Cybersecurity monitoring that catches threats while your team is still asleep.
Endpoint detection and response, sign-in monitoring, phishing investigation, dark web reports and audit logging for Alberta organizations. Detection, containment and a 24/7 security operations centre run around the clock, backed by our Alberta-based team.
Not a monthly scan. A daily practice.
Security tools are only useful if someone tunes them and acts on what they report. Alerts are reviewed across your whole environment and tuned over time, instead of left on factory defaults that generate noise until everyone starts ignoring them.
Endpoint & malware alerts
Every computer and server we manage runs endpoint detection and response. If a device needs to come off the network at 2 a.m. to stop something from spreading, the tools isolate it automatically, analysts in our 24/7 security operations centre review it, and you hear from us about what happened.
Sign-ins & phishing
Sign-ins are checked against where they should be coming from. Risky sign-ins and access attempts from outside the country are reviewed as part of daily monitoring. Reported phishing emails are investigated the same day, including tracing what else the sender may have touched.
Dark web & credentials
Compromise reports are reviewed every day, without exception, so leaked credentials get acted on while they’re still useful information, not after they’ve already been used against you.
The tools never sleep. The severity decides the response.
Detection and automated containment run 24 hours a day, 7 days a week. When something fires, our team is notified and decides what to do from there.
Security tickets don’t wait in line behind password resets. Every alert is triaged by what it actually is.
The tools act the moment they identify the threat, at any hour: stopping the process and isolating the device. The security operations centre reviews it right away and escalates to our team.
- Ransomware detection
- Active isolation events
- Confirmed compromise
Reviewed and actioned the day it’s reported, not added to a backlog for whenever there’s a gap.
- Risky sign-ins
- Phishing reports
- Suspicious endpoint behaviour
Part of ongoing monitoring, handled as a matter of course, not held for someone to eventually get to.
- Dark web compromise reports
- Routine sign-in log review
- Scheduled vulnerability scanning
You don’t have to guess which bucket your problem falls into. That triage happens every time.
EDR, MDR and XDR: what they are and why they matter.
Traditional antivirus compares files against a list of known threats. Many attacks today don’t use a known file at all: they use stolen passwords, legitimate admin tools or brand-new code. These three layers close that gap, and they’re the terms your insurer, auditor or board is most likely to ask about.
Endpoint Detection and Response
Software on each computer and server that watches behaviour, not just files. When something acts like ransomware, such as encrypting files, disabling backups or spreading to other machines, EDR can stop the process and isolate the device automatically.
Why it matters: it’s the difference between one infected laptop and a company-wide outage. Cyber insurance applications commonly ask for it by name.
Managed Detection and Response
Detection with people behind it. Alerts are reviewed, false alarms are filtered out, the tools are tuned, and someone decides what happens next: reset an account, restore a file or escalate.
Why it matters: an alert nobody acts on is just a log entry. When comparing providers, ask whether “managed” means people overnight or automated response with follow-up. Ours is the first: a 24/7 security operations centre (SOC) with analysts reviewing and acting on security alerts around the clock.
Extended Detection and Response
Connects signals from beyond the device: email, cloud sign-ins, user identities and network activity. Related events are seen as one incident instead of five unrelated alerts.
Why it matters: attacks rarely stay in one place. A phishing email, a risky sign-in and an unusual file download from the same account are one story. XDR lets you read it as one.
Not sure which of these you have today? A security review will tell you, in plain language.
Who deleted that file? The audit trail has the answer.
A shared folder disappears. A former employee’s account is still signing in. An administrator setting changed and nobody remembers why. Audit logging records who did what, and when, so the question gets answered with evidence instead of memory.
What gets recorded
Audit records come from your cloud tenant (such as Microsoft 365) and the systems we manage. How far back they go depends on your licensing and retention settings, and confirming that is part of every security review.
It matters most after an incident. Under PIPEDA, Alberta’s PIPA and, for public bodies, Alberta’s Protection of Privacy Act (POPA), an organization has to assess whether a privacy breach creates a real risk of significant harm, and you can’t make that call without knowing what was actually accessed.
One team, watching your environment every day.
We have been working with the team at BKY for over a year and their service has been exceptional from day one. They’re proactive in spotting issues before they become problems and quick to respond whenever we need support. They helped us transition to SharePoint with ease and we can sleep at night now knowing our data is safe and secure.
This is also most of your cyber insurance questionnaire.
Renewal coming up and not sure every answer holds? A cyber insurance readiness assessment checks each question on your application against your actual systems, and closes the gaps before you sign.
The answers are already true when the form arrives
Multi-factor authentication, endpoint detection and response, sign-in monitoring, patch cadence, backups and audit logging: those are the questions insurers ask at renewal. Because this runs every day as a matter of course, you’re not scrambling to become compliant in the weeks before your policy renews. You’re describing what has been happening all year, and we complete the technical sections with you.
- Multi-factor authentication coverage
- Endpoint detection & response
- Sign-in & access monitoring
- Patch cadence
- Privileged account controls
- Backup testing & restore verification
- Audit logging & incident response
The questions we actually get asked.
Is someone watching our systems 24/7?
Yes. Monitoring and automated response run around the clock, and detection tools can isolate a device or stop a malicious process at any hour without waiting for a person. Behind those tools is a 24/7 security operations centre (SOC), so trained analysts are reviewing alerts overnight, on weekends and on holidays. When something needs action, the SOC responds right away and escalates to our team based on how serious it is.
What counts as a “critical” incident?
Ransomware detection, an active isolation event or a confirmed compromise. Containment happens automatically the moment the tools identify it, the SOC reviews it right away, and our team is notified immediately to decide the next step.
What’s the difference between antivirus and EDR?
Antivirus looks for files that match known threats. EDR watches what software and users actually do, so it can catch attacks that don’t match anything on a list, such as a stolen password being used to run legitimate admin tools, and respond by stopping the process or isolating the device.
How far back can you see who deleted or accessed a file?
It depends on your licensing and retention settings. Some plans keep audit records for months, and retention can usually be extended. Part of a security review is confirming what you have before the day you need it.
Can you help with our cyber insurance questionnaire?
Yes. We complete the technical sections with you. Insurance questionnaires get longer and more specific every year, covering multi-factor authentication, patching, backup testing, endpoint detection and privileged account controls, and they’re written for whoever administers the systems rather than the policyholder. Most of what an insurer asks about is already part of the daily work, so at renewal you’re documenting what has been happening rather than scrambling to become compliant.
Is this only for larger organizations?
No. The same monitoring runs for organizations on our managed IT services, from a dozen people to several hundred. Attackers don’t check headcount before targeting a business.
Is your support offshore?
No. Your support team works in Alberta, and your Client Relationship Specialist is a named person you can reach directly rather than a queue.
Find out what’s already been missed.
A security review looks at what’s actually being monitored today, and what isn’t: endpoint coverage, sign-in monitoring, audit retention and the answers your insurer will ask for. No cost, no pressure, and if something needs attention now, you’ll know before you leave the call.
Already working with another IT provider? See how switching IT providers works without the downtime.
Book a security review
Tell us a little about your organization and we’ll arrange a time that suits you.