# CyberArc > CyberArc is a cybersecurity consultancy based in Toronto, Ontario. It provides authorized penetration testing, vulnerability assessments, and AI and agent security. CyberArc is the trade name of 17750692 Canada Inc., a federally incorporated Canadian corporation. Founder: Yathavan (Yathy) Gopalakrishnan. ## Services - Penetration testing: Authorized testing of web applications, APIs and networks. - Vulnerability assessments: Find and rank the weaknesses in the systems you put in scope. - AI and agent security: Prompt injection testing and MCP and tool permission reviews. ## How engagements work - Every engagement starts with a signed agreement and rules of engagement. - Testing happens only within the written scope. - Exploitation stops at proof of impact. - Findings are delivered as a report with severity ranking and remediation steps, plus one retest. - Health-data-aware (PHIPA) handling. - Client data is handled on local AI models by default; cloud AI tools are used only with the client's written consent. - There is no public phone number and no public street address. Contact is through the contact page. ## Contact - [Contact page](https://cyberarcsecurity.com/contact): the way to reach CyberArc and book a scoping call. - Programmatic enquiries: POST JSON to https://cyberarcsecurity.com/api/contact with fields name, email, company (optional), service (one of: penetration-testing, vulnerability-assessment, ai-agent-security, not-sure) and message (at least 10 characters). Rate limited. ## Core pages - [Services](https://cyberarcsecurity.com/services) - [Approach](https://cyberarcsecurity.com/approach) - [About](https://cyberarcsecurity.com/about) - [Contact](https://cyberarcsecurity.com/contact) ## Services - [Penetration Testing Services](https://cyberarcsecurity.com/services/penetration-testing): Authorized penetration testing for web applications, APIs and networks. Written scope, signed rules of engagement, severity-ranked report and one retest. - [Vulnerability Assessment Services](https://cyberarcsecurity.com/services/vulnerability-assessments): A structured search for weaknesses across the systems you put in scope, with every finding ranked by severity and the steps to fix it. - [AI and Agent Security Testing](https://cyberarcsecurity.com/services/ai-agent-security): Prompt injection testing and a review of what your AI agents, MCP servers and connected tools are permitted to touch. - [Web Application Penetration Testing](https://cyberarcsecurity.com/services/web-application-penetration-testing): Authorized testing of your web application's authentication, access control, input handling and business logic, with findings ranked by severity. - [API Penetration Testing](https://cyberarcsecurity.com/services/api-penetration-testing): Authorized API testing: authorization on every endpoint, object-level access control, token handling and schema abuse, with severity-ranked findings. - [Network Penetration Testing](https://cyberarcsecurity.com/services/network-penetration-testing): Authorized network testing: exposed services, weak and default credentials, missing patches, and segmentation that does not hold. ## Compliance frameworks - [Compliance frameworks index](https://cyberarcsecurity.com/frameworks) - [SOC 2 Penetration Testing Requirements](https://cyberarcsecurity.com/frameworks/soc-2-penetration-testing): SOC 2 never names penetration testing as a required procedure. Here is what the Trust Services Criteria actually ask for, and why auditors still ask for a test. - [PCI DSS Penetration Testing Requirements (v4)](https://cyberarcsecurity.com/frameworks/pci-dss-penetration-testing): PCI DSS Requirement 11.4 is explicit about penetration testing: internal and external, at least every 12 months, and after any significant change. - [PHIPA Security Safeguards and Security Testing](https://cyberarcsecurity.com/frameworks/phipa-security-safeguards): PHIPA s. 12(1) requires Ontario health information custodians to take reasonable steps to protect personal health information. What that means for testing. - [PIPEDA Safeguards and Security Testing](https://cyberarcsecurity.com/frameworks/pipeda-security-safeguards): PIPEDA Principle 7 requires safeguards appropriate to the sensitivity of the information, and names no specific technology. What that means in practice. - [Testing Against the OWASP Top 10:2025](https://cyberarcsecurity.com/frameworks/owasp-top-10-testing): The OWASP Top 10:2025 categories, what each one looks like in a real application, and what it takes to test for it rather than scan for it. - [ISO 27001 and Penetration Testing](https://cyberarcsecurity.com/frameworks/iso-27001-penetration-testing): ISO/IEC 27001 does not mandate a penetration test. It requires technical vulnerabilities to be managed, and testing is the usual evidence. - [LLM and AI Application Security Testing](https://cyberarcsecurity.com/frameworks/llm-application-security-testing): How to test an application built on a large language model: prompt injection, tool and agent permissions, output