Independent cybersecurity advisory / Victoria, BC
We’re cybersecurity consultants.
We find the weak spots in your business and help you fix them.
Who it's for
Any business worried about its security: small or large, private or public.
What we do
Look at how your business uses its systems, especially its data and AI, and find where an attacker could get in.
Ongoing help
We can also be your part-time head of security, often called a virtual CISO.
Tell us what’s worrying you. We’ll reply with a plan and a quote in writing.
Our practice
Find the weak spots. Fix what matters.
Four practices, one team. Every job ends with a written plan: what we found, what to fix first, and how. We can also be your part-time head of security, often called a virtual CISO.
- 01
AI security
For organizations using AI
Protect your business while your people use AI: your data, your accounts and the decisions AI now touches.
Read about AI security - 02
Risk & compliance
For businesses facing an audit
Pass the audit your customers ask for, and know what your real risks would cost.
Read about Risk & compliance - 03
AI safety
For teams building or shipping AI
Test and control the AI system itself: find dangerous behaviour before your customers, or attackers, do.
Read about AI safety - 04
Cybersecurity
For any business that runs online
Close the doors an attacker would use to get into your cloud, your apps and your accounts.
Read about Cybersecurity
About the name
What you think is true, and what’s really there.
Signal is what a business says about itself. Soil is what’s really underneath. Attackers get in through the gap between the two. We find that gap and help you close it.
What people assume
What we usually find
What people assume
“AI tools just save us time”
What we usually find
They also send your data to outside companies. Most businesses can't say which AI tools their staff use, or what goes into them.
What people assume
“We have a policy for that”
What we usually find
A policy is a promise on paper. What matters is whether your people know who decides, who to call, and what to do when something goes wrong.
What people assume
“It passed its security check”
What we usually find
The part that was checked is rarely where the trouble starts. Attackers go after the logins, the data, and the connections around it.
The risks that hurt a business are rarely the ones on the list. They’re the ones nobody was looking after.
So we look at your systems, suppliers, and data the way an attacker would, before we recommend anything.
Track record
Our team has worked on projects like these.
Most of our team comes from Microsoft, and we’ve kept big, busy systems safe. That’s how we know which risks are real, which fixes actually work, and what holds up when an attacker or an auditor comes knocking.
- 01
Microsoft
Where most of our team comes from: keeping Microsoft's products and its customers' data secure
- 02
Major events
Owning cybersecurity for ticketing, hospitality and logistics at the Paris 2024 Olympic & Paralympic Games
- 03
Mobile
Helping launch the iPhone at AT&T
- 04
Internet services
Owning cybersecurity for very large internet services — dating, sports and more
- 05
Critical systems
Voting systems, the internet backbone and cloud security
Before you ask
What people tell us before they call.
- “We’re too small to be a target.”
- Smaller organizations make attractive targets: they hold data worth stealing and usually have fewer people watching. Our work is sized to your business, not to a bank’s.
- “Our IT person handles security.”
- Good. We work with them, not around them, and bring the attacker’s view and audit experience they rarely have time to build.
- “We don’t know what it would cost.”
- You get a written plan and a quote before any work starts. If you don’t need us, we’ll tell you that too.
Research
What we’re writing about.
Plain-language articles on security, AI, and what goes wrong, and how to stop it happening to you.
- Governance & risk
WordPress Survival Time
How long does an unattended WordPress site last on the modern web? Minutes to be found, months to be noticed — and survival is a property of operations, not software.
- Governance & risk
Canvas LMS Breach: What Educational Institutions Should Do Now
The May 2026 Canvas breach exposed 275 million users across 8,800+ institutions. Here's what happened, immediate steps to take, and how to build long-term resilience.
- Governance & risk
Why Your AI Needs Governance Before It Needs Features
Most organizations rush to deploy AI capabilities without governance frameworks. Here's why that's a costly mistake and how ISO 42001 provides a structured path forward.
Start here
Worried about your security? Let's talk.
Tell us what's worrying you: a new AI tool, a supplier you rely on, a close call, or just a feeling that something isn't right. Any business, any size. We'll tell you plainly what we'd look at first.
We’ll reply with a plan and a quote in writing.
