Quick answer
The Twelve Controls eBook covers the twelve cybersecurity controls that Canadian cyber insurance underwriters now require evidence on (not just attestation): MFA on all admin access, EDR on every endpoint, immutable backups with test-restore logs, identity hygiene, network segmentation for OT exposure, vendor risk attestation tiers, incident response runbook with tabletop log, security awareness training, vulnerability management, email security, encryption at rest and in transit, asset inventory. Built across eleven consecutive years of zero-breach client outcomes.
Inside this guide.
Why mid-market is the target.
For most of the 2010s, mid-market oil and gas operators in Canada operated on a quiet assumption: cyber threats targeted the supermajors. Pipeline operators. Refineries. National oil companies. The boutique 60-person operator in Calgary with 140 producing wells in the Montney was not, in the imagination of most CEOs, on the same threat surface as Saudi Aramco or Colonial Pipeline.
That assumption was always wrong. By 2024-25, it became dangerously wrong.
In July 2025, Zscaler published their ThreatLabz annual report. The headline number for the energy sector: ransomware attacks against oil and gas companies increased 935% year-over-year. Ransomware attacks in Canada specifically rose 194.5%. The Canadian Centre for Cyber Security's 2025-2026 National Cyber Threat Assessment named ransomware the top cybercrime threat to the nation's critical infrastructure, citing escalating attacks on industrial and public sector organizations.
In August 2024, Halliburton - the largest oilfield services firm in the world - was hit by ransomware and forced to take systems offline for several days. The incident was disclosed to the SEC. Costa Rica's state energy company RECOPE was forced to revert to manual operations after a separate incident. Industrial sector ransomware attacks involving energy companies increased 46% quarter-over-quarter from Q4 2024 to Q1 2025, according to Honeywell. By Claroty's count, credential-stealing malware infections on OT systems rose 3,000% in the same period.
And here is what most mid-market CEOs missed about that data. It was not just about the supermajors anymore. The 935% increase was distributed across the entire sector, with mid-market specifically targeted because attackers had learned three things during 2023-24:
- Mid-market operators have meaningful revenue, meaningful production data, and meaningful regulatory consequences if disrupted - but most don't have Fortune 500 security budgets or 24/7 security operations centers.
- The IT-to-OT bridge in mid-market is often less segmented than in supermajors, meaning a successful IT intrusion can reach SCADA, historians, and production telemetry in hours rather than days.
- Mid-market cyber insurance payouts are predictable, traceable, and profitable for ransomware groups. The supermajors fight harder. The mid-market pays faster.
The math of opportunistic ransomware now works against mid-market oil and gas. That math doesn't get better in 2027. It gets worse, because generative AI is becoming a force multiplier for attackers - automating phishing lure creation, scaling vishing campaigns, accelerating credential harvesting. The Zscaler 2026 predictions explicitly warn that AI-augmented attacks will become standard, with attackers using AI tools to scale multi-phase extortion campaigns and to mine sensitive datasets for use in social engineering.
What changed in the insurance and M&A markets.
The threat picture changed. The insurance market followed within months. By late 2025, cyber insurance carriers serving Canadian energy had tightened underwriting requirements significantly. Most carriers in 2026 now require, at minimum:
- Phishing-resistant MFA on privileged, executive, and remote-access accounts - FIDO2 keys or number-matching authenticator apps. SMS-based MFA is no longer accepted by major carriers.
- EDR (Endpoint Detection & Response) deployed across all endpoints - and the carrier specifically wants to know which product. Gartner Magic Quadrant Leaders pass. White-label antivirus increasingly does not.
- Immutable offline backups verified within the previous 90 days, with test restore evidence.
- Network segmentation between IT and OT with documented architecture diagrams.
- Tested incident response plan - with evidence of a tabletop exercise within the past 12 months.
- Documented vendor cyber attestation for top-tier vendors with system access.
The M&A market shifted in parallel. Cyber moved from a check-the-box diligence category to a primary deal category. Buyers in 2026 now structure $500K-$5M cyber escrow holdbacks routinely, sometimes with multi-year tails. Deals re-trade on cyber findings. Some walk entirely.
What this book is for.
This book is the playbook for catching up. It assumes you are running a drilling, service, or production company between 25 and 200 people in Canadian oil and gas. It assumes you know that cyber is now a primary business risk, even if you don't yet have the framework to address it systematically. It assumes you would rather build defensible posture before the incident than pay for it after.
The framework is built around twelve controls. They are not novel - they map roughly to the Canadian Centre for Cyber Security's baseline guidance, to the NIST CSF, and to what cyber insurance underwriters now require. What this book adds is the operational reality of deploying them in a mid-market Canadian oil and gas environment. What works. What doesn't. What it actually costs. What white-label MSPs will sell you that doesn't pass underwriter scrutiny. What Fortune-500-grade tooling looks like at mid-market scale.
The book is also direct about what good looks like - including what good looks like when you partner with someone to deliver it. Vencer Group runs cyber operations across multiple jurisdictions with named, industry-leading tooling. The recommendations in this book reflect what is actually deployed in production. That's not marketing. It is the difference between writing about cyber and running cyber, and the perspective matters for the recommendations.
The threat picture, honestly stated.
Most cyber writing aimed at mid-market operators makes one of two mistakes. The first is overstating the threat - describing every operator as if they're moments away from a state-sponsored attack - which generates alert fatigue and ultimately causes operators to discount real warnings. The second is understating the threat - describing cyber as a "best practices" topic - which underprepares operators for what is now an everyday reality. This chapter splits the difference and tells the truth about the threat picture in 2026.
The three threat actor categories that target you.
Category one - opportunistic ransomware groups. The largest category by volume. These groups don't target you specifically. They run automated scans for vulnerable services exposed to the internet - unpatched VPN appliances, weak RDP gateways, exposed remote management consoles, known vulnerabilities in firewall products. You are a target because you appeared in a scan, not because they chose you.
The Zscaler 2025 data identified the technical attack vectors with the highest exploitation rates: SonicWall VPN vulnerabilities, Fortinet VPN flaws, Veeam backup software bugs, VMware hypervisor issues, SimpleHelp remote-access vulnerabilities. These are not exotic attacks. They are vulnerabilities in mainstream products with available patches that operators didn't apply in time. The exploitation timeline between disclosure and active exploitation has compressed to hours.
Category two - targeted criminal groups. A smaller category, but more dangerous. These groups identify you specifically - usually by mining LinkedIn for organizational structure, public filings for financial profile, and industry data for production information. They use social engineering (vishing, spear-phishing, business email compromise) to gain initial access. Once inside, they map the environment, locate the data that matters, exfiltrate it, then encrypt the systems and demand ransom for both decryption and non-publication.
The Honeywell data through 2025 showed targeted criminal groups increasingly focused on the energy sector specifically because the operational disruption leverage is so high. Production downtime in oil and gas is measured in dollars per hour, and the operator's willingness to pay scales with that math.
Category three - nation-state actors. The smallest category by volume but the most sophisticated. State-sponsored actors target energy infrastructure for strategic reasons - intelligence gathering, capability development, occasional disruption operations. Most mid-market operators are not direct targets of nation-state actors, but they are sometimes incidental targets - caught up in supply chain attacks, used as pivots to reach larger targets, or compromised because their cyber posture made them an easy resource for a larger operation.
The five attack vectors you actually face.
Across the three threat actor categories, the attack vectors that actually compromise mid-market operators fall into five recurring patterns. Understanding the patterns is how you design controls that work.
What attackers actually want from you.
Three things, in approximate priority order:
One - ransom payment. The primary financial objective for criminal groups. They encrypt your systems, threaten to publish stolen data, and demand payment. Average ransom payments for mid-market energy companies in 2025 ranged from $500K to several million. Insurance often pays. Underwriters know this, which is why their requirements keep tightening.
Two - stolen data with market value. Production data, customer lists, financial records, partner statements, employee data. Even if you don't pay the ransom, your data ends up sold on dark web markets. Production data specifically has resale value to commodity traders, competitive intelligence buyers, and short-sellers. Personal data ends up in identity theft markets.
Three - operational leverage. Some attackers explicitly target operational disruption - either for political reasons, for short-position market manipulation, or to demonstrate capability. The Costa Rica RECOPE incident was operationally motivated. Production disruption in oil and gas creates real-world consequences that translate to bargaining power.
You are not in the threat picture because you are big or interesting. You are in the threat picture because you exist, you are reachable, and you have something worth taking. The opportunistic ransomware groups don't care about your strategic position. They care that your VPN appliance hasn't been patched.
The good news is that the controls that defeat opportunistic attacks are not exotic. They are well-known, well-documented, and well-priced relative to the cost of an incident. The problem is that most mid-market operators haven't deployed them properly. The rest of this book is about closing that gap.
The twelve controls - overview.
