Are you exposed? Find out in five minutes.
Twelve questions across the cyber risks that actually matter for Canadian oil & gas companies of 10–100 people. Answer honestly. See where you stand. No email required.
Ransomware attacks on oil & gas surged 935% globally between April 2024 and April 2025 (Zscaler). The Canadian Centre for Cyber Security’s 2025–2027 outlook names ransomware the top cybercrime threat to Canadian critical infrastructure through 2027. The questions below are the ones that separate the operators that survive a cyber event from the ones that don’t.
Quick answer
The Vencer Cyber Risk Self-Score is twelve calibrated questions a Canadian oil & gas operator or service company (10–100 people) answers in about five minutes. It scores your posture against the twelve controls underwriters actually check in 2026 and returns a defensible, board-ready summary you can take into your next renewal conversation. No email required.
When someone in your company requests a wire transfer, or a vendor asks to change their payment details, do you verify the request through a separate channel - a phone call to a known number - before acting?
Critical ControlIf you discovered a breach at 2am tonight - who do you call first, what gets shut down, who tells your team and your customers? Is any of that written down somewhere people can actually find it?
Critical ControlDoes everyone in your company have to confirm logins with a code from their phone or an authenticator app (sometimes called “MFA”) - with no exceptions for executives, field crews, or contractors?
Critical ControlDo you have backups of your important data stored somewhere an attacker can’t reach or encrypt - and have you actually tested the restore process in the last 90 days?
Critical ControlIf something bad happened on a Saturday night - accounts taken over, data being stolen, systems acting strange - would a monitoring service catch it and start responding within minutes?
High ImpactDo your computers, servers, and equipment - including the equipment at field locations - get their critical security updates installed within 30 days of release?
High ImpactWhen was the last time someone checked your remote access - the way people connect to your systems from outside the office - to make sure nothing is exposed, outdated, or still using default passwords?
High ImpactDo you know exactly who has the highest level of access - the “admin” accounts that can change anything on your systems? And is that list short, current, and reviewed regularly?
High ImpactWhen someone leaves your company, are their accounts and access removed completely within 24 hours - email, shared drives, accounting systems, vendor portals, everything?
ImportantWhen your team uses personal phones or laptops to access work email or files, do you have a way to remotely remove that access if the device is lost or the person leaves?
ImportantHas anyone specifically set up your email to catch phishing - the fake messages pretending to be your CEO, your bank, or a vendor? (Microsoft 365 and Google have stronger filters available, but they’re off by default.)
ImportantDo you carry cyber insurance with good coverage? And in the last 18 months, has your policy been stable - no decline, no cancellation, no sharp premium increase?
High ImpactAnswer all 12 questions to see your score, your top gaps, and a 30/60/90-day action plan. No email required.
Your highest-priority gaps
The questions below scored lowest - and each one represents a real, concrete exposure. Critical Controls (weighted 2×) appear first because their failure most directly enables a material event.
What to do in the next 90 days
Prioritized for impact and feasibility. None of these require a major IT project to start - they require decisions you can make this quarter.
Optional
Want this emailed to you?
Your score, top gaps, and 30/60/90-day plan delivered as a PDF you can forward to your CFO or take into your next renewal call. No follow-up sequence unless you reply.
We don't sell lists. One email, then silence unless you reply. Skipping this is fine - your score and plan are already shown above.
Book a free 30-minute Cyber Posture Review
In 30 minutes, a senior Vencer engineer - not a sales rep - walks through your specific gaps with you, pressure-tests the answers above, and gives you a one-page summary of where you stand and what to address first. No pitch. No follow-up sequence unless you ask for one. Just the truth, from a Calgary partner with 19 years and zero data breaches in 11 years of managed security.
A self-assessment tool, not a certified audit. Results reflect self-reported inputs and pattern-matched benchmarks from operator experience. For a verified assessment, the IT Assessment is the appropriate step.
→ Book the 30-min review