A security audit checks whether your protections are in place and properly configured. A penetration test checks whether an attacker can still get through. For most SMBs, the logical order is the audit first, then the penetration test.
The official definitions
- Security audit. A systematic, documented review of your configurations, policies and procedures. NIST describes it as an examination: review of policies, configurations, rules and logs, plus interviews with staff.
- Vulnerability scan. Automated tools that look for known vulnerabilities. According to the Government of Canada, they only check for the possible presence of a weakness.
- Penetration test. The Government of Québec defines it as a test that simulates an attack by identifying vulnerabilities and exploiting them. It goes further than a scan: it proves the weakness can be exploited.
- Red team. A simulated attack against the whole organization that also tests your ability to detect and respond.
Audit or penetration test: the differences
| Criterion | Security audit | Penetration test |
|---|---|---|
| Question asked | Are our protections in place and properly set up? | Can an attacker get in anyway? |
| Method | Review of configurations, policies, access, backups; interviews | Simulated attack by an expert, chained weaknesses |
| What you receive | List of gaps and a remediation plan | Proven attack paths, ranked by severity |
| Who it is for | Management, IT manager, insurer | IT manager, demanding clients, insurer |
| Duration (SMB) | 1 to 2 days at UpSystems | 3 to 5 days for a manual test |
| UpSystems price | $300 to $2,500 | Scan $500 to $1,500, manual from $4,000 |
Where to start?
Start with the audit if you have never had an assessment. A penetration test on a network that has never been reviewed will mostly find problems an audit would have found for much less.
Go straight to a penetration test in three cases:
- A client or prime contractor requires a penetration test report.
- Your cyber insurer asks for it. Insurance questionnaires often exceed 80 questions, including “do you run regular penetration tests?”, and a wrong answer can complicate a claim.
- You have already fixed the gaps from an audit and want to check they hold.
After that, both the Government of Québec and the Government of Canada recommend a penetration test once a year, and after any major change.
What about Law 25?
Law 25 does not require a penetration test. It requires reasonable security measures. In its January 2026 guide, Québec’s Commission d’accès à l’information lists penetration and vulnerability tests as ways to check those measures, and asks that they be reviewed regularly. A documented audit or test is your best proof of due diligence.
Why the risk is real
In 2023, 16% of Canadian businesses had a cyber security incident, and recovery costs doubled since 2021 to about $1.2 billion (Statistics Canada). Only 22% of businesses had cyber insurance. The Canadian Centre for Cyber Security calls ransomware the most disruptive cyber threat facing Canada.
The UpSystems advantage: audit and test, same team
- A clear path. The audit (1 to 2 days, $300 to $2,500) shows what to fix. The penetration test confirms it is fixed. The same team does both, so nothing to re-explain.
- Published prices. You know the range before you call, which is rare in this market.
- A report in French or English, ready for Law 25. Usable with your insurer and your clients.
- Clients who vouch for us. GA International and Artik trusted us with their security assessment.
We tell you what to do first. Book a 30-minute call: we will tell you whether an audit is enough or you need a penetration test.
Frequently asked questions
What is the difference between a security audit and a penetration test?
The audit checks your protections and how they are configured. The penetration test simulates a real attack to prove what a hacker could reach.
How much does a cybersecurity audit cost for an SMB?
Published prices in Québec range from under $1,000 to $10,000 depending on depth. At UpSystems, $300 to $2,500.
Does Law 25 require a penetration test?
No. It requires reasonable security measures; the CAI lists penetration testing as one way to check them.
Does passing an audit mean I am secure?
No. The audit confirms the protections exist; only a penetration test confirms they hold up.
How often should you run a penetration test?
Once a year and after any major change, as recommended by the governments of Québec and Canada.