ZeroPoint
Let’s talk

We hack your company.
Before attackers do.

Black-box penetration testing and custom AI solutions for Canadian small and medium-sized businesses.

Explore our services

Orillia, Ontario · Serving businesses across Canada.

Penetration testing

  1. We try to break in.

    Every year, from the outside, with your permission, the way a real attacker would.

  2. We report what we found.

    A clear written report, every weakness ranked so the important fixes come first.

  3. We retest the repair.

    Once it’s fixed, by your team or ours, we test the same path again.

Custom AI solutions

  1. We build AI for your work.

    Custom tools around your data. Your team stays in control.

Black-box penetration testing.

We try to get in the way an outsider would: no supplied logins, no inside knowledge. With your permission, before a real attacker does.

We work within an agreed scope, using current attack techniques and OWASP guidance for web applications.

Nineteenth-century engraving of Chubb’s detector lock, its case cut away to show the bolt, levers and the two keys.

What could an attacker do?

Illustration, not a live test.

An instruction
gets through.

A message appears on your site. The system has accepted an instruction from outside.

Ready

Protect intellectual property.

Find paths that could expose valuable information.

Keep work moving.

Prioritise weaknesses that could interrupt operations.

Protect eligibility.

Where applicable, unmet security duties can put government contracts and Controlled Goods Program registration at risk. Source ↗

Your business is connected.
So is its exposure.

Your security extends into the software and suppliers you depend on.

55%

of analyzed small and medium business breaches involved a third party.

7,152 breaches · businesses with fewer than 1,000 employees.

Third-party involvementOther analyzed breaches

Verizon, 2026 Data Breach Investigations Report. Method & source ↗

AI is changing the threat.

What the teams building and defending these systems are seeing. Published research and guidance, not customer endorsements.

Anthropic
“Non-experts can also leverage Mythos Preview to find and exploit sophisticated vulnerabilities.”
Frontier Red TeamModel evaluation
Read publication
Cloudflare
“AI is automating high-velocity attacker operations.”
2026 Cloudflare Threat ReportThreat intelligence
Read publication
Canadian Centre for Cyber Security / Centre canadien pour la cybersécurité
“We urge every organization in Canada to strengthen its cyber defences today.”
Rajiv Gupta · Head of the Cyber CentreOfficial guidance
Read publication
Microsoft
“Now, threat actors from nation states to cybercrime groups are embedding AI into how they plan, refine, and sustain cyberattacks.”
Sherrod DeGrippo · Microsoft SecurityObserved activity
Read publication
Google Cloud
“Threat actors are also increasingly targeting AI assets.”
Google Threat Intelligence GroupObserved activity
Read publication
OpenAI blossomOpenAI
“OpenAI disrupted a Cambodia-based scam operation using ChatGPT to support investment, romance, gambling, and impersonation schemes.”
Disrupting malicious uses of AIObserved fraud
Read publication
CrowdStrike
“AI-enabled adversaries increased operations by 89% year-over-year, weaponizing AI across reconnaissance, credential theft, and evasion.”
2026 Global Threat ReportObserved 2025 activity
Read publication
National Cyber Security Centre, United Kingdom
“Keeping pace with frontier AI cyber developments will almost certainly be critical to cyber resilience for the decade to come.”
National Cyber Security Centre · UKForecast to 2027
Read publication
01–02 / 08

Custom AI solutions for everyday work.

Automate routine tasks. Find answers in your information. Turn business data into useful decisions.

Nineteenth-century engraving of punched cards for a Jacquard loom: rows of holes that told the machine which threads to lift.

A routine task

Start with the work that repeats.

AI-assisted workflow

Connect tools and information.

Human review

Your team keeps decision-making control.

Built around your existing tools. Start with one problem, measure the result, then expand.

Discuss an AI project

AI is moving
into everyday work.

Nearly one in five Canadian businesses with employees reported using AI to produce goods or deliver services in the preceding year.

