About

Patch & Retainer explains how managed cybersecurity services are priced for Canadian small and mid-sized businesses, so owners, office managers, controllers and IT leads can read a quote, compare options on the same basis and ask better questions before signing.

We cover what managed security service providers (MSSPs), managed detection and response (MDR), SOC-as-a-service, managed endpoint and firewall services, virtual CISOs and penetration testers typically include; the pricing models they use; and the Canadian rules that change the real cost: breach reporting under PIPEDA, Quebec's Law 25 and Alberta's PIPA, the Critical Cyber Systems Protection Act, CyberSecure Canada and the Cyber Centre baseline controls, the Criminal Code rules behind pen-test authorisation, and GST/HST/QST.

We do not rank, score or review providers, publish testimonials or case studies, or state any provider's price. Where we name a company, it is only as an example of a category. Every price on this site is an illustrative example that shows how the arithmetic works; real prices come from a provider's dated price page or written quote. Rules are checked against official sources such as Justice Laws, the Office of the Privacy Commissioner, the Commission d'accès à l'information and the Canadian Centre for Cyber Security, and we hedge anything we could not confirm.

This site is general information, not legal, tax, insurance or security advice. During an active incident, contact a qualified incident-response firm, your insurer and, where appropriate, the police.

How this site is made

Patch & Retainer is an independent information project. Guides are drafted with the help of AI writing tools and checked against official and primary sources before publication; see our Editorial Policy. We are not affiliated with any provider mentioned on the site and do not sell products or services.