KEY TAKEAWAYS
- Network security testing is a program with five disciplines. Penetration testing is only one of them.
- The other four are configuration review; recurring vulnerability scanning; segmentation and wireless testing; phishing simulation. They map to CIS Controls v8.1 safeguards 4, 7, 12 and 14.
- Most Canadian SMBs need monthly authenticated scans plus one annual external pen test. Quarterly external scans apply when PCI DSS v4.0.1, PHIPA or OSFI B-13 rules are in scope.
- NIST SP 800-115 frames technical testing in four phases: planning, discovery, attack, reporting. The OWASP Testing Guide supplies the network and web coverage detail.
- Cyber insurers and SOC 2 auditors now expect an evidence pack, not a single report: scan trend data, a configuration attestation, phishing-simulation results plus a retest sign-off.
Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
Network security testing is the full program a Canadian business runs to prove its defences work. Five disciplines sit inside it: configuration review, continuous scanning, segmentation checks, phishing simulation plus human-led exploitation. Buyers usually arrive asking for one annual test. The harder questions are which disciplines they need, on what cadence, and who owns each finding.
This guide covers all five, end to end. For depth on the exploitation layer alone, including scoping, test types plus Canadian pricing, read our companion guide to network penetration testing. For the point-in-time inventory view, see the security vulnerability assessment service or our managed cybersecurity services.
What is network security testing?
According to the Canadian Centre for Cyber Security, its baseline controls target organizations under 500 employees and apply an 80/20 rule: most of the protective benefit comes from a small set of disciplined habits. Network security testing is how a Canadian SMB proves those habits actually hold.
The work combines automated discovery, configuration review against CIS Controls v8.1 baselines, plus human-driven exploitation inside an agreed scope. The output is a prioritized list of weaknesses carrying evidence, named owners and a retest path.
Treating it as one annual event is where most Canadian SMBs go wrong. A test is a snapshot of a network that changes every week. Steady work between engagements is what keeps that snapshot honest.
Where penetration testing fits inside a network security testing program
According to CIS Controls v8.1, penetration testing is safeguard 18 of 18. Secure configuration is safeguard 4, continuous vulnerability management is 7, network infrastructure management is 12 plus security awareness training is 14. A network security testing program covers all five. A pen test covers the last one.
Buying only safeguard 18 is the most expensive mistake in this market. A pen test finds what is exploitable the week it runs. Safeguards 4 and 7 stop the same finding returning next year, at a fraction of the cost.
The reverse error is just as common. Scanning enumerates known issues; it never proves which two mediums chain into a domain-admin path. That proof is the job of a pen test, and our network penetration testing guide carries the Canadian cost bands. Not sure which tier fits? Talk to a CISSP-led team about scope.
The 6 tests every Canadian SMB should run annually
According to the Canadian Centre for Cyber Security (2025), ransomware is the top cybercrime threat facing Canada’s critical infrastructure. Its assessment adds that ransomware actors are “almost certainly opportunistic” rather than industry-specific. That is why a 40-person Ontario firm needs the same test menu a regulated enterprise runs, only at SMB scale.
Six discrete tests cover the assurance surface for a Canadian SMB above 25 staff. Treat the list as a menu: insurers, auditors plus boards each pull different items.
| Test | What it answers | Cadence | CIS v8.1 safeguard |
|---|---|---|---|
| External vulnerability scan | What does the public internet see? | Weekly | Control 7 |
| Internal authenticated scan | What patches are missing inside? | Monthly | Control 7 |
| Configuration review | Where do firewall and identity rules drift? | Quarterly | Control 4 |
| Wireless and segmentation test | Are guest, operational plus corporate VLANs really separate? | Annual | Control 12 |
| Phishing simulation | Who clicks, and who reports it? | Quarterly | Control 14 |
| External and internal pen test | What can actually be exploited and chained? | Annual | Control 18 |
Network security audit checklist: a quarterly verification guide
According to the Cyber Centre’s Top 10 IT Security Actions (ITSM.10.089), patching is second on the list and hardening is fourth. Segmenting and separating information comes fifth. A network security audit is the quarterly check that all three are still true inside a live network, not just written into a policy.
Run this list at the close of each quarter. It costs an internal team roughly half a day per 50 seats and catches drift that annual testing surfaces far too late.
