# Lorikeet Security Canada

> Lorikeet Security Canada is a cybersecurity consulting firm specializing in penetration testing, security code reviews, and compliance-driven security assessments for Canadian organizations. We serve startups, enterprises, fintech, healthcare, energy, and government clients across Canada, with deep expertise in Canadian privacy law (PIPEDA, PIPA Alberta, PHIPA Ontario) and international frameworks (SOC 2, ISO 27001, PCI-DSS). Compliance-ready reports, free retesting, and a real-time client portal included with every engagement. Based in Canada, serving clients nationwide and internationally.

## Core Pages

- [Homepage](https://lorikeetsecuritycanada.ca/): Overview of Lorikeet Security Canada's penetration testing and cybersecurity consulting services
- [About Us](https://lorikeetsecuritycanada.ca/about): Company background, mission, and team information
- [Contact](https://lorikeetsecuritycanada.ca/contact): Get in touch for security assessments and consultations
- [Methodology](https://lorikeetsecuritycanada.ca/methodology): Our penetration testing methodology and approach
- [Pricing](https://lorikeetsecuritycanada.ca/pricing): Transparent penetration testing pricing for Canadian organizations
- [FAQ](https://lorikeetsecuritycanada.ca/faq): Frequently asked questions about penetration testing and cybersecurity services

## Penetration Testing Services

- [Cloud Penetration Testing](https://lorikeetsecuritycanada.ca/services/cloud-penetration-testing): AWS, Azure, GCP, and OCI cloud infrastructure security assessments - misconfiguration review, IAM privilege escalation, storage exposure, and lateral movement testing
- [Web Application Penetration Testing](https://lorikeetsecuritycanada.ca/services/web-application-penetration-testing): Manual OWASP Top 10 and beyond; authentication, authorization, injection, business-logic, and client-side vulnerability testing for web applications
- [API Penetration Testing](https://lorikeetsecuritycanada.ca/services/api-penetration-testing): REST, GraphQL, and SOAP API security testing including BOLA/IDOR, broken authentication, mass assignment, and rate-limiting weaknesses
- [Network Penetration Testing](https://lorikeetsecuritycanada.ca/services/network-penetration-testing): Internal and external network penetration testing - host enumeration, service exploitation, lateral movement, and Active Directory attack paths
- [Mobile App Penetration Testing](https://lorikeetsecuritycanada.ca/services/mobile-penetration-testing): iOS and Android mobile application security testing including binary analysis, data storage, transport security, and API backend assessment
- [On-Site Security Assessments & Walkthroughs](https://lorikeetsecuritycanada.ca/on-site-assessments): Hands-on physical and technical security walkthroughs for Toronto (Financial District, GTA, Waterloo) and Calgary offices - testing physical access controls, badge cloning, rogue network drops, RF bleed, and comms room security
- [Red Team Operations](https://lorikeetsecuritycanada.ca/services/red-team): Full-scope adversary simulation covering initial access, persistence, privilege escalation, lateral movement, and objective attainment - with detailed attack narratives
- [Social Engineering](https://lorikeetsecuritycanada.ca/services/social-engineering): Phishing simulations, vishing campaigns, and pretexting exercises to measure and improve human-layer security awareness

## Compliance Readiness Services

- [SOC 2 Readiness](https://lorikeetsecuritycanada.ca/soc-2-readiness): SOC 2 Type I & II penetration testing and compliance readiness; reports scoped to satisfy AICPA Trust Services Criteria and enterprise buyer questionnaires
- [ISO 27001 Readiness](https://lorikeetsecuritycanada.ca/iso-27001-readiness): ISO/IEC 27001:2022 compliance security assessments and gap analysis; reports aligned to Annex A controls for certification readiness
- [PIPEDA Compliance](https://lorikeetsecuritycanada.ca/pipeda-compliance): Penetration testing and privacy risk assessments aligned to Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA / Bill C-27)
- [PCI-DSS Readiness](https://lorikeetsecuritycanada.ca/pci-dss-readiness): PCI-DSS v4.0 compliance penetration testing for cardholder data environments; reports structured to satisfy QSA requirements