The twelve controls in this framework are not new. They map to the Canadian Centre for Cyber Security baseline, to NIST CSF, and to what cyber insurance underwriters now require in 2026. What is novel here is the framing as twelve specific, actionable items in deployment order - with named industry-standard tooling that passes underwriter and M&A diligence scrutiny.
Twelve is the right number because it is enough to cover defensible posture and few enough to actually deploy. Most mid-market operators stuck at "we need a cyber program" can address all twelve in a focused 90-180 day program. Most operators stuck in five-year cyber roadmaps would deploy faster, simpler, and more durably if they reframed around these twelve.
The twelve, named.
Control 2: Phishing-resistant MFA on all accounts
Control 3: Privileged access management
Control 4: Documented offboarding with evidence
Control 6: Email security (Gartner Leader) protecting all inboxes
Control 8: Network segmentation between IT and OT
Control 10: Tested incident response plan
Control 11: Vendor cyber attestation
Control 12: Cyber governance and tabletop discipline
Why this order matters.
Most cyber roadmaps put all twelve controls in parallel work streams and end up partway done on each. The twelve are designed to be sequential. Controls 1-4 (identity) come first because identity is the single most common attack vector and identity controls underpin everything else. Controls 5-6 (endpoint and email) come second because they stop the most common attack types. Controls 7-8 (resilience and segmentation) come third because they limit blast radius when prevention fails. Controls 9-12 come last because they require the foundation of 1-8 to function properly.
Operators who execute in this order finish faster and have working coverage sooner. Operators who try to run all twelve in parallel typically finish 18 months late with mediocre coverage everywhere and no single control that fully works.
The Fortune-500-grade-at-mid-market-price principle.
For each of the twelve controls, there is a named industry-standard product that passes underwriter and M&A diligence scrutiny. Most are Gartner Magic Quadrant Leaders. Mid-market operators have access to these products at meaningfully reasonable scale-appropriate pricing - either directly or through MSPs that licensed them properly. The gap between "what mid-market should run" and "what most mid-market actually runs" is mostly a function of which MSP they partnered with and what that MSP chose to license.
This book names products. Not as endorsements, but because the named products are what passes diligence. SentinelOne, CrowdStrike, or Microsoft Defender for Endpoint for EDR. Proofpoint, Mimecast, or Abnormal Security for email security. Veeam, Rubrik, or Cohesity for backup. Microsoft Entra (formerly Azure AD) or Okta for identity. These names appear on Gartner Leader quadrants in 2025. White-label products and rebranded MSP cyber stacks do not.
The chapters that follow detail each of the twelve controls - what it is, why it matters, what passes diligence, what to deploy, and what it costs. Chapter ten discusses how to choose your stack overall. Chapter nine addresses why the white-label MSP cyber stack is currently the single most common reason mid-market operators fail cyber diligence.
A 50-person operator deploying the twelve controls properly with external support - fractional CISO, named industry tooling, deployment services - runs roughly $120,000 to $250,000 in the first year (one-time setup plus annual licensing) and $60,000 to $120,000 per year ongoing. That's less than one ransomware incident. It's less than the cost of a single mid-career security hire. And it produces underwriter-compliant, diligence-defensible posture.
Controls 1-4: Identity, MFA, and access.
Identity is the foundation of every other cyber control. If your identity layer is weak, nothing else compensates. If your identity layer is strong, most of the common attacks become much harder to execute. Controls 1-4 cover the identity layer comprehensively.
Control 1: Single sign-on (SSO) across all major systems.
What it is: A central identity provider that authenticates users for all major business applications. Users log in once to the identity provider, then access connected applications without re-authenticating.
Why it matters: Without SSO, each application has its own authentication, its own user list, and its own access controls. Some users have access to applications they no longer need. Some former employees still have access months after departure. Most mid-market operators discover, when they audit their actual access state, that 15-30% of accounts are stale or incorrectly scoped. SSO concentrates identity decisions in one place where they can be managed properly.
What passes diligence: Microsoft Entra (formerly Azure AD), Okta, or Google Workspace identity - all enterprise-grade identity providers with documented security postures. SSO coverage above 90% of business applications is the underwriter target. Below that, you are flagged.
What to deploy in mid-market: Microsoft Entra is the most common choice for Canadian energy operators because most run Microsoft 365 already. Entra provides SSO to Microsoft applications natively and to most major SaaS applications through pre-built connectors. The cost is incremental rather than separate - typically $6-22 per user per month depending on the Entra tier needed for your use case.
Common deployment pitfalls: The technical deployment is straightforward. The hard part is identifying every business application that needs to be connected - and there are always more than the IT lead realizes. Production accounting platforms, JIB systems, regulatory portals, field data capture tools, partner-facing systems. A thorough SSO deployment usually surfaces 20-40 applications that the IT lead didn't have in their inventory.
Control 2: Phishing-resistant MFA on all accounts.
What it is: Multi-factor authentication that cannot be defeated by phishing or man-in-the-middle attacks. The 2026 standard is FIDO2 security keys (YubiKey, Feitian, Google Titan) or number-matching authenticator apps (Microsoft Authenticator with number matching, Google Authenticator with number matching).
What does NOT pass: SMS-based MFA, voice call MFA, email-based MFA. All defeated by SIM swapping and AiTM (Adversary in the Middle) phishing campaigns. Push-only MFA - where the user just taps "approve" - is increasingly being rejected by underwriters because users approve fraudulent pushes too often (the "MFA fatigue" attack).
Why it matters: Credential theft is the most common attack vector. MFA stops most credential theft attacks. Phishing-resistant MFA stops nearly all of them. The Adversary in the Middle (AiTM) attack family that became prevalent in 2024-25 specifically bypasses traditional MFA - which is why underwriters tightened the requirement in 2026.
What passes diligence in 2026: FIDO2 keys for privileged, executive, and remote-access accounts. Number-matching authenticator apps for general workforce accounts. Coverage above 95% of human accounts is the underwriter target. Service accounts (non-human) are harder - Control 3 addresses those.
What to deploy in mid-market: If you're on Microsoft Entra, Microsoft Authenticator with number matching enabled. Cost: included. For privileged accounts, hardware keys - YubiKey 5 Series is the most common choice. Cost: $50-90 per key, plus deployment time. Most mid-market operators discover that the cost of the keys is trivial compared to the cost of the deployment time - getting every privileged user to actually use the key is the work.
Control 3: Privileged access management.
What it is: A documented framework for managing accounts with elevated privileges - administrators, system accounts, service accounts, vendor accounts. The framework includes inventory, justification, periodic review, and just-in-time elevation where possible.
Why it matters: Privileged accounts are the highest-value targets for attackers because they bypass most controls. Most mid-market operators cannot produce a complete inventory of their privileged accounts. Service accounts especially - the non-human accounts that applications use to talk to each other - are typically scattered, undocumented, and over-privileged.
What passes diligence: Documented inventory of all privileged accounts (human and service). Quarterly review evidence. Just-in-time elevation for human admin work where possible. Service accounts with assigned owners, documented purpose, scoped credentials, and rotation schedule. For mid-market operators, "Privileged Access Management" tooling is increasingly being expected - Microsoft has built-in PIM in Entra, third parties include CyberArk, BeyondTrust, and Delinea.
What to deploy in mid-market: Start with the inventory. List every privileged account, who owns it, what it does, what it has access to. This document alone is worth more than most tooling deployments. Then implement quarterly review. Then add PIM tooling - Microsoft PIM is included with Entra P2 licensing and is the natural choice for operators already on Microsoft.
Control 4: Documented offboarding with evidence.
What it is: A documented process for revoking access when employees leave, with checklist evidence that each offboarding was completed properly. The process covers all systems - Microsoft 365, production accounting, JIB systems, field tools, third-party SaaS, VPN, physical access, vendor portals, partner systems.
Why it matters: Stale access from former employees is one of the most common attack vectors. The Mandiant 2025 incident response data showed that 17% of investigated breaches involved access from accounts that should have been disabled when the employee left. The window between departure and access revocation is the vulnerability. Diligence teams audit specifically for this.
What passes diligence: A documented offboarding process with evidence that the last 12 months of departures were completed cleanly. Specifically: an offboarding checklist, a named owner for each departure, time-stamped completion records for each system, and median offboarding time below 24 hours for privileged accounts and below 72 hours for standard accounts.
What to deploy in mid-market: The process matters more than the tooling. A clear checklist, a named owner, and discipline about executing the process produce better outcomes than any specific tool. The tool that helps most is SSO from Control 1 - if all access flows through SSO, deactivating the SSO account closes most access automatically.
Controls 1-4 - SSO, phishing-resistant MFA, privileged access management, documented offboarding - are the foundation. Without them, the other eight controls cannot reach their potential. With them, most opportunistic attacks become much harder, and the harder attacks become detectable rather than invisible.
