Misconfiguration, not sophisticated hacking, is one of the most common causes of cloud data exposure.

The shared responsibility model describes how security duties are split between a cloud provider and the customer. The provider secures the underlying infrastructure ("security of the cloud"), while the customer is responsible for how they configure and use it ("security in the cloud"), including data, access permissions, and settings. Exactly where the line sits depends on the service: with SaaS applications the customer's share is mostly data, accounts, and settings, while with cloud servers and infrastructure the customer also owns the operating system, patching, and whatever runs on it.

A frequent and costly misunderstanding is assuming the cloud provider handles everything. In reality, configuring access, protecting accounts, and managing data are the customer's responsibility, which is exactly where many incidents originate.

Identity and Access Management ensures the right individuals can access the right resources at the right times, and that no one else can. It covers how identities are created and verified, how access is granted and revoked, and how that access is enforced through policies, authentication, and authorization controls.

Good IAM is foundational to nearly everything else in security, because almost every system and cloud app is gated by an identity. If identities are weak or poorly governed, every downstream control is undermined.

The Identity Layer

Multi-Factor Authentication requires more than just a password to log in, typically something you know (a password) plus something you have (a phone app, security key, or code). Even if an attacker steals or guesses a password, that alone is no longer enough to log in, which stops the vast majority of account-takeover attempts.

MFA is one of the highest-impact, lowest-cost controls available and blocks the overwhelming majority of automated account-takeover attempts. It is considered a baseline requirement for any account that matters, especially email, remote access, and administrative accounts. Not all MFA is equal: attackers increasingly use real-time phishing kits to capture one-time codes and approved push prompts, so phishing-resistant methods such as security keys and passkeys are recommended for email, remote access, and administrative accounts, and SMS codes should be a last resort.

The Identity Layer

Privileged Access Management protects the most powerful accounts in an organization: administrator and service accounts that can change configurations, access sensitive data, and control systems. Because administrator accounts have access to critical systems and sensitive data, it is vital to ensure that these accounts are monitored and used appropriately by authorized individuals.

PAM tools enforce this by vaulting and rotating credentials, granting elevated access only when needed and only for as long as needed, and recording privileged sessions. Compromising a privileged account is an attacker's fastest path to total control, which is why these accounts get special protection.

The Identity Layer

When work happened inside an office, the network perimeter was the main boundary to defend. Now that users, devices, and applications are spread across home offices and the cloud, that boundary has dissolved. The one thing common to every access request, wherever it comes from, is identity.

As a result, identity has become the primary control point for security. Protecting and verifying identities (through MFA, least privilege, and monitoring) now does much of the work the network perimeter used to do.

The Identity Layer

User awareness training educates employees about cybersecurity risks and teaches them how to recognize and respond to threats such as phishing, suspicious links, and social engineering. Because so many attacks target people rather than technology, a workforce that can spot and report a suspicious message is a genuine security control.

Effective training is ongoing rather than a once-a-year video. People forget, threats change, and new staff arrive. Regular training, reinforced with simulated phishing exercises, keeps awareness high and gives you a real measurement of how often staff fall for phishing, so improvement can be tracked over time.

Phishing exercises & training

Least privilege means giving every user, account, and system only the access it genuinely needs to do its job, and nothing more. If an account is later compromised, least privilege limits the damage, because the attacker inherits only that account's narrow permissions.

It is a simple idea that is often poorly implemented, as access tends to accumulate over time. Reviewing and trimming excess access is one of the most effective ways to reduce risk.

The Identity Layer

An endpoint is any device that connects to your network, such as laptops, desktops, servers, and mobile devices. Endpoint Detection and Response (EDR) is a security solution that monitors these devices, detects threats, and responds to them in real time using advanced analytics and automation.

Rather than only looking for known malware, EDR watches for suspicious behaviour such as unusual processes, attempts to disable security tools, or signs of ransomware. It can isolate a compromised device, kill malicious processes, and give responders a detailed record of what happened.

The Devices Layer

Traditional antivirus matches files against a list of known-bad signatures and blocks them. It is fast and useful but blind to anything it has not seen before. EDR is behaviour-based: it looks at what software actually does, so it can catch novel attacks, "living off the land" techniques that abuse legitimate tools, and threats that never involve a malicious file.

EDR also adds response and investigation capabilities antivirus lacks, such as isolating devices from the network, killing malicious processes, recording activity for analysis, and in some products rolling back the changes malware made. Many modern platforms combine both approaches.

