Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. I have led Fusion’s managed IT services and cybersecurity practice since 2012, serving Canadian businesses across Toronto, Hamilton, and Metro Vancouver.
Every managed IT quote a Canadian business receives is really a bundle of software. A provider names a price per user, then delivers that price through platforms you never buy directly. This post sets out what sits in that stack, what each tier defends against, and what quietly stops happening when one goes missing.
Fusion Computing describes that stack by capability rather than by vendor logo. A buyer can verify a capability. In my experience a logo says very little about whether patching actually lands on your fleet, or whether a named person acts on the alert at 2 a.m. on a Sunday.
Fusion Computing’s software stack has five working parts: remote monitoring and management, service desk ticketing, managed endpoint detection and response, privileged access management, and next-generation firewalling with secure networking. Microsoft 365 security tooling, awareness training and a 24/7 security operations layer sit on top of those five.
KEY TAKEAWAYS
- Across our 90+ Canadian SMB client engagements through Q1 2026, we measured an average of 11 tools per environment inside the CA$180 per user per month managed IT fee.
- The Canadian Centre for Cyber Security lists 13 baseline controls for organizations under 500 staff, built on an 80/20 effort-to-benefit rule.
- Statistics Canada put 2023 Canadian business spending on cyber prevention and detection at CA$11.0 billion, with recovery spending doubling to CA$1.2 billion.
- Ask what each tool does and who watches it. A platform nobody opens is a licence rather than a control.
The rest of this post walks the stack tier by tier, then prices it against the CA$180 per user per month starting point. If you would rather have someone read your current stack back to you, book a consultation.
For a broader service view, see how Fusion delivers IT support across help desk coverage, monitoring, patching, Microsoft 365 administration, and vendor coordination.
Fusion’s Cybersecurity Toolbox
According to the Canadian Centre for Cyber Security (2025), organizations under 500 staff should run 13 baseline controls, from automatic patching to strong user authentication. Fusion Computing delivers those controls through one integrated toolset covering help desk, monitoring, patching, Microsoft 365 administration and security oversight, so nobody has to reconcile five vendor dashboards.
Most Canadian managed IT providers run remote monitoring and management platforms, service desk ticketing systems, endpoint detection and response agents, backup and disaster recovery software, patch management, and network monitoring dashboards. The specific toolset varies by provider. Integration between the platforms is what turns support from reactive into proactive.
Next-Generation Firewall (NGFW)
A next-generation firewall inspects traffic at the application layer and runs intrusion prevention at the network perimeter. Canada’s cyber agency lists basic perimeter defences among its 13 baseline controls. Without one, the command-and-control traffic ransomware depends on leaves a compromised Toronto laptop unchallenged. Our explainer covers the types of firewalls Canadian SMBs actually deploy.
Antivirus (AV)
Signature-based antivirus matches files against a catalogue of known malware. It still earns its place as the cheap floor of the stack, and federal guidance still counts security software as one of the 13 essentials. On its own it misses fileless attacks and stolen-credential logins, because neither writes a recognisable file to disk. See our guide to business antivirus.
Managed Endpoint Detection & Response (EDR)
EDR watches behaviour on laptops, desktops, and servers instead of matching signatures. When a process starts encrypting files at 3 a.m., the agent isolates the device before the blast radius grows. Without EDR a quiet infection can sit on a machine for weeks. Microsoft ships this capability inside Defender for Endpoint for tenants already on Microsoft 365.
Managed Detection & Response (MDR)
MDR is EDR plus the humans. A security operations team triages alerts around the clock, confirms what is real and runs the containment playbook. The Cyber Centre calls ransomware the top cybercrime threat to Canada’s critical infrastructure. Alerts nobody sees until Monday are why a Friday-night intrusion becomes a Monday-morning outage.
Extended Detection & Response (XDR)
XDR correlates signals from endpoints, email, identity and cloud workloads inside a Microsoft 365 tenant, so one incident view replaces four consoles. A phishing click reads as noise on its own. Pair it with a suspicious sign-in and a new inbox rule and the pattern is account takeover in progress. Without correlation that pattern surfaces after the wire transfer clears.