For a 50-person operator deploying Controls 1-4 properly: roughly $20K-50K in one-time deployment work plus $15K-30K per year in ongoing licensing and management. The return is durable, the discipline is learnable, and the underwriter compliance is verifiable.
Controls 5-6: Endpoint and email.
Controls 5 and 6 are the operational front line. Email is the most common attack vector. Endpoints are where the attack lands. Together they account for roughly 80% of compromise events that mid-market operators experience. Both have well-established Gartner Leader products. Both pass underwriter and M&A diligence scrutiny when deployed properly. Both fail diligence routinely when delivered as white-label MSP rebrands.
Control 5: EDR (Endpoint Detection & Response) on every endpoint.
What it is: Endpoint Detection & Response. Modern EDR is not antivirus - it is a behavioral monitoring and active-response platform that watches everything happening on each endpoint, detects suspicious patterns, and can isolate compromised machines automatically. The Gartner Magic Quadrant for Endpoint Protection Platforms is the authoritative reference for which products meet the modern definition.
Why it matters: Every modern ransomware attack lands on an endpoint. EDR is the difference between detecting the attack at minute one - when one machine is showing suspicious behavior - versus discovering the attack at hour eight when forty machines are encrypted. The 2025 Mandiant incident response data showed median dwell time (the time between initial compromise and detection) at 11 days for organizations without EDR and 1.6 days for organizations with properly deployed EDR. The order-of-magnitude difference is the whole story.
What passes diligence in 2026: A Gartner Magic Quadrant Leader product, named explicitly. As of 2025, the Leaders are SentinelOne, CrowdStrike Falcon, and Microsoft Defender for Endpoint (Plan 2). Coverage above 95% of endpoints (including servers and workstations). Active 24/7 monitoring of EDR alerts - either internal SOC or a managed service. The product name matters because underwriters and diligence teams verify against published Gartner rankings.
What does NOT pass: White-labeled EDR products sold by MSPs under their own brand. Traditional antivirus (signature-based detection). Free or low-tier consumer products. This is the single most common cyber finding in M&A diligence - the seller says they have EDR, the buyer asks for the product name, and the answer is a brand the buyer has never heard of. Diligence teams immediately escalate.
What Vencer runs and why it matters: Vencer's standard endpoint stack is SentinelOne - a 2025 Gartner Magic Quadrant Leader. The licensing is real, the threat intelligence is verifiable, and any buyer's diligence team can independently validate the posture. SentinelOne's behavioral AI engine catches threats before signatures exist for them, and the autonomous response capability isolates compromised endpoints automatically. This is the same EDR platform used by Fortune 500 SOCs. It is also the platform that lets a managed SOC scale across many clients without losing fidelity per client.
What to deploy in mid-market: Choose one Gartner Leader EDR product and deploy it across every endpoint - every workstation, every server, every laptop, every tablet that connects to the corporate environment. For mid-market operators on Microsoft 365 E5, Defender for Endpoint Plan 2 is included and is a credible choice. For operators without E5, SentinelOne or CrowdStrike with managed SOC service is the most common deployment. Pricing in 2026 ranges from $5-12 per endpoint per month for the EDR product itself, plus the cost of 24/7 monitoring if you don't have internal SOC capacity (which you don't, if you're below 200 people).
Common deployment pitfalls: Three. First, leaving endpoints uncovered - the contractor's laptop, the field tablet, the legacy server that "isn't really used much." Attackers find the gaps. Second, deploying EDR without 24/7 monitoring - the alerts arrive at 2am on Saturday and nobody sees them until Monday. Third, deploying EDR and leaving traditional antivirus in place creating conflicts and false positives. Pick the Gartner Leader, deploy it everywhere, monitor it 24/7, and remove conflicting tools.
Control 6: Email security (Gartner Leader) protecting all inboxes.
What it is: Advanced email security that goes beyond Microsoft 365's or Google Workspace's built-in protection. The 2026 Gartner Email Security category includes Proofpoint, Mimecast, Abnormal Security, and Microsoft Defender for Office 365 (Plan 2). The products use a combination of content analysis, sender reputation, behavioral analysis, and increasingly AI to detect phishing, business email compromise, account takeover, and malware delivery.
Why it matters: Email is the most common initial access vector across all three threat actor categories. Microsoft 365's built-in protection catches the obvious attacks but increasingly misses the targeted ones - the spear-phishing email crafted specifically for your CFO, the AI-generated business email compromise mimicking your CEO's writing style, the invoice fraud targeting your accounts payable team. The advanced products catch these. The basic products don't.
What passes diligence: A Gartner Leader email security product layered on top of (or replacing) the built-in protection of your email platform. Coverage on 100% of mailboxes. Evidence of active tuning over the past 12 months (false positive rate trending down, true positive catches documented). Optionally: DMARC, DKIM, and SPF properly configured to prevent spoofing of your domain.
What does NOT pass: Microsoft 365 or Google Workspace built-in protection alone - they are the floor, not the ceiling. White-labeled email security products. Email security from an MSP that you can't identify by product name. "We use the email security included with our Microsoft 365" is increasingly read by diligence teams as "we have basic protection only."
What Vencer runs and why it matters: Vencer's standard email security stack is Proofpoint - a 2025 Gartner Magic Quadrant Leader for email security. Proofpoint provides advanced threat protection, business email compromise detection, social engineering defense, and post-delivery remediation. The capability to retroactively remediate threats discovered after delivery is increasingly important as attackers increasingly use legitimate cloud services to host phishing payloads that activate after delivery. Microsoft's built-in protection cannot do this at the level Proofpoint can.
What to deploy in mid-market: Layer a Gartner Leader product on top of your existing email platform. For most Canadian energy operators on Microsoft 365, Proofpoint Essentials or Microsoft Defender for Office 365 Plan 2 are the most common choices. Pricing ranges from $3-8 per mailbox per month for the advanced layer. The deployment is non-disruptive - email continues flowing through your existing platform; the advanced layer adds inspection.
Common deployment pitfalls: Two. First, deploying email security without configuring DMARC, DKIM, and SPF properly - which leaves your domain spoofable by attackers and weakens the entire posture. Second, treating email security as a "set and forget" deployment - false positive rates need ongoing tuning, threat intelligence needs ongoing review, and the security team needs to act on the alerts that the product surfaces. An untuned email security platform produces alert fatigue and gets ignored.
For a 50-person operator deploying Controls 5 and 6 with Gartner Leader products and 24/7 monitoring: roughly $15K-30K in deployment plus $25K-50K per year ongoing. That covers EDR licensing, email security licensing, and managed SOC services to monitor the alerts.
The math against the alternative: a single ransomware incident in 2026 averages $500K-$2M in direct ransom and remediation costs, plus operational disruption that often exceeds the direct costs. Even a single prevented incident pays for the controls many times over. The discipline of measuring this - recorded prevented incidents, recorded near-misses, recorded false positives - is part of the governance discipline of Control 12.
Controls 7-8: Backup, recovery, segmentation.
Controls 7 and 8 address what happens when prevention fails. Backup and recovery determine whether a successful attack is recoverable in hours or in weeks. Network segmentation determines whether an IT compromise reaches your OT systems - and the consequence of that reach. Both are increasingly non-negotiable from underwriters and M&A diligence teams.
Control 7: Immutable backups, tested quarterly.
What it is: Backups that cannot be deleted, modified, or encrypted by an attacker - not even by an attacker with administrator credentials. Immutability is achieved through a combination of write-once storage, cryptographic protection, air-gapped or logically-separated environments, and proper retention policies. The 2026 standard is 3-2-1-1-0: three copies of data, on two different media, with one offsite, one immutable, and zero verification errors in the most recent test.
Why it matters: Ransomware groups have learned that the most valuable target during an attack is the backup system itself. If they can encrypt or delete the backups, the victim's only recovery option is to pay. Modern ransomware specifically targets Veeam, VMware, and other common backup infrastructure during the initial reconnaissance phase. The 2025 Zscaler data showed Veeam backup software vulnerabilities as one of the top five exploited categories - not because Veeam is insecure, but because Veeam is everywhere and the backup data is the high-value target.
What passes diligence in 2026: Documented immutable backup architecture. Test restores verified within the past 90 days, with documented evidence. RTO (Recovery Time Objective) and RPO (Recovery Point Objective) defined for each critical system. A specific Gartner Leader backup product - Veeam, Rubrik, or Cohesity - deployed for production data. Air-gapped or immutable copies stored separately from the primary environment. Test restore frequency at least quarterly. "We back up to a NAS" is not adequate.
What Vencer runs and why it matters: Vencer's standard backup stack is Veeam - a 2025 Gartner Magic Quadrant Leader for Enterprise Backup & Recovery. Veeam's hardened repositories support immutability out of the box (S3 Object Lock, Linux hardened repositories, immutability in the Veeam Backup & Replication console). The capability to recover not just files but full production environments - including SCADA systems, historians, and OT data - is what distinguishes Veeam from consumer-grade backup. Veeam combined with proper immutability configuration is what passes 2026 underwriter scrutiny.