- Firewall rule review. Each entry needs a named owner, a business justification plus a review date. Entries missing all three get removed, and a firewall migration plan is where that audit usually happens.
- Identity review. Leavers are gone from Microsoft Entra ID, the VPN plus every local device. Check service accounts as carefully as human ones.
- Privileged access review. Count global admins in Microsoft 365. Above four for an SMB is almost always privilege sprawl rather than design.
- Patch trend check. Are critical CVEs closing inside 14 days? A flat or rising backlog is the single best predictor of a bad pen test.
- External surface diff. Compare this quarter’s external scan to last quarter’s. New open ports get explained or closed the same week.
- Backup restore test. Restore one real file set. The Cyber Centre baseline requires offline copies, and an untested copy is not evidence.
Across our 41 Canadian SMB client fleets, our engineers found the same three items dominate a first audit. Firewall rules with no owner. VPN accounts belonging to departed staff. Guest wireless bridged into the corporate VLAN. None of the three needs a pen test to find, and all three routinely survive one. Want the audit run against your network? Book an IT business consultation.
Internal vs external testing scope
According to Statistics Canada (2024), 16 percent of Canadian businesses were hit by a cyber security incident in 2023. Recovery spending doubled from roughly CA$600 million in 2021 to CA$1.2 billion in 2023, and small businesses carried about CA$300 million of that. Scope decisions keep a firm out of the recovery column.
External testing simulates an unauthenticated attacker on the public internet. Targets are the firewall edge, VPN gateways, web applications plus any cloud asset reachable by hostname. It answers the question a Canadian insurer asks at renewal.
Internal testing assumes the attacker already has a foothold on the LAN. Starting position is a non-privileged laptop or a device planted on a switch port. Targets are file shares, Microsoft Entra ID and Active Directory, lateral-movement paths plus VLAN boundaries.
Both scopes are needed. External-only testing misses the post-breach reality where ransomware operators land via phishing then pivot through Microsoft Entra ID. Internal-only testing misses the perimeter weaknesses that let them in. A defensible annual program runs both inside one engagement window, because findings on one side keep exposing the other.
Configuration review and segmentation testing: the drift scanners miss
According to the Cyber Centre, hardening is the fourth item on that same Top 10 list. Default configurations and misconfigurations “can leave your networks vulnerable”, and segmentation ranks fifth. Neither shows up as a CVE. A vulnerability scanner reports a fully patched firewall as clean while the policy behind it quietly permits anything.
Configuration review is a human reading the running config against a CIS Benchmark. It catches the any-any rule left from a 2019 migration, the management interface exposed to the guest VLAN, plus the tunnel to an office that closed two years ago.
Segmentation testing is the paired exercise. A tester sits on the guest wireless and tries to reach the finance file share. Ontario clinics and Quebec firms need that evidence, because PHIPA and Law 25 both turn on who could reach the data rather than who did.
FC INTERNAL BENCHMARK
Across our 41 Canadian SMB client fleets we measured the gap between the two disciplines at intake. Configuration and segmentation findings clear in 30 to 60 days once an owner is named. Findings that arrive without an owner sit until the following year’s test re-reports them.
That figure is anonymized client data and an FC internal benchmark from Q2 2026, drawn from first-person field observation rather than a vendor study.
Phishing simulation: what does a pen test miss?
According to the Cyber Centre’s 2025-2026 threat assessment, AI is “almost certainly lowering the barriers to entry” for attackers. They now use it to craft convincing phishing emails at scale plus generate deepfakes for social engineering. CIS Controls v8.1 answers with safeguard 14. Simulation is how a business measures whether the training landed.
A network pen test rarely touches this layer. Most Canadian SMB engagements exclude social engineering from scope to keep the test bounded, which leaves the entry route ransomware operators actually use untested all year.
Two numbers matter, and most vendors report only one. Click rate tells you exposure. Report rate tells you whether staff know what to do next, and under CIS safeguard 14 it predicts whether a real intrusion is caught in hour 1 or week 3.
Field note from Mike
In our practice the first simulation at a new client always produces a defensive conversation about click rate. I now open with report rate instead. At a Toronto professional-services client in the 50 to 80 seat band, click rate barely moved across three quarters while report rate went from near zero to roughly half the staff. That second number shortened their real incident response, and no pen test would have measured it.