Use is growing. A useful application still starts with a real business need.

Canadian businesses using AI · %

Statistics Canada · Q2 surveys, 2024–2026. Each measures use during the preceding 12 months. Source ↗

A test and a report, every year.

Your software, suppliers and access change. Each year we test again and give you a written report, so you can see what has changed and what has improved.

  1. Test and report.

    Agree the scope, test from outside, report what we found.

  2. Fix what matters.

    Your team or ours makes the repair. We check it.

  3. Repeat every year.

    And again after important changes.

Supporting Canadian
digital sovereignty.

Based in Orillia, Ontario, we help Canadian businesses strengthen control over their data, ideas and systems—through practical security testing and AI solutions.

William Chewett’s 1821 engraved map of Lake Simcoe and its townships, with Orillia lettered on the north-west shore. A red mark shows present-day Orillia at the Narrows.

Less uncertainty.
More peace of mind.

Start a conversation

info@0point.ca

Sources & notes

Industry data gives context. It does not measure your organisation’s risk or predict the results of an engagement.

  1. Verizon, 2026 Data Breach Investigations Report. Third-party involvement: 55% of 7,152 analyzed breaches in businesses with fewer than 1,000 employees. Vulnerability exploitation: 31% in the known-initial-access analysis of non-Error, non-Misuse breaches (n = 19,905), across organization sizes. Different populations; these measures are not additive. Executive summary ↗Reporting window: 1 Nov 2024–31 Oct 2025. Not a random sample of all businesses.
  2. Statistics Canada, Canadian Survey on Business Conditions, Q2 2026, Table 2. Businesses with employees using AI to produce goods or deliver services in the preceding 12 months: Q2 2024, 6.1%; Q2 2025, 12.2%; Q2 2026, 19.2%. Analysis and table ↗Published 11 June 2026. Survey periods differ from calendar-year totals.
  3. Controlled goods and contract obligations. Controlled Goods Program registration and government contract security clearances are different requirements. Failure to meet applicable security or reporting duties can affect registration, clearances or dependent contracts; consequences are not automatic after an attack. PSPC: Controlled Goods breach reporting ↗ · Contract Security Manual, §3.6 ↗
  4. AI threat research and guidance. Anthropic (2026-04-07) · Cloudflare (2026-03-03) · Canada’s Cyber Centre (2026-06-24) · Microsoft (2026-04-02) · Google Cloud (2026-09-08) · OpenAI (2026-07-31) · CrowdStrike (2026-02-24) · UK National Cyber Security Centre (2025-05-07) Vendor observations and model evaluations describe the publishers’ own work. The NCSC item is a 2025 assessment to 2027. CrowdStrike’s 89% compares tracked AI-enabled operations in 2025 with 2024. Microsoft describes largely human-directed workflows; OpenAI’s example concerns fraud.
  5. OWASP Web Security Testing Guide. A structured guide to testing web applications. We select relevant tests within the agreed scope; a black-box assessment does not certify compliance with every standard or establish that all vulnerabilities have been found. Testing guide ↗
  6. Archival plates. Chubb’s detector lock, wood engraving, about 1850, public domain. Source ↗ · Jacquard cards for weaving figured silk, engraving by G. Gladwin after C. Varley, Wellcome Collection, CC BY 4.0. Source ↗ · Lake Simcoe, from William Chewett’s 1821 map of Upper Canada, public domain. Source ↗Shown as negatives, cropped, with colour fields and marks added for this site. The Orillia mark is approximate.
  7. Demonstration and assessment scope. The terminal instructions are fictional display text. The animation illustrates possible consequences and a scoped fix; it executes no commands or attacks. A retest checks the demonstrated path. Annual testing is a review cadence; it is not continuous protection or a guarantee that all systems are secure.

Sources reviewed 27–28 October 2026. Network and AI workflow figures are original explanatory illustrations, not recordings or client data. No client assessment material is published here.