## Locations

- [Locations Overview](https://lorikeetsecuritycanada.ca/locations): Service areas across Canada
- [Calgary](https://lorikeetsecuritycanada.ca/locations/calgary): Cybersecurity services in Calgary, Alberta - penetration testing for energy, fintech, healthcare, and technology organizations; PIPA Alberta and PIPEDA compliance expertise
- [Toronto](https://lorikeetsecuritycanada.ca/locations/toronto): Cybersecurity services in Toronto, Ontario - penetration testing for financial services, SaaS, healthcare, and legal/professional services; OSFI B-13, PHIPA, and FINTRAC compliance expertise
- [Alberta](https://lorikeetsecuritycanada.ca/locations/alberta): Province-wide cybersecurity services across Alberta - security assessments for energy, agriculture, technology, healthcare, and construction sectors; PIPA Alberta, PIPEDA, and NERC CIP awareness

## Key Canadian Compliance Frameworks Covered

- **PIPEDA / Bill C-27 (CPPA)** - Canada's federal private-sector privacy law; applies to organizations collecting personal information in the course of commercial activity
- **PIPA Alberta** - Alberta's provincial Personal Information Protection Act; one of Canada's most stringent provincial privacy statutes
- **PHIPA (Ontario)** - Personal Health Information Protection Act; governs health information custodians in Ontario including hospitals, clinics, and digital health platforms
- **OSFI B-13** - Office of the Superintendent of Financial Institutions Technology and Cyber Risk Management guideline; applies to federally regulated financial institutions
- **FINTRAC** - Financial Transactions and Reports Analysis Centre of Canada; anti-money-laundering compliance requirements for financial services
- **SOC 2** - AICPA Trust Services Criteria; the default expectation of US and international enterprise buyers evaluating Canadian SaaS and fintech vendors
- **ISO 27001** - International information security management system standard; increasingly required for Canadian companies selling internationally
- **PCI-DSS v4.0** - Payment Card Industry Data Security Standard; applies to any organization handling cardholder data
- **NERC CIP** - North American Electric Reliability Corporation Critical Infrastructure Protection; applies to bulk electric system operators in Alberta and across Canada

## Commercial & Buyer Guides (Blog)

- [Blog Hub](https://lorikeetsecuritycanada.ca/blog): Practical cybersecurity and compliance playbooks for Canadian tech founders, CTOs, and CISOs
- [Proof of Penetration Test](https://lorikeetsecuritycanada.ca/blog/customer-wants-proof-of-penetration-test): What enterprise buyers accept as proof of a penetration test and why sending a raw report leaks liability
- [How to Vet a Pentest Firm](https://lorikeetsecuritycanada.ca/blog/how-to-vet-a-penetration-testing-firm): 5 questions that expose automated scanner resellers before signing an SOW
- [Cyber Insurance Requirements Canada](https://lorikeetsecuritycanada.ca/blog/cyber-insurer-asking-about-security-controls): How Canadian underwriters evaluate MFA, EDR, and annual pentest attestations
- [Security Questionnaire Playbook](https://lorikeetsecuritycanada.ca/blog/customer-sent-security-questionnaire-no-answers): A 48-hour guide to handling 150-question vendor risk assessments
- [Hidden Costs of SOC 2](https://lorikeetsecuritycanada.ca/blog/hidden-costs-of-soc-2): Five unquoted costs of SOC 2 compliance for Canadian SaaS companies
- [Penetration Test Deliverable Breakdown](https://lorikeetsecuritycanada.ca/blog/what-a-penetration-testing-deliverable-looks-like): Dissecting an executive summary, Letter of Attestation, and technical findings
- [PHIPA vs HIPAA Guide](https://lorikeetsecuritycanada.ca/blog/phipa-compliance-vs-hipaa-canadian-healthtech): Navigating cross-border health data compliance for Canadian MedTech and SaaS
- [Canadian Privacy Stack (Law 25, PIPA, PIPEDA)](https://lorikeetsecuritycanada.ca/blog/quebec-law-25-pipeda-compliance-guide): Understanding provincial and federal privacy requirements demanded by enterprise buyers
- [SOC 2 Type I vs Type II](https://lorikeetsecuritycanada.ca/blog/soc-2-type-1-vs-type-2-timeline-cost): Comparing timelines, costs, and enterprise acceptance for Canadian tech companies
- [Securing AI and RAG Architectures](https://lorikeetsecuritycanada.ca/blog/securing-ai-and-rag-pipelines-enterprise-guide): Vector database access controls, prompt injection defenses, and enterprise AI auditing
- [Top 10 Cybersecurity Companies in Canada](https://lorikeetsecuritycanada.ca/blog/top-cyber-security-companies-in-canada): Objective 2026 guide to Canadian cybersecurity firms across offensive pentesting, fractional CISO, and MDR

## Contact

- Email: canada@lorikeetsecurity.com
- Website: https://lorikeetsecuritycanada.ca
- Domain: lorikeetsecuritycanada.ca