CostLink began as an IT consultancy on May 21, 1985, on Saint-Jacques Street, in space borrowed from a notary firm. The first invoice covered the installation of a Novell server. The first cyber engagement arrived in 2008 — incident response for an insurance client.
Today the workshop operates a 24/7/365 operations centre from Montréal. Thirty-four people — analysts, responders, compliance advisors, red team. One site. No offshore subcontracting. Everything is here.
Six operational principles — what makes a CostLink engagement different from a generic MSP. Written into our contracts. They hold when clients try to negotiate otherwise.
No alert leaves the centre without an analyst seeing it. No blind automation calling a client executive at 3 AM. If we call you at night, someone here already confirmed it's worth your sleep.
No offshore subcontracting. No "partner SOC" covering the nights from Manila. All three shifts are at 1470 Place Victor-Hugo. When you call, this is where we pick up.
The monthly report isn't a raw alert dump. It's the dossier you'll present to your auditor, regulator, board of directors. Signed by a name and a title, not "the CostLink team".
You already have an EDR license? We operate it. Your SIEM is in place? We plug in. We never force an editor change without a clear operational benefit — your existing investment matters.
No engagement locks you into our stack beyond the contractual commitment. Your data, your policies, your evidence stay yours. The export transition is documented up front and contract-included.
Three full shifts, predictable rotation, full-time weeks. Rare in North American SOC. That's why seven of the original eleven analysts are still here after eight years — and why analysis quality doesn't drift.
Tier 1 and Tier 2. Three full shifts seven days a week. GCFA, GCIH, GREM, GMON. Seven members in post since 24/7 launch in 2018.
Tier 3 team — endpoint, network, cloud forensics. CISSP, GCFA, GCIH, ENCE. On-site Greater Montréal in under 4 hours.
Five OSCP holders — two OSCE, two OSEP, one CRTO. Pentests and red team delivered without subcontracting. 43 engagements last 12 months.
CIPP/C, CISA, ISO 27001 Lead Auditor, CRISC. Law 25, ISO 27001, SOC 2, PCI-DSS, NIST CSF.
Detection writing, automations, Splunk/Sentinel/Elastic integrations. Tenant portal maintained. 412 384 events/day ingestion pipeline.
Executive, operations, advisory, finance, recruitment. All bilingual. Present in person at quarterly committees.
The initial assessment is free and uncommitted. A director walks through your environment, hands you a report and a roadmap. Best way to judge without pressure — the conversation, the diagnostic, and whether we're the right team for you.