Managed Identity Threat Detection & Response (ITDR)
ITDR watches the identity layer for impossible travel, token theft and privilege escalation. Credential abuse is now the common opening move, which is why the Canadian Anti-Fraud Centre remains the reporting destination for so much business email compromise. Without identity monitoring, a valid password gives an attacker the access it gives your controller.
Managed Microsoft 365 Security Suite
Most Canadian SMBs already own more Microsoft 365 security than they have switched on. Conditional access, multi-factor authentication and mailbox auditing ship inside subscriptions firms already pay for, alongside Defender for Office 365 attachment sandboxing. Without configuration, Outlook and SharePoint stay open to the phishing and credential theft that reach them first.
Managed Security Awareness Training (SAT)
Training turns the people who receive the phishing email into a reporting channel. The Cyber Centre ranks employee awareness training among the 13 baseline controls, ahead of most technical spend. Quarterly video modules do very little on their own. Short monthly simulations with a one-click report button change behaviour, which is the point of security awareness training.
Zero Trust Network Access (ZTNA)
Zero trust access grants a user the specific application they need instead of the whole network. A compromised account then reaches one system rather than every file share in the building. Federal guidance frames this as access control and authorization, one of the 13 baseline controls. Our primer on zero trust for Canadian SMBs covers the rollout order.
Secure Access Service Edge (SASE)
SASE moves the security stack into the cloud, so a hybrid team gets the same inspection in a Hamilton kitchen as in the head office. Split-tunnel VPNs quietly bypass that inspection. Without a cloud-delivered gateway, remote traffic leaves your policy behind the moment somebody joins the coffee-shop network.
Beyond Technical Tools: Business-Focused IT Management
- 24/7 help desk. Level 1 front-line support for end-user issues, with Level 2 escalation for servers and infrastructure.
- 24/7 security operations. Monitoring, triage and vulnerability patching against a 1-hour priority response target.
- Vendor management. Coordinating line-of-business software vendors so nobody waits three days on a renewal.
- Budgeting guidance. A rolling 12-month hardware and subscription forecast, so refreshes stop landing as surprises.
- Strategic IT direction. Quarterly reviews that tie the roadmap to headcount and revenue plans.
- Fractional CIO support. Executive-level leadership from a virtual CIO without a full-time hire.
- Compliance consulting. Evidence packaging for PIPEDA, PHIPA and cyber insurance renewals.
The line between a front-line help desk and a managed practice is mostly about which of those run on a schedule. Fusion Computing compares the two in IT support vs managed IT.
EDR vs MDR vs XDR, Explained in Plain Terms
According to Microsoft (2026), Defender for Endpoint bundles endpoint detection and response, next-generation protection, attack surface reduction and vulnerability management into a single agent. The category names matter at renewal time. EDR is the sensor, MDR adds the humans who read what the sensor sees, and XDR widens the view to email, identity and cloud signals.
| Layer | What it watches | Who responds | Typical fit |
|---|---|---|---|
| EDR | Process behaviour on each device | Your own team, or an automated rule | 10 to 25 staff with in-house IT |
| MDR | The same signal, watched by analysts | A 24/7 security operations team | 10 to 150 staff with no night shift |
| XDR | Endpoint plus email, identity and cloud | Analysts working one correlated incident | Firms already standardised on Microsoft 365 |
Most Canadian firms under 150 staff land on MDR. The sensor is affordable and the shortage is people, which Statistics Canada quantified when it reported that 50% of businesses had cyber security employees in 2023, down from 61% two years earlier.
XDR earns its premium once a firm is standardised on Microsoft 365, because the identity and email signal is already there to correlate. Buying XDR before identity is cleaned up simply produces a wider view of an unmanaged estate.
Tool Selection Criteria: A Buyer’s Guide
According to the Cyber Centre guidance on consuming managed services (ITSM.50.030), buyers should ask whether a provider can produce an audit trail of all administrator actions, confirm where data is stored, request SOC 2 Type 2 reports and define an exit path. Those four checks decide most tool selections at Fusion Computing.
Tenant fit comes first. A tool that cannot sign users in through Microsoft Entra ID or Google Workspace creates a second identity estate, which is exactly where stale accounts survive. Data residency comes second, written into the contract rather than claimed in a brochure.