“Buyers ask me for a penetration test when what they need is a program. I have never opened a Canadian SMB network where the annual test was the weakest link. It is the firewall rule nobody owns, the guest VLAN that is not really separate, and the person who clicks. Test all five layers or the report just tells you what you already survived.”
Mike Pearlstein, CISSP, CEO, Fusion Computing
Book an IT Business Consultation
How often should testing run? (compliance-driven cadence)
According to OSFI Guideline B-13, effective July 2022, federally regulated financial institutions must run regular vulnerability assessments plus periodic tests using an intelligence-led approach. Most Canadian SMBs sit outside OSFI, yet their enterprise customers increasingly flow the same expectation down through vendor questionnaires.
Cadence follows exposure rather than calendar habit. Five drivers move a Canadian SMB from “should test” to “must test” on a fixed schedule.
- Compliance. PCI DSS v4.0.1 requires annual penetration testing plus quarterly external scans by an Approved Scanning Vendor. SOC 2 Type II auditors want continuous vulnerability-management evidence. PHIPA, OSFI B-13 plus Law 25 add their own.
- Cyber insurance. Canadian insurers now condition renewal on a third-party test under 12 months old alongside continuous scanning evidence.
- Material change. Cloud migration, an acquisition or a substantial firewall change each warrant a targeted retest inside 30 days.
- Post-incident. After any confirmed intrusion, a focused test of the affected segment validates that remediation actually closed the path.
- Annual baseline. One annual external pen test plus monthly internal scanning is the minimum defensible posture above 25 staff.
What evidence do insurers and auditors require?
According to the Office of the Privacy Commissioner of Canada, PIPEDA safeguards must be kept current and followed in practice rather than merely documented. That standard is why a single annual PDF fails a serious review. Reviewers want a running evidence trail.
Assemble five artifacts and most Canadian insurer or SOC 2 requests close without a follow-up round.
- Scan trend data. Twelve months of critical and high counts with mean time to remediate. A falling line beats any single clean scan.
- Configuration attestation. Signed quarterly confirmation that firewall and identity reviews ran, naming who performed them.
- Phishing-simulation results. Click rate plus report rate by quarter, with the training that followed each round.
- Penetration test report. Under 12 months old, third party, with reproducible steps. Our network penetration testing guide sets out what a defensible one contains.
- Retest attestation. Written confirmation that critical findings were re-checked and closed inside the 30 to 60 day window.
Assembling that pack against a renewal deadline is where most Canadian SMBs run out of runway. Ask us to build the evidence pack alongside the testing.
How to choose a Canadian network security testing provider
According to NIST SP 800-115, credible technical testing has to be planned, executed plus reported as a repeatable process. Six filters cut the Canadian SMB market quickly, and they protect against the worst pattern in the space: a reseller running an automated scan then selling it as a penetration test.
- Program coverage. Ask who covers safeguards 4, 7, 12 and 14 between engagements. A provider who quotes only safeguard 18 is selling one fifth of the answer.
- Lead-tester credentials. OSCP, CISSP or GPEN named on the proposal itself rather than on the firm’s website.
- Methodology alignment. The proposal references NIST SP 800-115 plus the OWASP Testing Guide by name.
- Sample report. Request a redacted sample before signing. A firm that cannot produce one has nothing to show.
- Canadian data handling. Test artifacts include captured credentials and production screenshots, so confirm Canadian residency under PHIPA, PIPEDA plus Law 25.
- Retest in the base price. A 30 to 60 day retest window written into the SOW, never sold afterward as an upsell.
Fusion Computing runs all five disciplines for Canadian SMB clients from Toronto to Metro Vancouver. Every engagement is CISSP-led at the architecture level, scoped to NIST SP 800-115, and delivered with a 60-day retest included. Want the program priced against your actual environment? Book an IT business consultation, or compare the managed cybersecurity services option.
Field note from Mike
On a 2025 Hamilton manufacturer engagement, the external scan came back with 11 medium-severity findings. The client nearly shipped that report to their broker as is. At the exploit stage, my team chained two of those mediums (an exposed staging subdomain plus a reused admin credential from a public breach corpus) into full domain admin in under two hours. The real finding was a critical. Scanning alone would have hidden it.
