Adopt AI and the cloud safely, with the evidence to prove it.
We help Canadian small and medium businesses put Claude Code and MCP to work, secure their Azure and AWS environments, and meet compliance requirements such as CPCSC. A small, senior practice: the person you talk to is the person who does the work.
Or email info@exploitsbay.com
St. John’s, Newfoundland and Labrador · Working across Canada
Generate a CPCSC Level 1 gap report for my subscription.
46 ITSP.10.171 controls evaluated
- 15 Compliant evidence attached
- 9 Non-compliant resources named
- 13 Manual review checklist provided
- 9 Not assessed data source missing
✓ Level 1 self-assessment drafted: 13 requirements, suggested MET / NOT MET
Four areas, one standard: show the evidence.
Every engagement is scoped with you and ends with something you can use: a working tool, a hardened environment, or the evidence an assessor will accept.
Claude Code & MCP
Put Claude Code and the Model Context Protocol (MCP) to work on real problems, with the guardrails your security team expects.
02Cloud Security
Azure and AWS security architecture built on least privilege, segmentation and defence in depth.
03Compliance Readiness
Prepare for CPCSC, ITSP.10.171, NIST SP 800-53 or CIS benchmarks using evidence from your live environment, not a spreadsheet.
04DevSecOps & Supply Chain
Security checks that run on every commit, not once a year.
Defence supplier? CPCSC Level 1 now applies at contract award.
The Canadian Program for Cyber Security Certification is appearing in Department of National Defence contracts. If you can’t attest to its 13 Level 1 controls, you can’t be awarded the contract. Our guide explains what it asks for, in plain language.
Simple, and agreed up front.
- 1
Conversation
Free and without obligation. Tell us what you’re working on and we’ll say honestly whether we can help.
- 2
Scope
A short written proposal with clear deliverables and a fee agreed before any work starts.
- 3
Deliver
We work alongside your team, with read-only access wherever we can, and show our evidence.
- 4
Hand over
Documentation and knowledge transfer, so you can run it yourselves afterwards.
Security and AI, from someone who builds with both.
Security firms rarely build with AI. AI consultancies rarely pass a security review. We do both, and we can help you adopt AI without breaking the controls you already have.
We build with these tools
Our cpcsc-mcp server, kev-check and this website were all built with Claude Code. We’ve already hit the problems your team will, and solved them.
Government-grade background
Founded by a security engineer with 30 years in enterprise IT, including nearly a decade securing AWS and Azure workloads for the Government of Canada. Background →
Honest about the limits
We say what software can and can’t prove. Manual checks are marked as manual, and a partial pass is never presented as a clean one.
Built in-house, with Claude Code.
cpcsc-mcp
A Model Context Protocol server that lets Claude or any MCP client assess an Azure subscription against ITSP.10.171 and draft the CPCSC Level 1 self-assessment.
Free · sign in with your emailkev-check
Check CVE identifiers from a scanner export against CISA’s Known Exploited Vulnerabilities catalogue, so triage starts with the ones attackers are using.
Working on something security, cloud or AI related?
Start with a free, no-obligation conversation. Tell us what you’re working on and we’ll tell you honestly whether we can help.