Total cost of ownership comes third. A licence that duplicates something already bundled into Microsoft 365 Business Premium is money spent twice. Maintenance overhead comes fourth, and it is the criterion buyers skip. I ask who patches the tool, who configures it and who acts on what it produces. That last one is what I chase hardest.
Those four criteria are a subset of the diligence Fusion Computing recommends in questions to ask before hiring an MSP. For a second opinion on a stack you already own, talk to our team.
“Buyers ask which brand we run. What matters more is who is accountable when the alert fires. Across Toronto, Hamilton and Metro Vancouver I have replaced plenty of well-reviewed products nobody was watching, and I have kept plenty of ordinary ones a named engineer owned end to end.”
Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. First-person field observation across our 90+ Canadian SMB managed-IT engagements through Q1 2026.
How Much Does a Managed Tool Stack Cost per User?
According to Statistics Canada (2024), Canadian businesses spent CA$11.0 billion on cyber security prevention and detection in 2023, while recovery spending doubled from roughly CA$600 million in 2021 to CA$1.2 billion. Fusion Computing prices managed IT from CA$180 per user per month, with managed cybersecurity at CA$130 to CA$180 per user per month.
A typical mid-market package lands near CA$230 per user per month once after-hours coverage and regulated-industry uplift are in scope, and CA$130 is the lowest floor we quote for a light scope. The full breakdown sits in managed IT services cost in Canada.
Buying the same tools separately is usually more expensive and always more work. The software itself is the small part of the bill. Somebody still has to onboard all 40 or 400 devices, tune the alerts and answer the phone at midnight. That labour is what the per-user fee actually buys, and it is what managed cybersecurity services deliver.
FC INTERNAL BENCHMARK, Q1 2026
Across our 90+ Canadian SMB client engagements through Q1 2026, we measured an average of 11 tools per environment inside the CA$180 per user per month fee. Duplicate capability shows up in most first stack reviews of our clients, usually an antivirus product still billing alongside the endpoint agent that replaced it.
Service/Tool Q&A
According to Statistics Canada (2024), 50% of Canadian businesses reported having cyber security employees in 2023, down from 61% in 2021, and 47% pointed to outside consultants or contractors as the reason. Two topics come up on almost every buying call at Fusion Computing, so they are answered in full here.
Why do I need all of these tools instead of just one?
Each tool closes a different failure path. The Canadian Centre for Cyber Security publishes 13 baseline controls and CIS publishes 18, and no single product covers all of them. Remove the identity layer and a stolen password walks straight in. Remove training and the phishing email still gets clicked. Layering keeps one failure from becoming a breach.
How does Fusion keep my tool stack current over time?
Every stack gets a quarterly review against CIS Controls v8.1, plus continuous patching on a 1-hour priority response target for critical issues. Tools that stop earning their place get retired rather than renewed. Across our 90+ Canadian SMB client engagements through Q1 2026 the average environment carried 11 tools, and trimming duplicates is usually the first win.
Cybersecurity Tool Reference
According to the CIS Critical Security Controls v8.1 (2024), 18 controls cover everything from asset inventory to audit log management. The table below maps the acronyms a Canadian buyer meets during procurement to the job each one performs, and to what goes unwatched when the line item is cut. Our CIS Controls packages for SMBs post goes deeper.