Common testing mistakes Canadian SMBs make
According to CIS Controls v8.1, penetration testing sits at safeguard 18 for a reason: it is the last check, not the first. Five patterns show up in almost every botched Canadian SMB procurement. Each one is fixable, and each costs either money or assurance when it goes uncaught.
- Buying a scan and calling it a pen test. A proposal that names no human tester and no methodology is a vulnerability scan in a nicer cover.
- Scoping out the riskiest assets. Excluding production “to avoid disruption” asks the tester to confirm what the business already believes is safe.
- No retest budget. Findings without a retest become shelfware. Build the 30 to 60 day window into the original SOW.
- Ignoring identity. Defender Vulnerability Management catches host CVEs, while most modern intrusion paths run through Microsoft Entra ID misconfiguration.
- One-and-done thinking. A test is a snapshot. Continuous scanning covers the CVEs disclosed across the other 364 days.
Book an IT Business Consultation
Frequently asked questions
Twelve questions Canadian SMB buyers ask most often when scoping a network security testing program. Pricing questions specific to the exploitation discipline are answered in depth in our network penetration testing guide, which carries the Canadian cost bands by scope and test type.
What is network security testing in plain language?
The full set of checks that prove a network’s defences work: configuration review, vulnerability scanning, segmentation and wireless testing, phishing simulation plus human-led exploitation. It maps to CIS Controls v8.1 safeguards 4, 7, 12, 14 and 18.
How is network security testing different from penetration testing?
Penetration testing is one of the five disciplines, CIS safeguard 18. Network security testing is the whole program around it, including the quarterly configuration and phishing work that a pen test never touches. Buying only the pen test leaves four safeguards untested.
How often should a Canadian SMB test?
Monthly authenticated internal scans plus one annual external penetration test is the floor. Add quarterly external scans and quarterly configuration review when PCI DSS v4.0.1, PHIPA or OSFI B-13 apply. Phishing simulation stays quarterly in either case.
What does a network security testing program cost in Canada?
Budget the program rather than the single test. Continuous scanning plus quarterly configuration review typically costs CA$2,000 to CA$6,000 a year for an SMB under 150 staff. Annual penetration test pricing by scope is covered in our network penetration testing guide.
Which standards should the testing follow?
NIST SP 800-115 and the OWASP Web Security Testing Guide are the recognized methodology baselines. PCI DSS v4.0.1 applies to merchants in scope, OSFI B-13 to federally regulated financial institutions, and CIS Controls v8.1 frames the wider program.
Will my cyber insurer accept a test as evidence?
Most Canadian insurers now want an evidence pack rather than one report. Expect to supply a third-party test under 12 months old, 12 months of scan trend data, a configuration attestation plus a written retest sign-off showing critical findings closed.
Internal or external testing first?
Run external first when budget forces a choice, then internal in the next cycle. External answers the question Canadian insurers ask at renewal. Internal answers the question post-breach reality keeps asking. Mature programs run both in one window.
Does a vulnerability scan count as a network security audit?
No. A scan enumerates known CVEs on reachable hosts. An audit reviews firewall rules, Microsoft Entra ID privilege, segmentation plus backup restore evidence against a CIS Benchmark. The quarterly checklist above is the audit; the scan is one input to it.
Is phishing simulation really part of network security testing?
Yes, under CIS Controls v8.1 safeguard 14. The Cyber Centre notes attackers now use AI to craft convincing phishing at scale. Since most Canadian SMB pen tests exclude social engineering from scope, simulation is the only discipline that measures this route.
Which tools do testers typically use?
Authenticated scanning usually runs on Tenable Nessus, Qualys or Rapid7 InsightVM. Microsoft Defender Vulnerability Management ships with several Microsoft 365 plans. Manual exploitation adds Burp Suite and Metasploit under a named tester.
Do I need a red team exercise?
Probably not. Red team work suits organizations already running all five disciplines annually where testing has stopped surfacing material findings. Fewer than one in ten Canadian SMBs under 200 staff are at that point.
How long does a typical SMB engagement take?
Plan for three to five weeks: one week scoping, one to two weeks active testing, one week analysis and writing, then the debrief. The 30 to 60 day retest window opens after delivery.