What to deploy in mid-market: Choose Veeam or equivalent Gartner Leader, deploy with immutability properly configured (this is critical - Veeam with immutability disabled is not immutable backup, it's just Veeam). Maintain offline or air-gapped copies on a different infrastructure. Test restore quarterly with documented evidence. Pricing for mid-market Veeam deployments ranges from $30-80 per protected workload per month, plus the storage cost for backup data. Total annual investment for a 50-person operator's complete backup environment typically runs $25K-60K depending on data volume.
Common deployment pitfalls: Three. First, deploying backup software without enabling immutability - most operators discover during their first incident that what they thought was immutable backup is actually mutable backup. Second, never testing restores - backup that doesn't restore is not backup. Third, leaving the backup infrastructure on the same network as production - attackers reach the backup through the same compromised credentials they used to reach production. Segmentation between production and backup is part of Control 8.
Control 8: Network segmentation between IT and OT.
What it is: Documented network architecture that separates Information Technology (corporate networks, email, ERP, productivity) from Operational Technology (SCADA, historians, production telemetry, well control systems). Real segmentation includes firewalls between the zones, jump hosts for cross-zone access, logged crossings, and access control policies that prevent direct connections.
Why it matters: The OT/IT bridge is where IT incidents become operational catastrophes. The 3,000% increase in credential-stealing malware on OT systems reported by Claroty in 2024-25 was almost entirely driven by attackers crossing from compromised IT environments into OT. A ransomware incident contained on the IT side is an expensive problem. A ransomware incident that crosses to OT and disrupts production is a catastrophic problem - sometimes with safety and environmental consequences.
What passes diligence: A documented network architecture diagram showing the segmentation. Evidence of firewalls between IT and OT zones with rule sets documented and reviewed. Jump hosts or session brokers for cross-zone access. Logging of crossings with active monitoring. For operators with significant OT footprint (any production company, any service company running well operations), the Purdue Reference Model with proper segmentation between Levels 0-2 (process control) and Levels 3-5 (corporate) is the architectural reference.
What does NOT pass: "We use VLANs" alone - VLANs without firewall enforcement are not segmentation. Flat networks where IT and OT share the same address space. Remote vendor access into OT through the same VPN as IT users. This last one is one of the most common findings in mid-market diligence - the SCADA vendor logs in through the same VPN as the sales team, with the same credentials and the same access path.
What to deploy in mid-market: The technical deployment depends on existing infrastructure, but the principles are universal. Separate firewalls (or separated rules on existing firewalls) between IT and OT zones. Jump hosts or session brokers for any IT-to-OT access - vendor maintenance, remote support, operations team access. Active monitoring of cross-zone traffic. The Canadian Centre for Cyber Security has published specific guidance on industrial control system segmentation that is appropriate for Canadian operators.
Common deployment pitfalls: The biggest pitfall is treating segmentation as a one-time project. Networks drift. New vendors get connected with shortcuts. Emergency changes don't get reviewed. Segmentation needs ongoing governance - at minimum quarterly review of firewall rules, jump host access, and any new connections that crossed zones. Most mid-market operators that deploy segmentation properly discover that maintaining it is harder than deploying it.
Controls 5-6 (endpoint and email) are about preventing the attack. Controls 7-8 (backup and segmentation) are about limiting the damage when prevention fails. Mature cyber programs invest in both - and treat them as complementary rather than competing priorities.
The operators who experience successful attacks and recover well are the ones who had Controls 7-8 working before the incident. The operators who experience successful attacks and become news are the ones who didn't.
Controls 9-12: Monitoring, IR, vendor, governance.
Controls 9-12 are the operational disciplines that make the first eight controls actually work in production. Tooling without monitoring is theatre. Monitoring without response is observation. Response without governance is chaos. The four operational controls are what convert a static cyber program into a live cyber capability.
Control 9: 24/7 monitoring and detection.
What it is: Continuous monitoring of the EDR alerts, email security alerts, identity events, network logs, and OT telemetry - with human analysts available 24 hours a day, 7 days a week, to investigate and respond. The function is typically called a SOC (Security Operations Center). For mid-market operators, the SOC is almost always delivered as a managed service - operators below 200 people cannot economically run an internal 24/7 SOC.
Why it matters: The attacks happen on weekends, at night, during holidays - specifically because attackers know that's when defenses are weakest. The 2025 Mandiant data showed median attack timing peaks at 3am local time of the victim, with Sunday morning being the most common day. An EDR alert at 3am Sunday morning that nobody sees until Monday morning is the difference between containing an attack at one machine and recovering from an attack across forty machines.
What passes diligence in 2026: A named, contractually-defined 24/7 SOC. Documented SLAs for detection and response. Named analysts (or named provider). Evidence of actual incident response over the past 12 months - alerts handled, false positives tuned out, true positives investigated and contained.
What does NOT pass: "Our MSP responds during business hours" - increasingly read by underwriters and diligence teams as "no real 24/7 capability." "We have an EDR product that sends alerts to email" - alerts without humans are not monitoring. "After-hours we use voicemail" is the most damaging finding in cyber diligence in 2026. Most regional MSPs offering "24/7" actually offer business hours plus on-call escalation, which is not the same thing.
What Vencer runs and why it matters: Vencer's 24/7 monitoring is delivered by two sister entities running live NOC/SOC operations in Bangkok and Jakarta. Real infrastructure, real analysts on real shifts, real coverage 24 hours a day across multiple time zones. Live CVE response - when a perfect-score zero-day is announced, the response begins immediately, not on the next business day. This is not unique among Fortune 500 SOC operations - it is unique among mid-market managed services providers, where most "24/7" claims dissolve under inspection. The buyer's diligence team can verify the physical infrastructure, the named analyst rosters, and the documented incident response history.
What to deploy in mid-market: For operators above ~60 people, a managed 24/7 SOC service is the right answer. Cost typically ranges from $3-8 per endpoint per month, in addition to the EDR licensing. The total cost of EDR + 24/7 SOC monitoring for a 50-person operator is typically $25K-50K per year - meaningfully less than a single cybersecurity FTE, with meaningfully better coverage.
Control 10: Tested incident response plan.
What it is: A written incident response plan that addresses the most likely incident types - ransomware, business email compromise, OT incident, data exfiltration, insider threat. The plan names roles (incident commander, technical lead, communications lead, legal counsel, executive sponsor), defines escalation triggers, and includes runbooks for the most likely scenarios. It has been tested in a tabletop exercise within the past 12 months, with documented after-action notes.
Why it matters: Incidents are stressful. The middle of an incident is not when you want to be figuring out who to call, what to tell your insurance carrier, when to involve law enforcement, or how to communicate with partners and customers. The plan exists to provide structure when stress is highest. The tabletop exists to discover the gaps in the plan before the incident, not during.
What passes diligence: A written plan with named roles, defined triggers, and documented runbooks. A tabletop exercise within the past 12 months with documented participation by senior leadership (CEO, CFO, IT lead, operations lead, legal counsel). Documented after-action items with completion evidence. A named external incident response firm on retainer for high-severity incidents. The retainer matters because in the middle of an incident is the wrong time to negotiate terms with an IR firm.
What to deploy in mid-market: Use a published template (NIST SP 800-61 is the canonical reference) and adapt it to your environment. Bring in external help for the first tabletop - fractional CISO support or a dedicated incident response consultancy. Schedule the next tabletop within 90 days of the first. The first tabletop typically surfaces 15-25 gaps in the plan. The second one verifies that the gaps were closed. By the third one, the plan is mature.
Control 11: Vendor cyber attestation.
What it is: A structured program for assessing and documenting the cyber posture of vendors with access to your environment or your data. The vendor categories that matter most: your IT/MSP provider, your production accounting platform, your JIB platform, your remote support tools, your monitoring services, your accounting firm, your law firm, your engineering consultants who access your data.
Why it matters: Supply chain attacks are increasingly common because the math works for attackers. Compromise one vendor, reach dozens of customers. The 2025 attacks on Sitecore, Sisense, and several MSP platforms each reached hundreds of downstream customers. If your vendor is compromised and you have no attestation program, you have no documented basis for understanding what happened to your environment when the vendor's environment was breached.
What passes diligence: A documented vendor risk register. SOC 2 Type 2 reports collected from your top vendors. Documented vendor security questionnaires completed within the past 12-24 months. Contract terms with key vendors that include cyber breach notification, audit rights, and reasonable cyber posture requirements. For partners with persistent access to your production environment, ongoing monitoring of the vendor's cyber posture.