| Tool/Service | Purpose | Key Benefit | Risk If Missing |
|---|---|---|---|
| NGFW | Protects network traffic | Stops advanced threats | Exposed to modern malware & ransomware |
| AV | Basic malware protection | Blocks common threats | Susceptible to basic viruses |
| EDR | Endpoint security & response | Catches stealth attacks | Silent infections can spread |
| MDR | 24/7 threat monitoring | Rapid threat response | Missed after-hours attacks |
| XDR | Full system threat visibility | Closes security gaps | Missed complex, coordinated attacks |
| ITDR | Protects user identities | Stops credential theft | Full access via compromised accounts |
| Microsoft 365 | Protects apps & email | Built-in security & productivity | Vulnerable to phishing & credential theft |
| SAT | Employee security training | Reduces human error | Easy phishing & social engineering success |
| ZTNA | Limits internal access | Stops lateral movement | Attackers can spread internally |
| SASE | Secure remote/cloud access | Safe access from anywhere | Unprotected remote connections |
| Vendor Management | Coordinates IT vendors | Ensures smooth operations & cost efficiency | Disorganized vendor relations, higher costs |
| Budgeting Guidance | Plans & controls IT spending | Better financial predictability | Uncontrolled IT expenses |
| Strategic IT Direction | Aligns IT with business goals | Supports growth & innovation | Technology misaligned with business needs |
| Fractional CIO (vCIO) | Provides executive IT leadership | Roadmap and budget owned by a named advisor | Lack of strategic IT leadership |
| Compliance Consulting | Helps meet regulations | Reduces legal and regulatory risks | Non-compliance penalties & risks |
| Service Desk Support | End User Support (Level 1) & Server / Network Infrastructure Support | 24×7 Helpdesk Team of Experienced Local Technicians | End-user downtime and inefficiencies |
| SOC Services | Ongoing Security Operations Centre and Oversight Team | 24×7 Monitoring, Alerting, cyber security patching | Cyber security Breach, financial loss, downtime and data loss |
What Is the Right Next Step for Your Tool Stack?
According to the Cyber Centre ransomware playbook (ITSM.00.099), offline backups offer the most protection and testing restores is a crucial part of the process. Start there. Ask your provider for the date of the last tested restore, then get in touch about the gaps that answer exposes.
Frequently asked questions
According to the Office of the Privacy Commissioner of Canada, businesses must report breaches of security safeguards that pose a real risk of significant harm, and keep records of every breach for two years. The tooling questions below come up most often when Canadian buyers work out who produces that evidence.
What software and tools does Fusion Computing use to deliver managed IT?
Five capabilities do the work: remote monitoring and management, service desk ticketing, managed endpoint detection and response, privileged access management, and next-generation firewalling. Microsoft 365 security tooling, awareness training and a 24/7 security operations layer sit on top. Our CISSP-led team publishes the capability list rather than the vendor list, because a capability is what a buyer can verify.
How much does a managed security tool stack cost per user in Canada?
Managed IT at Fusion Computing starts at CA$180 per user per month, with a typical package near CA$230 and CA$130 as the lowest floor we quote on a light scope. Managed cybersecurity runs CA$130 to CA$180 per user per month. Statistics Canada put total Canadian business spending on prevention and detection at CA$11.0 billion in 2023.
Can Fusion work with software we already own?
Yes. Most Canadian SMBs already hold Microsoft 365 licences that include conditional access, multi-factor authentication and Defender for Office 365. Switching on what is already paid for is usually the first 30 days of work. Where an existing tool duplicates a stack capability, one of the two gets retired so nobody pays twice.
How does this tooling support PIPEDA and PHIPA compliance?
Every layer produces evidence. The Office of the Privacy Commissioner requires businesses to report breaches posing a real risk of significant harm and to keep breach records for 2 years. Monitoring supplies patch evidence, identity tooling supplies access logs, and the service desk supplies the incident timeline that regulators and cyber insurers ask for.
What is the difference between antivirus and EDR?
Antivirus matches a file against a catalogue of known malware, so it stops the threats that have already been catalogued. EDR watches what a process does, which catches fileless attacks and stolen-credential logins that never write a recognisable file to disk. EDR is the layer that flags encryption starting at 3 a.m. and isolates the device.
Do we still need awareness training if we have all these tools?
Yes. The Cyber Centre ranks employee awareness training among its 13 baseline controls, ahead of most technical spend. Tools reduce what reaches a user, and training decides what happens when something gets through. Short monthly simulations with a one-click report button outperform an annual 45-minute video. To review your own coverage, contact us.
Fusion Computing is a Canadian-owned managed IT and cybersecurity provider serving businesses with 10 to 150 employees since 2012. With a 93% first-contact resolution rate, CISSP-led security leadership and recognition as one of Canada’s 50 best managed IT companies, Fusion Computing delivers monitoring, help desk and security services aligned to CIS Controls v8.1.
Last reviewed: August 2026. Fusion Computing