The Devices Layer

Asset and vulnerability management identifies, assesses, and prioritizes risks across your IT assets so that weaknesses can be remediated before attackers exploit them. It starts with knowing what you have, since you cannot protect assets you do not know exist, and continuously scans those assets for known vulnerabilities and missing patches.

Because no organization can fix everything at once, the "prioritization" part is key: focusing remediation on the vulnerabilities that are most exposed and most likely to be exploited delivers the greatest risk reduction for the effort.

The Devices Layer

A SIEM collects, analyzes, and correlates security data from across an organization (firewalls, servers, endpoints, identity systems, and cloud apps) to detect threats in real time and give the team what it needs to respond. It acts as the central nervous system for security monitoring.

Individually, a failed login or a single odd network connection looks like noise. A SIEM's value is in correlation: connecting events from different systems to reveal a pattern that indicates an attack, and generating alerts so a team can investigate before damage is done.

The Monitoring Layer

Immutable backups are backup copies written to storage that blocks changes and deletion for a defined retention period, so that even an attacker holding administrator credentials cannot erase them through normal means. They provide a reliable, secure way to preserve data integrity and protect against ransomware and accidental changes.

This matters because modern ransomware deliberately seeks out and destroys backups before encrypting data, knowing that a victim with good backups does not need to pay. If the backups are immutable, the attacker cannot tamper with them, so you can restore your systems and recover without paying a ransom. Backups defeat the encryption side of a ransomware attack. Because many groups also steal data and threaten to publish it, backups are the recovery foundation, not the whole defence, which is why the earlier layers still matter.

The Data Layer Check your ransomware resilience

The 3-2-1 rule is a widely used guideline for resilient backups: keep at least three copies of your data, on two different types of media, with at least one copy stored offsite (or offline/immutable). It makes it far less likely that any single failure, disaster, or attack can take out all of your copies at once.

Many organizations now extend it to "3-2-1-1-0," adding one immutable or air-gapped copy and zero errors verified by regular restore testing. A backup you have never tested is an assumption, not a recovery plan.

Check your ransomware resilience

A maturity gap analysis evaluates how well an organization manages and protects its digital assets, helping identify areas for improvement and measure progress over time. It compares your current security practices against a recognized framework or best-practice baseline and highlights the gaps between where you are and where you should be.

The output is a prioritized roadmap: a clear picture of your strengths, your most important weaknesses, and the sequence of improvements that will reduce risk most effectively. It is often the best first step because it tells you where to invest.

Assessments

A vulnerability assessment is a thorough examination of systems to identify weaknesses and potential entry points that could be exploited by attackers. It typically uses automated scanning combined with expert review to produce a prioritized list of vulnerabilities, such as missing patches, weak configurations, and exposed services, along with guidance on how to fix them.

It answers the question "where are we exposed?" and is something most organizations should do regularly, since new vulnerabilities are discovered constantly.

Our vulnerability assessment service

Penetration testing is a simulated cyberattack used to uncover weaknesses in systems, designed to help organizations identify and fix vulnerabilities before they can be exploited. A skilled tester actively attempts to breach defences the way a real attacker would, chaining weaknesses together to demonstrate genuine impact.

The difference: a vulnerability assessment broadly identifies and lists potential weaknesses, while a penetration test goes deeper on exploitability, proving which weaknesses can actually be used, and how far an attacker could get. The two are complementary, not interchangeable.

Our penetration testing service Not sure which you need? Take the decision tool

A phishing exercise is a simulated attack in which an organization sends realistic but harmless fake phishing messages to its own employees to see who recognizes and avoids them. It measures real-world susceptibility, identifies who may need more support, and reinforces awareness training in a practical, memorable way.

Done supportively rather than punitively, regular simulations give the organization hard data on susceptibility and a way to track improvement over time.

Phishing exercises

A tabletop exercise is a simulated, scenario-based discussion designed to test and improve an organization's incident response plans, processes, and decision-making in the face of a potential cyber threat. Key people walk through a realistic incident, for example a ransomware outbreak, and talk through how they would respond, step by step.

These exercises reveal gaps in plans, unclear roles, and missing contacts before a real crisis, when there is no time to discover them. They are one of the most cost-effective ways to improve readiness.

Tabletop exercises

A cloud readiness assessment helps an organization determine whether it is prepared to move operations to the cloud by evaluating its current infrastructure, applications, and processes. It looks at what can migrate smoothly, what needs to change first, and how to do it securely, so the move improves rather than weakens the organization's security posture.