What to deploy in mid-market: The full vendor risk management framework can be expensive. For mid-market operators, the practical approach is a tiered program: for tier-1 vendors (those with persistent access to production or critical data), full SOC 2 review and quarterly check-ins; for tier-2 vendors (those with access to corporate but not production), annual questionnaires and contract review; for tier-3 vendors (low-impact), contract review only. This is one of the controls where mid-market is allowed to be selective - full enterprise-grade vendor risk management is not expected, but documented selectivity is.
Control 12: Cyber governance and tabletop discipline.
What it is: The operational discipline that ties all eleven other controls together. Named accountability - usually a CISO function (internal or fractional). Defined cadence for reviewing posture, alerts, incidents, and metrics. Regular tabletop exercises. Executive-level reporting cadence - typically quarterly to the CEO and board. Annual cyber strategy review aligned to business strategy.
Why it matters: Cyber programs without governance drift. The controls deployed in 2026 degrade by 2027 because nobody is actively maintaining them. The 2025 Verizon Data Breach Investigations Report identified "lack of governance" as the leading contributor to material breaches across the energy sector. Governance is the discipline that prevents the controls from becoming security theatre over time.
What passes diligence: A named CISO function (internal or fractional). A documented cyber strategy aligned to business strategy. Quarterly board reporting evidence over the past 12-24 months. Annual tabletop exercises with documented results. A metrics dashboard that tracks the 12 controls and their status over time. For operators above 100 people, this becomes a formal program with documented governance artifacts; for operators below 100, fractional CISO support delivering the same outputs is acceptable.
What to deploy in mid-market: For most mid-market operators, a fractional CISO function is the right answer. Cost: typically $4,000-8,000 per month for the right level of engagement. That's meaningfully less than a full-time CISO at $250K+ all-in, and meaningfully more capable than "the IT lead also handles cyber" which is the default at most mid-market operators. The fractional engagement provides the governance discipline, the strategic guidance, the board-level reporting, and the relationship with carriers, auditors, and diligence teams that the controls require to function.
Controls 9-12 are what convert deployed cyber controls into a working cyber capability. Without them, the first eight controls become a static deployment that degrades over time. With them, the program is live, adaptive, and verifiable to underwriters, auditors, diligence teams, and partners.
For a 50-person operator: Controls 9-12 cost roughly $60K-100K per year - managed 24/7 SOC, fractional CISO, incident response retainer, tabletop facilitation. That's the operational backbone that makes the rest of the cyber investment work.
OT/IT convergence and the SCADA boundary.
Every Canadian oil and gas operator and most service companies have Operational Technology (OT) - SCADA systems, historians, methane monitoring, well control systems, telemetry, field automation. OT is not optional in this industry. What is optional is how seriously you treat the boundary between OT and IT - and the boundary is increasingly where attacks land.
Why OT is different.
OT systems were designed for reliability, availability, and safety - not security. The protocols are old (Modbus, DNP3, OPC), the patching cycles are slow (some systems can't be patched without taking production offline), and the operating systems are often legacy (Windows XP, Server 2003, embedded Linux). The security assumptions baked into OT design were "this network is air-gapped and only authorized engineers have access." Both assumptions broke a decade ago.
Modern operations expect OT data to flow upstream to corporate IT systems for production accounting, partner reporting, regulatory compliance, and increasingly for AI-driven optimization. The bridge between OT and IT is now an operational requirement, not an exception. Which means the security model has to evolve to accept that OT is reachable from IT - and to manage the reachability through controls rather than wishful thinking.
The Purdue Reference Model, simplified.
The Purdue Reference Model is the architectural standard for industrial network segmentation. It defines five levels, from physical processes at the bottom to enterprise systems at the top. For mid-market Canadian operators, the practical interpretation is:
- Level 0-1: Physical devices and basic controls. Pumpjacks, wellheads, valves, sensors, basic PLCs. These don't connect to anything else most of the time. If they do, the connection is local and tightly controlled.
- Level 2: Local supervisory control. SCADA HMIs, local historians, local engineering workstations. This is where operations engineers actually work day-to-day.
- Level 3: Site operations management. Production scheduling, maintenance systems, regional historians. The bridge between operations and corporate.
- Level 3.5 (the DMZ): Industrial DMZ. The zone between Level 3 and Level 4. This is where data is allowed to flow upstream and where remote access is allowed to flow downstream, with controls.
- Level 4-5: Enterprise/corporate. ERP, email, productivity, web. The IT side of the operation.
The control point is Level 3.5 - the industrial DMZ. Properly designed, the DMZ allows data to flow up (production data to corporate reporting) and access to flow down (engineering access from corporate IT to operations) with logging, authentication, and rule enforcement. Most mid-market operators don't have an industrial DMZ. They have a firewall rule that says "operations can talk to corporate," which is not the same thing.
What good OT/IT segmentation looks like in mid-market.
Mid-market operators are not expected to deploy enterprise-grade ICS security suites. The mid-market bar is more pragmatic: documented architecture, real segmentation between corporate and operations zones, jump hosts for cross-zone access, logged crossings, and ongoing review.
Specific elements that pass diligence:
- A documented network architecture diagram showing the IT zones, OT zones, and the segmentation between them. The diagram identifies which devices live where, which protocols are allowed across boundaries, and where the firewalls enforce the policy.
- A separate firewall (or separated rules on an existing firewall) enforcing IT-to-OT and OT-to-IT policy. The policy is denying everything by default and allowing only specific protocols, ports, and sources. Each allowance is documented with business justification.
- Jump hosts or session brokers for any cross-zone access - vendor maintenance, remote support, operations team access from corporate networks. The jump hosts log every session, require strong authentication, and enforce time-bound access.
- Active monitoring of cross-zone traffic. Either inline tooling (network detection and response on the OT/IT boundary) or log aggregation that flows into the SOC. Crossings that aren't monitored are crossings that attackers can exploit invisibly.
- Regular review of firewall rules and jump host access. Quarterly minimum. Networks drift, new vendors get connected with shortcuts, emergency changes don't get reviewed. The review catches drift.
The remote vendor access problem.
The single most common OT/IT vulnerability in mid-market is remote vendor access. The SCADA vendor needs to log in to fix something. The historian vendor needs to push an update. The instrumentation vendor needs to diagnose a sensor. If they're logging in through the same VPN as the sales team, with the same credentials, you have a problem.
The proper architecture: vendor access flows through a dedicated session broker (or properly configured jump host) into the OT environment. Each vendor has their own credentials, scoped to the specific systems they need to access. Each session is recorded. Sessions are time-bound - when the vendor is finished, access expires automatically. Vendors don't have persistent access; they request access when needed and the request is approved or denied based on context.
The tooling: BeyondTrust Privileged Remote Access, CyberArk Privileged Session Manager, or for mid-market operators, properly configured Microsoft Entra Privileged Identity Management combined with Azure Bastion. The implementation effort is meaningful but the security gain is large - and the discipline that comes with it has compounding benefits across the rest of the cyber program.
OT-specific incident response.
Standard IT incident response procedures don't always work for OT. "Isolate the affected system from the network" can mean "shut down production" for OT systems. The incident response plan needs to address OT scenarios specifically: who has authority to take production offline, what the safety implications are, how to recover OT data and OT systems after an incident, who from the OT side participates in incident response.
The Costa Rica RECOPE incident is the canonical reference. When the IT environment was compromised, RECOPE made the decision to revert to manual operations rather than risk OT compromise. That decision was correct - but it depended on having manual fallback procedures documented, manual gauging available, and operators trained to operate without the digital systems. Most mid-market operators in Canada have not thought through what "operating without the digital systems for 72 hours" actually means.
OT is the part of mid-market oil and gas that supermajor cyber programs handle with dedicated ICS security teams. Mid-market operators don't have that luxury - but they also don't need it. What they need is documented segmentation, controlled cross-zone access, monitoring of crossings, and an incident response plan that addresses OT specifically.
The deployment is meaningful but achievable. The cost is real but bounded. The alternative is the Costa Rica RECOPE outcome - operating manually for days while the cyber team works through what should have been a contained IT incident.
Cyber insurance - what 2026 underwriters require.
The cyber insurance market in 2026 looks meaningfully different from the market five years ago. Premiums have stabilized but underwriting requirements have tightened significantly. Mid-market operators who could buy cyber insurance with a basic questionnaire in 2021 now face detailed technical attestations, occasional pre-binding audits, and material deductibles. The market is more disciplined and the insurance is more valuable - but only if you can pass underwriting.
What changed between 2022 and 2026.
2022 was a hard market. Premiums spiked, capacity contracted, exclusions multiplied. Carriers lost money on the ransomware wave of 2021-22 and responded by tightening underwriting across the board. By 2024, the market had stabilized - premiums normalized, capacity returned, but with new minimum control requirements that became table stakes for any meaningful coverage. 2025-26 added another layer of tightening driven specifically by the energy sector ransomware surge and the post-Halliburton incident environment.
