Managed detection and response

Managed security services with people watching, not just software alerting

Security tools generate alerts around the clock. Effective managed security connects those alerts to people, approved response actions and the systems your business depends on. Canada Create provides 24/7 monitoring and analyst triage within the agreed coverage, with endpoint, identity, email and cloud services, vulnerability management and practical reporting. The Agreement identifies monitored assets, service hours, severity-based response targets, containment authority and escalation contacts. No service can guarantee that every threat is detected or contained.

What managed security includes

Managed detection and response (MDR)

We deploy and manage endpoint detection and response on the supported devices in scope, with Microsoft 365 or Google Workspace identity signals, email protection and cloud logs where configured. Analysts triage the agreed telemetry around the clock. Approved playbooks define when people or automation may isolate a device, disable an account or block a sender, and when client authorization is required. Collection gaps, licensing limits and unsupported assets remain visible.

Vulnerability management

We scope recurring or continuous vulnerability scanning across approved external and internal assets, then prioritize findings using exploitability, exposure, business impact and available fixes. Patching is coordinated with your IT provider or implemented by us where authorized, with change windows and verification. A penetration test can investigate exploitable paths in greater depth; scanning and remediation tracking do not replace that work or guarantee that every gap stays closed.

Dark web and credential monitoring

Credential-exposure monitoring checks available breach intelligence and other permitted sources for agreed domains, executive identifiers and employee accounts. A finding prompts validation, affected-account review and approved reset or MFA actions. Coverage is limited to accessible sources; an absent alert does not prove that credentials have never leaked.

Dark web monitoring is useful only when someone acts on what it finds. Each alert is reviewed before it reaches you, so you hear about exposures tied to your agreed domains and people rather than every mention of your company name. When a staff password, personal email or session data appears in a breach collection, we confirm which account is affected, check whether that password is still in use in your environment, and work with your IT lead to reset it, review recent sign ins and confirm MFA is turned on. Your monthly report lists findings, the actions taken and any accounts still waiting for a reset, so leaders can see that exposures were closed rather than just noticed.

Email security and phishing defence

We configure filtering, impersonation protection, SPF, DKIM and DMARC for the agreed mail environment, and can route a reporting button to the response team. Authentication and enforcement reduce certain forms of domain spoofing; they do not prevent every lookalike-domain, display-name or compromised-account attack. Sending sources and alignment are checked before policy changes.

Backup and ransomware readiness

We review backup coverage, separation, access and retention, and can implement immutable backup controls and restoration tests where supported and included. Recovery exercises check selected systems and dependencies against agreed objectives. Ransomware can also involve stolen data and disrupted operations, so a backup alone does not settle the incident or guarantee recovery.

Incident response

An incident-response scope identifies the lead, contacts, covered systems, response targets and authorized containment or investigation work. We coordinate technical evidence and recovery with your team, insurer and counsel. Your responsible privacy or legal advisers determine notification duties under PIPEDA and applicable provincial legislation and approve external communications. Active-incident availability and specialist dependencies are confirmed before a new engagement begins.

Incident response moves faster when the preparation is done before anything goes wrong. During onboarding we agree who can authorize containment steps such as isolating a laptop, disabling an account or blocking a sender, how your team reaches the response lead, and where logs and evidence will be kept. When an incident starts, you work with the agreed lead, receive a written timeline of what was seen and done, and get plain language updates you can share with owners, your insurer and counsel. After recovery, a short review records the cause where it can be determined, the gaps it exposed and the changes agreed to reduce the chance of a repeat.

Built for small businesses and regulated organizations

A 25-person accounting firm and a 400-seat SaaS company have different systems, dependencies and risk priorities. We fit managed security around those needs and the internal or external IT team already involved. For healthcare, legal, financial services, public sector and technology organizations, agreed monitoring and reporting can support evidence requirements under PHIPA, PIPEDA, SOC 2, PCI DSS, ISO 27001 or relevant OSFI guidance. Your advisers and assessors identify applicability; the service does not by itself establish compliance, certification or insurance eligibility.

What you see every month

A concise monthly executive report summarizes detected events, response actions, vulnerabilities, credential exposures, commissioned backup tests and recommended priorities. Supporting technical records show coverage, unresolved items and the evidence behind each status. Quarterly reviews connect this record to the next decisions. AI may assist analysis and reporting within approved information-handling arrangements; our team reviews deliverables with technical judgement and presents them for your approval. Runtime response automation follows the agreed playbooks.

Managed security pricing

Custom-scoped engagements; proposal after discovery. Recurring fees may be structured per user, per device or around the agreed environment, with onboarding and third-party tooling identified separately. Coverage, telemetry volume, retention, response responsibilities and reporting needs affect the quote. A cyber security audit can establish a useful starting point when the current position is unclear. The Agreement states the term, scope and any service-specific response targets.

Investigating a missing alert? Follow the managed SOC event-trace guide to distinguish a collection, normalization, detection or response gap.

Related guides: choosing a cyber security company and securing your WordPress website.

Get your managed security proposal

Request a scoped proposal. Call (416) 273-9030, Monday to Friday, 9 am to 6 pm, and Saturday, 10 am to 2 pm. After hours, our 24/7 AI agent answers the toll-free line, +1 (800) 808-9235, and we’ll follow up the next business morning. Standard team support targets a response within 24 to 48 hours on business days. Contracted security monitoring and incident escalation use their separately agreed service arrangements. Part of our cyber security services for Canadian businesses.