About Signal & Soil
We've run security where failure made the news.
Our team has kept big, busy systems safe, from the iPhone launch to the Paris Olympics. Now we tell boards, executives and governments what's really going on in theirs.
Where our experience comes from
Most of our team comes from Microsoft. We’ve also worked on projects like:
- 01Testing the security of new AI models before they were released
- 02Owning cybersecurity for very large internet services — dating, sports and more
- 03Owning cybersecurity for ticketing, hospitality and logistics at the Paris 2024 Olympic & Paralympic Games
- 04Building the data behind a global bank's cybersecurity science team at HSBC
- 05Checking open source code for security holes across Microsoft's products
- 06Helping launch the iPhone at AT&T
- 07Building secure voting systems, including mail-in ballots
- 08Helping start Microsoft's Trustworthy Computing effort
That history is not a sales pitch. It is why we start from how systems really break, not how they are described on paper.
Why Signal & Soil
Leaders are being asked to make big decisions about security and AI on the strength of sales pitches, green dashboards and checklists written by people who never had to live with the risk. The important questions, what to rely on, what to keep in-house, what to say no to, and what to prepare for, often go unasked.
We are here to ask them, and to answer them in writing. We do that in three ways: risk advisory for boards, executives and governments; AI safety testing before AI is trusted; and a research group that keeps both honest. Everything we write is for the person who has to decide, not for show.
Signal is what a business says about itself. Soil is what’s really underneath. Attackers get in through the gap between the two, and that is where we work.
How risk really behaves
Your risk surface is bigger than you think
Every AI tool, supplier, login and data feed is a way in. Most were added one at a time, by someone solving a different problem, and nobody ever drew the whole map.
Risk compounds
Small gaps don’t add up, they multiply. A stale login, an over-trusted AI agent and a supplier outage are each minor. On the same afternoon they are a crisis.
Everything leans on a few things
A handful of cloud providers, AI models and data paths now sit underneath most businesses. When one of them fails, everything built on it fails together.
Principles
How we think.
- 01Signal
- Separate what is really changing from what is just loud. Most talk about AI is noise. What matters is what you depend on, who gains from it, and how it breaks.
- 02Soil
- Base every conclusion on how your business really runs: the systems your people use, the suppliers you rely on, and the records you can actually show.
- 03Facts before opinions
- We tell you what could go wrong, what it would cost, and whether it can be undone, before we give an opinion. Advice that falls apart when someone pushes back is not advice.
- 04Independence
- No deals with vendors, no products to resell, nothing to promote. You pay us for honest advice, and it has to hold up when someone disagrees with it.
Canadian-based
Built in Canada. Working globally.
Based in Canada, with experience across large companies, tech firms, and governments in North America and Europe. Available as a Canadian government supplier for federal, provincial, and municipal work.
Start here
Not sure where you stand? Let's find out.
Tell us what the board is asking, what the regulator wants, or what's hitting your service. Or just the feeling that the green dashboard isn't telling you everything. We'll tell you plainly what we'd look at first.
We’ll reply in writing: what we’d look at first, and a quote.