handling and the trust boundary. ## Answers - [Answers index](https://cyberarcsecurity.com/answers) - [What Is Penetration Testing?](https://cyberarcsecurity.com/answers/what-is-penetration-testing): A penetration test is an authorized attempt to break into a system you own, to find what an attacker could reach before one tries. How it works, end to end. - [Vulnerability Assessment vs Penetration Testing](https://cyberarcsecurity.com/answers/vulnerability-assessment-vs-penetration-testing): One measures breadth, the other measures depth. Which you need depends on whether you already know you have a backlog. - [What Is a Vulnerability Assessment?](https://cyberarcsecurity.com/answers/what-is-a-vulnerability-assessment): A vulnerability assessment is a structured search for weaknesses across a defined scope, with each finding confirmed and ranked by severity. - [Does SOC 2 Require a Penetration Test?](https://cyberarcsecurity.com/answers/does-soc-2-require-a-penetration-test): No. SOC 2 states control objectives, not procedures. But your auditor will usually ask for a test, and here is why. - [How Often Should You Run a Penetration Test?](https://cyberarcsecurity.com/answers/how-often-should-you-run-a-penetration-test): Annual is the common floor and the wrong answer on its own. The trigger that matters is significant change, which is why shipping teams test more often. - [What Is in a Penetration Test Report?](https://cyberarcsecurity.com/answers/what-is-in-a-penetration-test-report): What a penetration test report should contain, how to tell a real report from a rebranded scanner export, and what to do with it first. - [What Is Prompt Injection?](https://cyberarcsecurity.com/answers/what-is-prompt-injection): Prompt injection is text a model reads as data being treated as an instruction. The dangerous form is indirect, and the damage is set by tool permissions. - [MCP Server Security: What to Check](https://cyberarcsecurity.com/answers/mcp-server-security): An MCP server is a set of tools with real credentials behind it. What to check before you connect one to an agent, and what to review after. - [Black Box vs White Box Penetration Testing](https://cyberarcsecurity.com/answers/black-box-vs-white-box-penetration-testing): Black box testing mimics an outsider's starting position. White box testing finds more in the same time. Which to choose, and why most tests should be grey. - [Rules of Engagement in Penetration Testing](https://cyberarcsecurity.com/answers/what-are-rules-of-engagement-in-penetration-testing): The rules of engagement name the targets, the window, the permitted techniques and the contacts. It is what makes authorized testing legal and fast. - [What Drives the Cost of a Penetration Test?](https://cyberarcsecurity.com/answers/how-much-does-a-penetration-test-cost): Penetration testing is priced per scope. Here are the variables that move the number, so you can read a quote and compare two of them honestly. ## Industries - [Industries index](https://cyberarcsecurity.com/industries) - [Security Testing for Healthcare Providers in Ontario](https://cyberarcsecurity.com/industries/healthcare): Security testing for clinics, digital health products and custodians handling personal health information under Ontario's PHIPA. - [Penetration Testing for SaaS Companies](https://cyberarcsecurity.com/industries/saas): Tenant isolation, role boundaries and the SOC 2 timeline. Security testing scoped for a multi-tenant product that ships every week. - [Penetration Testing for Fintech and Payments](https://cyberarcsecurity.com/industries/fintech): Where money moves, business logic is the attack surface. Security testing scoped for payment flows and PCI DSS Requirement 11.4. - [Security Testing for AI Products and Agents](https://cyberarcsecurity.com/industries/ai-startups): If your product calls tools on a user's behalf, the model is not the attack surface. The permission model is. Testing scoped for AI products. ## Locations - [Locations index](https://cyberarcsecurity.com/locations) - [Penetration Testing in Toronto](https://cyberarcsecurity.com/locations/toronto): CyberArc is a cybersecurity consultancy based in Toronto, Ontario. Authorized penetration testing, vulnerability assessments, and AI and agent security. - [Security Testing for Ontario Organizations](https://cyberarcsecurity.com/locations/ontario): Ontario organizations answer to PHIPA for health information and PIPEDA for commercial personal information. What each requires, and how testing fits. ## Open-source AI security work - [agent-shield](https://github.com/cyberranger93/agent-shield): prompt-injection detection toolkit. - [agent-permission-graph](https://github.com/cyberranger93/agent-permission-graph): maps what AI agents and MCP servers can touch. - [recon-agent](https://github.com/cyberranger93/recon-agent): recon for authorized bug bounty work. - [LinkedIn](https://www.linkedin.com/in/yathy) - [GitHub](https://github.com/cyberranger93) Full reference with answers: https://cyberarcsecurity.com/llms-full.txt