The current state: carriers want to see specific controls deployed and documented before they bind coverage. "We have antivirus and a firewall" no longer qualifies for serious cyber coverage. The detailed underwriting questionnaires now include 80-200 specific questions about controls, products, and operational practices.
The 2026 underwriter checklist.
What carriers serving Canadian energy mid-market are looking for in 2026, organized by the same twelve controls framework:
- Identity (Controls 1-4): SSO with MFA on at least 95% of accounts. Phishing-resistant MFA (FIDO2 or number-matching) on privileged, executive, and remote-access accounts. Documented offboarding with evidence. PAM for privileged accounts. SMS-based MFA is increasingly being flagged or excluded.
- Endpoint (Control 5): EDR deployed on every endpoint, with the carrier wanting to know which product. Gartner Leader products pass. Coverage above 95%. 24/7 monitoring of EDR alerts.
- Email (Control 6): Advanced email security beyond built-in protection. DMARC enforced. Phishing simulation training conducted at least annually.
- Backup (Control 7): Immutable backups verified within 90 days. 3-2-1 minimum, 3-2-1-1-0 preferred. Documented test restore evidence.
- Segmentation (Control 8): Documented IT/OT segmentation for operators with OT. Network architecture diagrams available on request.
- Monitoring (Control 9): 24/7 SOC capability - internal or managed. Named provider. Documented SLA. Evidence of actual incident handling over the past 12 months.
- Incident response (Control 10): Written incident response plan. Tabletop exercise within past 12 months. Named external IR firm on retainer for high-severity incidents.
- Vendor (Control 11): Vendor risk register. SOC 2 reports for top vendors. Contract terms including breach notification.
- Governance (Control 12): Named CISO function (internal or fractional). Board-level cyber reporting cadence.
Operators who can answer all of these affirmatively get the best rates and the broadest coverage. Operators who can't either pay materially higher premiums, accept narrower coverage with broader exclusions, or - increasingly - get declined for serious coverage entirely.
Coverage details that matter.
Beyond underwriting, the actual policy terms matter substantially. Things to look for in your 2026 cyber policy:
Coverage limits. Most mid-market policies range from $1M to $25M aggregate limit. The right limit depends on revenue, operational scale, and concentration risk. For a $50M revenue operator, $5M-$10M aggregate is the typical comfortable range - enough to cover ransom plus remediation plus business interruption for a meaningful incident.
Ransomware-specific limits and sub-limits. Some policies cap ransomware coverage separately from other cyber events. Read carefully. The sub-limit can be meaningfully lower than the aggregate limit.
Business interruption coverage. Cyber incidents that disrupt operations - even briefly - generate business interruption costs. Coverage exists but the trigger conditions vary significantly between carriers.
Waiting periods. Most policies have waiting periods before business interruption coverage kicks in. Common waiting periods are 8-24 hours. If your operations are time-sensitive and a 12-hour disruption causes substantial loss, a long waiting period materially reduces the coverage value.
Dependent business interruption. Coverage for losses caused by cyber incidents at your vendors or partners. This is increasingly important as supply chain attacks become more common. Most older policies don't include this coverage; newer policies vary widely.
Regulatory exposure. Coverage for regulatory fines and investigation costs. The Canadian Centre for Cyber Security and PIPEDA exposure makes this meaningful for Canadian operators. International operations add complexity - your Bangkok or Houston exposure may not be covered by a Canadian-issued policy.
Reputation harm. Coverage for the costs of managing reputational damage post-incident. Communications consultants, customer notification, partner reassurance. Often a sub-limit; sometimes excluded.
What carriers are doing differently in 2026.
Three trends worth knowing:
Pre-binding cyber audits. For larger limits or operators with risk profiles that warrant it, carriers are increasingly requiring a pre-binding cyber audit conducted by their nominated provider. The audit can either confirm coverage or generate findings that require remediation before binding. Plan for this in your renewal timeline.
Active monitoring during the policy period. Some carriers now offer (or require) ongoing monitoring of your external attack surface during the policy period. New vulnerabilities, exposed services, or compromise indicators trigger notifications to the insured. This is closer to a security service than traditional insurance, and it's increasingly common.
Coverage for ransom payments is becoming conditional. Some carriers are limiting ransom payment coverage to specific circumstances - for example, requiring law enforcement notification, requiring the carrier to negotiate the ransom, or excluding coverage for payments to specific sanctioned threat actor groups. The mid-2025 OFAC sanctions guidance on ransomware payments accelerated this trend.
Cyber insurance in 2026 is genuinely valuable - but only if you can pass underwriting and only if you read the policy carefully. The right framing is that cyber insurance is the financial backstop on top of operational controls, not a substitute for them. Operators who deploy the twelve controls properly are also the operators who get the best coverage at the best rates.
Operators who try to use insurance as a substitute for controls discover that the policy either won't bind, won't pay, or won't pay enough to matter. The discipline of the controls and the discipline of underwriting reinforce each other - which is why mature cyber programs always include both.
The white-label MSP problem.
This chapter is direct about a structural problem in the mid-market managed services industry. Most regional MSPs serving Canadian oil and gas mid-market are selling white-labeled or rebranded cyber tools - products built by mid-tier security vendors and resold under the MSP's brand. The pattern is profitable for the MSP and convenient for the operator who doesn't want to think about cyber. It is increasingly catastrophic in 2026 cyber insurance renewals, M&A diligence, and actual security outcomes.
This chapter does not name names of competing MSPs. It describes the pattern, explains why it exists, what it costs operators, and how to evaluate whether you are exposed to it. The framework applies to evaluating any MSP, including Vencer. Use it as a diligence tool.
Why white-label MSP cyber exists.
Three reasons, in approximate order of business motivation:
One - margin. White-label products are typically purchased by the MSP at wholesale and resold at retail. The MSP makes 30-50% margin on the cyber product line, sometimes more. Reselling Microsoft Defender or SentinelOne directly to clients at the vendor's published mid-market price provides much narrower margin to the MSP.
Two - lock-in. Clients on white-label products can't easily switch MSPs because the product is branded as the MSP's. Migrating to a different provider means migrating the cyber stack, which is disruptive and expensive. The MSP's branded product is the lock-in mechanism. The client doesn't realize they're locked in until they try to leave.
Three - narrative simplicity. Selling "our cyber platform" is easier than selling "we deliver SentinelOne, Proofpoint, and Veeam with managed services." The branded narrative is cleaner for sales conversations and feels more proprietary. The narrative is also harder for the client to verify.
What white-label MSP cyber actually means.
Behind the branded interface, white-label MSP cyber products typically resolve to one of three underlying technologies:
- A mid-tier security vendor's white-label OEM offering. The underlying product is real but is a tier or two below the Gartner Leaders. Often lacks the threat intelligence integration, the advanced detection capabilities, or the operational scale of the Leaders.
- A bundle of commodity security tools wrapped in custom UI. The underlying components are real products, but the integration is shallow - alerts from one tool don't correlate with alerts from another, and the operational outcome is a collection of tools rather than a cohesive security capability.
- A discontinued or end-of-life product still being sold to existing customers. The MSP is monetizing the back end of a product lifecycle even though the vendor has effectively abandoned the platform. This is more common than most operators realize.
None of these patterns are inherently dishonest. They become problematic when the client is led to believe they're getting Fortune 500-grade cyber capability when they're getting something meaningfully less.
How to tell if your MSP is using white-label cyber.
Six diagnostic questions. Ask your MSP these questions and pay attention to how they answer:
One: What is the actual product name of your EDR? Is it on the 2025 Gartner Magic Quadrant for Endpoint Protection Platforms? If the answer is "[MSP brand] EDR" and you can't find it on Gartner, you're likely on white-label.
Two: What is the actual product name of your email security? Is it on the 2025 Gartner Magic Quadrant for Email Security? Same logic.
Three: What is the actual product name of your backup software? Is it Veeam, Rubrik, Cohesity, or another Gartner Leader? Or is it [MSP brand] Backup?
Four: Where is your 24/7 SOC physically located? Can you name the cities? Is it your MSP's office, or is it a real 24/7 operation? "Calgary, with on-call escalation" is not 24/7 operation.
Five: Can you take the cyber stack with you if you change MSPs? "Yes, here are the underlying products and your licenses transfer" is the right answer. "It would require migration" suggests proprietary lock-in.
Six: What was the last cyber incident your MSP responded to? Cyber MSPs see incidents in their client base regularly - once a quarter at minimum across a 50-client portfolio. If your MSP can't describe a recent incident response, they may not have the operational scale to be a serious cyber provider.
What it costs to be on white-label MSP cyber.