Cloud readiness

Vulnerability assessments work best on a regular schedule, and after significant changes to your environment, because new vulnerabilities are disclosed continuously. Penetration testing is typically annual, or when a framework, customer, or insurer requires one, and after major changes to what you are protecting. Phishing simulations work best as an ongoing program rather than a one-off, so awareness stays current and improvement can be tracked.

Explore our assessments

It is designed not to. Scope, testing windows, and rules of engagement are agreed before anything starts, so testing never surprises your team. Vulnerability scanning is routine and low-impact, and anything with the potential to affect production is scheduled and controlled together with you.

How a penetration test runs

These are widely recognized cybersecurity frameworks and standards that provide structured, best-practice guidance. Organizations use them as a yardstick to assess and improve their security programs:

• NIST Cybersecurity Framework (CSF): a flexible framework organized around six core functions (Govern, Identify, Protect, Detect, Respond, Recover) used to assess and communicate cyber risk.
• CIS Critical Security Controls: a prioritized, prescriptive set of safeguards that are especially useful for knowing what to do first.
• ISO/IEC 27001: an international standard for an Information Security Management System (ISMS), which organizations can be formally certified against.

Security frameworks, explained Which framework do you need? Try the selector

Start by understanding your risk rather than buying tools. A maturity gap analysis or vulnerability assessment will tell you where your real exposure is, so you spend on what matters most. From there, a handful of high-impact, low-cost fundamentals deliver the greatest risk reduction:

• Turn on Multi-Factor Authentication everywhere, especially email and remote access.
• Get reliable, tested, immutable backups in place.
• Deploy modern endpoint protection (EDR) and keep systems patched.
• Add email security and run user awareness training.

Build your Security Priorities Roadmap

FioSec helps organizations design, implement, and strengthen cybersecurity programs using proven technologies and real-world engineering experience. That spans professional services (consulting and design, implementation and integration, team enhancement, and policy development), security assessments, and the supply and deployment of cybersecurity technologies through our partner network.

The simplest way to begin is to get in touch and tell us what you are trying to achieve, whether that is evaluating a specific technology, planning a security initiative, or getting an assessment. We will recommend a practical next step.

Contact the FioSec team

There is no fixed price list, because no two environments are the same. Every engagement is scoped to what you actually need, whether that is a one-time assessment, an implementation project, or ongoing support.

Reach out and we will talk through your situation and put together a quote. The conversation costs nothing and comes with no obligation.

Request a consultation

Yes. If you are dealing with an active incident, call our team at 289-800-2187 and we will get you to the right people.

If it is not urgent, the contact form works too, and we will follow up quickly.

Contact us

As long as it is needed, and no longer. Some engagements are short and focused, like an assessment with a report and a debrief. Others run longer, from an implementation project through to ongoing support and tuning.

Scope is agreed together during discovery, so you will know what the engagement looks like before it starts. As your needs evolve, we stay available for the next phase of work.

How we work

Yes. FioSec offers preferred pricing for registered charities, and works with other mission-driven not-for-profits case by case. Not-for-profit organizations face the same threats as larger enterprises, often with leaner budgets and smaller IT teams, and the program exists to put enterprise-grade cybersecurity within reach.

About our not-for-profit program

Yes. Carriers increasingly require specific controls before they will write or renew a policy, most commonly MFA, EDR, protected backups, and staff training. These map directly onto the layers we deploy and support, and we help organizations close the gaps and document their controls for underwriters.

Our free readiness check shows where you stand against the controls carriers most often ask about.

Take the insurance readiness check

Yes. We publish anonymized case studies of real engagements: the situation the client was facing, the work we did across the layers, and how it turned out. Client names are withheld, since security work is confidential, but the engagements are real.

Read our case studies

Vendor-agnostic by design. We recommend the technologies that fit your environment and objectives, not a fixed product line. Through our partner network of 26 leading security vendors, we can then supply, implement, and support whatever you choose.

See our technology partners

A practical baseline for most organizations includes an acceptable use policy, an access control policy, an incident response plan, and a backup and recovery policy. Frameworks, auditors, and insurers often expect more, depending on your industry and obligations.

The harder part is writing policies your team will actually follow. Our Policy Development service builds that documented foundation with you.

About Policy Development

Yes. FioSec is an approved supplier under the OECM Networking Products and Related Services agreement, allowing eligible Ontario public sector organizations (including school boards, colleges and universities, municipalities, healthcare organizations, and non-profit institutions) to procure cybersecurity technologies through a pre-qualified procurement framework.

This streamlines purchasing by letting eligible organizations acquire technologies from an approved supplier without running a full competitive procurement, while staying compliant with public sector purchasing policies.

Cybersecurity procurement through OECM