Three categories of cost, in approximate order of materiality:
Cyber insurance renewals. Increasingly, carriers reject white-label cyber as not meeting their underwriting criteria. The operator gets quoted a higher premium, narrower coverage, or in some cases declined entirely. Migrating from white-label to named industry-standard tooling typically reduces premiums by 10-25%, often more than the cost of the migration itself.
M&A diligence. White-label cyber is now the single most common cyber finding in mid-market M&A diligence. Buyers either require remediation as a closing condition or price in the cost of replacing the stack. The deal multiple impact is 0.2-0.5×, plus often $500K-$2M of escrow holdback for cyber reps. For a $50M EBITDA service company, that's $10M-$25M of enterprise value at risk.
Actual security outcomes. Less measurable, but real. White-label cyber tools detect fewer attacks, respond slower, and recover less cleanly than named industry-standard tooling with proper 24/7 operations. Most operators don't notice the gap until an incident exposes it.
What Vencer runs, and why this chapter is direct about it.
Vencer Group does not white-label cyber. The stack is named, industry-standard, and verifiable. SentinelOne for EDR - 2025 Gartner Magic Quadrant Leader. Proofpoint for email security - 2025 Gartner Magic Quadrant Leader. Veeam for backup - 2025 Gartner Magic Quadrant Leader. Microsoft Entra for identity - the enterprise identity standard. The 24/7 SOC operates across two sister entities in Bangkok and Jakarta - real infrastructure, real analysts, real coverage.
This is named explicitly in this chapter because the white-label MSP cyber problem is real, structural, and rarely visible to clients until something forces visibility - usually a cyber insurance renewal, an M&A transaction, or an incident. The diligence questions in this chapter apply equally to Vencer. Any operator evaluating Vencer should ask the same six questions and verify the answers independently. Gartner publishes the Magic Quadrant rankings publicly. The product names are searchable. The capabilities are verifiable.
The point is not that Vencer is the only good choice. The point is that the criteria for "good" are knowable, the products that meet the criteria are named, and any operator can evaluate any MSP against the criteria with thirty minutes of research. The white-label problem persists because most operators have not done the thirty minutes.
If you are evaluating your current MSP or considering a new one, the six diagnostic questions in this chapter are the framework. Ask the questions. Verify the answers. Match against Gartner's published rankings. An MSP that delivers Gartner Leader products under their own names, with documented 24/7 operations and verifiable incident response history, is what passes 2026 cyber insurance, M&A diligence, and actual security outcomes.
An MSP that cannot answer the questions affirmatively is a risk you are carrying. The risk shows up at the worst possible moments - during an insurance renewal, during a diligence process, or during an incident.
How to choose your cyber stack.
Mid-market operators choosing a cyber stack - whether internally managed or delivered through an MSP - face a real selection problem. There are dozens of vendors in each category. Most claim Gartner Leader status (the ones who actually have it, and the ones who interpret the language creatively). Pricing is opaque. Comparisons are hard. This chapter is the framework for making the choice with confidence.
The framework: six categories, six choices.
For mid-market operators, the cyber stack reduces to six product categories. Pick one product per category from the Gartner Leader quadrant, deploy them properly, manage them with discipline, and you have a defensible cyber posture.
The selection criteria that matter.
Beyond Gartner Leader status, four criteria distinguish good choices from bad choices in mid-market:
One - operational scale of deployment. Does the vendor have meaningful mid-market customer base in Canadian energy? Vendors who serve enterprise primarily often have under-resourced mid-market support. Vendors who serve mid-market primarily sometimes lack the depth of enterprise capability. The sweet spot is vendors with serious capability in both segments.
Two - channel partner quality. Most mid-market operators interact with these products through an MSP or solution provider. The quality of that partner matters as much as the product. A great product delivered by a weak partner produces weak outcomes. A good product delivered by a strong partner produces strong outcomes.
Three - total cost of ownership including operations. The product license is rarely the largest cost. Implementation services, ongoing tuning, alert investigation, incident response - these are often two to three times the license cost. Comparing products on license cost alone is the wrong comparison.
Four - integration with the rest of your stack. The products that work well together produce compound value. Microsoft Defender for Endpoint integrated with Microsoft Entra produces a different outcome than SentinelOne integrated with Okta - different doesn't mean better or worse, but the integration shape matters. Pick products that work well with each other, not just the best products in isolation.
The MSP selection framework.
For most mid-market operators, the cyber stack is delivered through an MSP. The MSP selection is therefore the cyber stack selection. Six criteria for evaluating an MSP for cyber-heavy mid-market work:
- Named Gartner Leader products. Not white-label. The MSP delivers the products under the vendors' real names, with verifiable licensing.
- Real 24/7 SOC. Not "business hours with on-call escalation." A documented 24/7 operation with named locations, named analysts (or named provider partnerships), and contractual SLAs.
- Energy sector experience. Specifically Canadian oil and gas mid-market. Knowledge of OT/IT challenges. Experience with the regulatory environment.
- M&A experience. Can they support a transaction - buyer side or seller side - through the cyber diligence process? Have they done it before?
- Incident response history. Documented history of incidents handled in client environments, with appropriate references (anonymized).
- Multiple engagement models. Bundled for operators who want full ownership; co-managed for operators with internal IT who need reinforcement; fractional for smaller teams. An MSP with only one engagement model is rigid and usually overpriced for some segment.
The questions to ask in the evaluation:
- Show me the Gartner Magic Quadrant for each of the six categories. Tell me which product you would deploy in each. Tell me what the licensing model looks like.
- Where is your SOC physically located? What hours does it cover? How many analysts do you have on shift at 3am Sunday?
- Show me three recent incidents you've responded to. Anonymize the clients. Walk me through detection, containment, recovery.
- What other Canadian energy clients can I speak with as references? How long have they been with you? What was their cyber posture before vs. after?
- What does the engagement look like in the first 90 days? What does it look like in year two?
The answers tell you everything you need to know. Strong MSPs answer crisply with specific names, specific numbers, and specific references. Weak MSPs answer with marketing language and generalities.
Mid-market cyber stack selection is not rocket science. The Gartner Leader products are knowable. The MSP evaluation criteria are knowable. The total cost of ownership is computable. Most mid-market operators end up with mediocre cyber posture not because the choices are hard but because the diligence didn't get done.
An evening of research and a half day of MSP conversations is enough to make the right choice. The operators who skip the diligence pay for it later, in the cyber insurance renewal or the M&A diligence or the incident.
Measuring cyber posture.
Cyber posture is measurable. Most mid-market operators don't measure it, which is why they discover the gaps at the wrong moments - during the insurance renewal, during M&A diligence, or during an incident. The discipline of measurement is what converts cyber from a vague worry into a managed business risk.
This chapter is the measurement framework. Six metrics that capture cyber posture comprehensively, with targets appropriate for mid-market operators in 2026.
Metric 1: Control coverage score.
Against the twelve controls, what percentage are fully deployed, fully documented, and recently tested? Target for operators in the 80-200 person range: above 90%. Target for operators in the 25-80 person range: above 75%. Below 60%, you are not M&A-ready and probably not insurance-renewal-ready.
How to measure: structured self-assessment against the twelve controls, ideally validated by an external review annually. Track the score over time. Improvement of 5-10 points per quarter is a reasonable trajectory during the catch-up phase.
Metric 2: Mean time to detect (MTTD).
From the time an attacker establishes initial access in your environment to the time your security operations detect them. Target: under 24 hours for sophisticated threats; under 1 hour for opportunistic threats.
How to measure: track every alert investigation that resulted in a true positive (real threat). Compute the elapsed time from compromise indicator to detection. Most mid-market operators discover when they start measuring this that their MTTD is days or weeks, not hours. Closing the gap is the value proposition for 24/7 SOC services.
Metric 3: Mean time to respond (MTTR).
From detection to containment. Target: under 1 hour for high-severity incidents; under 4 hours for medium-severity. The MTTR is what determines whether a detected attack becomes a contained incident or a spreading catastrophe.
How to measure: same source as MTTD. Compute the elapsed time from detection to containment for each true positive. MTTR scales with operational maturity - a 24/7 SOC with documented runbooks produces materially better MTTR than an ad-hoc response model.
Metric 4: Patch latency.
From the time a critical vulnerability is disclosed to the time you have it patched in your environment. Target for critical-severity vulnerabilities with active exploitation: under 72 hours. Target for high-severity without active exploitation: under 30 days.
How to measure: track CVE disclosure dates against your patching evidence. Compute the elapsed time. Critical vulnerabilities on internet-facing devices are where the math is most unforgiving - these need to be patched within hours, not weeks. The Zscaler 2025 data showed exploitation timelines compressed to under 72 hours for most major disclosures.
Metric 5: Phishing simulation pass rate.
Regular phishing simulations against your workforce, with the pass rate tracked over time. Target: above 95% click resistance, above 99% credential entry resistance. The metric captures the cultural side of cyber posture - the workforce's actual behavior under realistic threat conditions.
How to measure: quarterly phishing simulation campaigns. Track who clicked, who entered credentials, who reported the email. Improvement over time matters more than the absolute number - a 70% pass rate that improves to 95% over twelve months is a better signal than a flat 90% over the same period.
Metric 6: Incident frequency and severity distribution.
Counts of incidents experienced by severity tier, tracked over time. Target: declining critical-severity count; stable or declining high-severity count; increasing low-severity detection count. The pattern matters more than any single number - increasing low-severity detection is actually a good sign because it means you're catching the early indicators.
How to measure: incident log with consistent severity classification. This is the metric your board cares about most because it's the closest thing to "are we getting safer or less safe."
The composite cyber posture score.
Combine the six metrics into a single composite score:
- Control coverage: 30%
- MTTD: 15%
- MTTR: 15%
- Patch latency: 15%
- Phishing simulation pass rate: 10%
- Incident frequency trend: 15%
Compute quarterly. Report to the board. Operators who execute the 90-day cyber deployment program typically move from a composite score of 40-50% to 75-85% within the program window. The compounding then continues - by the end of year one of active management, scores of 90%+ are achievable.
What gets measured gets managed. Operators who report cyber posture to their boards quarterly outperform operators who don't. The reporting discipline forces the operational discipline. The operational discipline produces the posture. The posture survives diligence and underwriting.
The six metrics are simple to compute once the underlying controls are in place. The work is not in the measurement; the work is in deploying the controls that produce the measurements.
Three postures. Three 90-day plans.
The right cyber 90-day plan depends on where you are starting. Three honest starting postures cover most Canadian energy mid-market operators in 2026. Each posture has a different 90-day plan. Pick the one that matches your actual situation and execute it.
Posture A: Catching up - control coverage below 60%.
You are below the floor. Your cyber insurance renewal is at risk. Your M&A readiness is poor. Your actual incident risk is elevated. The 90-day plan is the catch-up - get to defensible posture across the twelve controls in three months, then iterate from there.
Days 1-30: Foundation. Deploy Controls 1-4 (identity foundation). SSO with phishing-resistant MFA on every account. Documented offboarding. Inventory of privileged accounts. This is the foundation everything else depends on; nothing else compounds without it.
Days 31-60: Front line. Deploy Controls 5-6 (endpoint and email). Gartner Leader EDR on every endpoint with 24/7 monitoring. Gartner Leader email security on every mailbox. This stops 80% of opportunistic attacks.
Days 61-90: Resilience and operations. Deploy Controls 7-10 (backup, segmentation, monitoring, IR). Immutable backups verified. IT/OT segmentation documented and enforced. 24/7 SOC operational. Written incident response plan with first tabletop scheduled. You now have defensible posture across the most critical controls.
Days 91+ continue with Controls 11-12 (vendor attestation, governance) and the deeper work on the controls deployed in the first 90 days.
Posture B: Hardening - control coverage 60-85%.
You have the basics but the controls are not yet diligence-defensible. Identity is mostly deployed but MFA coverage has gaps. EDR is in place but the 24/7 monitoring is weak. Backups exist but immutability is uncertain. The 90-day plan is hardening - close the specific gaps that prevent diligence pass.
Days 1-30: Gap assessment. Honest audit against the twelve controls with specific deficiencies identified. Engage external review if possible - fractional CISO or external cyber assessor. The audit produces the gap list.
Days 31-60: Critical gap closure. Close the top five gaps identified in the audit. Common patterns: extending MFA coverage to remaining accounts, upgrading EDR product to a Gartner Leader, configuring backup immutability properly, implementing real 24/7 monitoring vs. business-hours-only.
Days 61-90: Documentation and validation. Document the deployed posture comprehensively. Run a tabletop exercise. Schedule a third-party validation if possible. Posture B operators are usually 60-90 days of focused work away from diligence-defensible state; the program just needs structure and execution.
Posture C: Maturing - control coverage above 85%.
You have defensible posture and need to keep improving. The 90-day plan is maturation - deepening the existing controls, increasing the operational discipline, and addressing the long-tail risks that distinguish good from excellent.
Days 1-30: Threat intelligence integration. Connect your SOC operations to current threat intelligence. Tune your detection rules based on actual threat actor TTPs targeting Canadian energy. Run a red team exercise or penetration test.
Days 31-60: OT/IT depth. Deepen the OT/IT segmentation. Implement OT-specific monitoring if not already in place. Run an OT-specific tabletop exercise. Address the supply chain depth that most mid-market operators don't reach.
Days 61-90: Governance maturity. Implement board-level cyber metrics. Run a comprehensive incident response exercise. Refresh the cyber strategy document to align with current business strategy. Posture C operators are not catching up; they are differentiating on cyber as a competitive advantage.
The honest cost of each posture.
For a 50-person operator, executing one posture properly over the first 90 days, with external advisory and tooling support:
- Posture A (catching up): $80K-$150K in the first 90 days, then $80K-$150K per year ongoing.
- Posture B (hardening): $40K-$80K in the first 90 days, then $60K-$120K per year ongoing.
- Posture C (maturing): $30K-$60K in the first 90 days, then $80K-$140K per year ongoing.
For all three postures, the ongoing cost is roughly $60K-$150K per year. That's meaningfully less than a single cyber FTE at $200K all-in. It's meaningfully less than the cost of a single ransomware incident. It's meaningfully less than the M&A multiple impact of failing diligence on cyber. And it produces underwriter-defensible, diligence-defensible, attack-defensible posture.
The companies still standing after the next incident.
Eleven years of managed security operations, zero data breaches across the environments under my governance. Not because we are uniquely talented. Because we deploy the twelve controls correctly, monitor them 24/7 from real infrastructure, and govern them with discipline that doesn't drift. The math works when the discipline holds.
The threat picture in 2026 is what it is. Mid-market is the target. The 935% increase in oil and gas ransomware doesn't reverse. Generative AI makes attackers more capable, not less. The Halliburton incident, the RECOPE attack, the cyber insurance underwriting tightening, the M&A diligence escalation - none of it gets walked back. The operators who treat cyber as a primary business risk in 2026 are the operators still standing in 2028.
If you take one thing from this book, take this: the twelve controls are not optional anymore. They are what passes underwriting. They are what passes diligence. They are what stops opportunistic attacks. They are what limits the damage when prevention fails. They are deployable. They are affordable. They are measurable. And they are the difference between being the operator on the news and being the operator who quietly continues to do business while a competitor is on the news.
The work is not glamorous. SSO and MFA. EDR and email security. Immutable backups and network segmentation. 24/7 monitoring and tested incident response. Vendor attestation and governance discipline. None of it makes for a compelling presentation. All of it makes for a defensible business.
And one last thing. The discipline is patient. The cyber program you build in 2026 compounds across the cycle. The controls deployed at $107 oil keep running when oil is at $47. The team trained on tabletop exercises in the upcycle responds well in the downcycle when an attack lands. The insurance program you build during a quiet period pays out cleanly during a noisy one. The companies that build their cyber properly in 2026 are the companies that don't have to rebuild it after the next incident.
Twelve controls. Three postures. Two sister entities on shift in Bangkok and Jakarta as I write this, watching for the next anomaly. One choice. Build accordingly.
Eleven years. Zero breaches. Twelve controls. Two sister entities. One choice. Build accordingly.
- James D. Boyd
CALGARY · BANGKOK · JAKARTA
Vencer Group
Managed IT and cybersecurity built for the way your business actually runs.
Vencer Group is Calgary's managed IT, M&A technology, and cybersecurity partner - built for energy, advisory, and regulated businesses with international ambitions. Nineteen years in business. Two oil price collapses survived alongside our clients. Eleven years of managed security operations with zero data breaches. Thirty-plus M&A transactions delivered. More than $12 billion in transaction value guided. Delivery across four continents - with live infrastructure under management right now in Calgary, Bangkok, Jakarta, and Singapore.
Most MSPs sell hours. We deliver outcomes the operator, the CFO, the underwriter, and the board all need.
Three engagement models. One team that knows your industry.
Most managed IT firms force you into one shape. Vencer meets you where you are - whether you want full ownership, you already have an IT person who needs reinforcement, or you're a smaller team scaling fast.
Things most Calgary MSPs can't say.
The Cyber-and-the-Cycle Assessment
Three to five days. Written report. No obligation. A structured review of your cyber posture against the twelve controls, with specific findings, a 90-day remediation plan, and a budget. You leave with a written assessment covering the twelve controls, your current posture score, your specific gaps, and a 90-day plan with named owners. No hype. No vendor pitch. Just the truth about where you are and what to do next.
Calgary, AB T2P 3J4
Operator opinion built from field work. Not legal, regulatory, or certified security advice. Every organization carries different variables. Use this as a thinking framework, not a compliance checklist.
→ Book the 30-min review