About Zero Day IT

Named after the worst day in IT.
Built so your business is ready for it.

Zero Day IT is a managed IT and cybersecurity provider headquartered in Vancouver, BC. We run the technology Canadian organizations depend on, defend it from a 24/7 security operations centre, and put the numbers in writing so you can see the work rather than take it on trust.

58
Services in 10 domains, each with scope and measures
24/7
Security operations and service desk
15 min
Critical incident acknowledged, 24/7, any day of the year
< 4 h
On-site response across the Lower Mainland
Why the name

Zero days of warning

zero-day
noun

A flaw that attackers are already using before the vendor has a fix. The defender gets zero days of notice.

A zero-day is the worst day in IT, and the one every provider hopes never arrives. We named the company after it because readiness for that day is the whole job. Not the sales deck, not the dashboard: the question of whether, when something unknown gets through, your business has a bad afternoon or loses a decade of work.

What decides that is unglamorous. Patching on a published cadence. Multi-factor authentication on every account, with no exceptions for the people who ask nicely. Backups that someone has restored, timed, and written down. Least privilege, so one stolen password does not open every door. And a person awake at three in the morning who knows your environment and is authorised to act.

That is what we do, for organizations across Canada, from an office on West Georgia Street and a security operations centre that never closes. One team, one agreement, one number to call: +1 (866) SOS-GEEK.

What we do

Three jobs, one accountable team

Most providers do one of these well. Clients leave when the other two are nobody's problem.

01
Run

We run your IT

Service desk, devices, servers, identity, network and cloud, under one agreement with one number to call. Every client gets the same ten baseline controls on day one and the same monthly report.

Managed IT services
02
Defend

We defend it around the clock

A 24/7 security operations centre watches endpoints, identities, email, network and cloud, confirms real threats and contains them with pre-agreed playbooks. Backups are immutable and restore-tested, so ransomware is a bad day, not the end.

Managed detection and response
03
Plan

We plan it with your leadership

Fractional CIO and CISO leadership, a roadmap and budget you can defend to a board, compliance programmes for PIPEDA, PIPA, SOC 2, ISO 27001 and PCI DSS, and projects delivered to a scope, not an hourly meter.

Advisory services
How we work

Five rules we do not bend

The operating standard, the cadence and the response targets are published in full on the Services page. These are the principles behind them.

  1. 01

    Standard first

    Every client gets the same ten controls, the same operating rhythm and the same report. Bespoke is where gaps hide. We publish the standard so you can check it.

  2. 02

    Evidence, not assurance

    Patch compliance, backup success, agent coverage and response times are numbers, and you get them every month. If we cannot measure a control, we do not claim it.

  3. 03

    Prevention before heroics

    Most incidents are stopped by unglamorous work done on a schedule: patching, MFA, least privilege, backups that have been restored. We do that work first and talk about it less.

  4. 04

    Plain English

    You will never need to decode an acronym to make a decision. We explain the risk, the options and the cost in words an owner can act on, including when the news is bad.

  5. 05

    Accountable to you

    A named escalation engineer, a service delivery manager, a quarterly review with your leadership, and documentation that belongs to you. If you ever leave, you leave with everything.

In writing

What every client can hold us to

Our standard targets. The figures that bind us are in your service agreement, and your monthly report shows whether we hit them.

15 min
Critical incident acknowledged
Priority 1, 24/7, including statutory holidays
< 4 h
On-site response
Across the Lower Mainland, BC
24/7
Security operations and service desk
No holidays, no gaps
10
Baseline controls on day one
The Zero Day IT Standard, for every client
30 days
Onboarding to the full standard
Discovery, inventory, documentation, hardening
7 days
Exploited and critical updates applied
Routine updates monthly, firmware on N-1
Monthly
Service report with the real numbers
Patching, backups, coverage, SLA attainment
Quarterly
Business, access and restore reviews
Signed off with your leadership
Getting started

Your first ninety days

Onboarding is where most provider relationships quietly fail. Ours is a fixed sequence with a named owner, and nothing is marked done until it is documented.

  1. Days 1 to 30

    Discover and harden

    Discovery sessions with your leadership and staff, a full asset inventory, documentation written from scratch, and the ten baseline controls deployed: MFA, endpoint protection, patching, immutable backups, email authentication, DNS filtering, least privilege, device encryption, documentation and awareness training. The service desk is live from day one.

  2. Days 31 to 60

    Tune and prove

    Security detections tuned to your environment, the patch cadence running on schedule, the first restore test timed and recorded, and the first monthly report delivered and walked through with you line by line.

  3. Days 61 to 90

    Plan the year

    Your first quarterly review: the risk register, a twelve-month roadmap and budget, the privileged-access review signed off, and an exceptions list where every open item has an owner and a date.

Who we work with

Fit is about your situation, not your headcount

Organizations across Canada, with on-site work across the Lower Mainland. The same controls apply to a twelve-person firm with client files and a thousand-seat operation; only the scope changes.

No in-house IT

We are your IT department: service desk, devices, servers, identity, cloud and security, under one agreement with one number to call.

An internal IT team that needs depth

Co-managed: your team keeps the keys, we add the 24/7 SOC, the after-hours desk, the specialists and the tooling.

Regulated data

Health, legal, financial and public-sector clients who need controls they can prove to a regulator, an insurer or an auditor.

Several locations

Branches, clinics, stores or yards that need the same standard, the same connectivity and the same response wherever they are.

A recent incident

Organizations that have been through a breach or an outage and want the response, the recovery and the hardening done properly.

A move to the cloud

Microsoft 365, Azure, AWS or Google Cloud migrations with identity, security and cost designed in from the start.

We are probably not the right fit if
  • You want break-fix only, with nothing monitored in between. We do project and on-demand work, but managed clients are run to a standard, and that is where the results come from.
  • You want MFA, patching or backups left out to save money. Those controls decide how the worst day ends, so they are not optional on a managed agreement.
  • You need a provider who says yes to every exception. We will explain the risk in plain terms, and sometimes the answer is no.
Sectors

Built for regulated,
always-on work

The sectors we serve and the rules they live under. We publish references only with a client's written permission, so you will find no client counts here, and you can ask for a conversation with someone in your sector.

🏦

Financial Services

Regulator and auditor expectations, complete audit trails, client records that cannot leak

🏭

Manufacturing

Operational technology kept apart from office IT, shift coverage, downtime counted in lost production

🏫

School Districts

FIPPA obligations, thousands of student and staff identities, shared devices across many schools

🏛️

Government

Public-sector privacy law, procurement and reporting requirements, services the public depends on

🏥

Health Care

Patient privacy under PIPA, clinical uptime, medical devices on the network

🎓

Education

Colleges, universities and private schools: open campus networks, research data, staff and student access

⚖️

Legal and Professional Services

Client confidentiality, document management, trust-account and invoice fraud attempts

🛒

Retail and Hospitality

PCI DSS, point-of-sale and guest systems, many locations run to one standard

🏢

Business and Enterprise

Multi-site companies with an internal IT team that needs 24/7 security depth and a documented standard

Frameworks we work to:PIPEDA • BC PIPA • FIPPA • NIST CSF 2.0 • CIS Controls • SOC 2 • ISO 27001 • PCI DSS v4.0 • HIPAA

Platforms

Certified on what we run

We use the tools you already own where they are fit for purpose, and say so when they are not. Individual engineer credentials are listed in proposals, because certifications belong to people.

  • MicrosoftMicrosoft 365, Azure, Entra ID, Intune, Defender and Purview
  • SentinelOneSingularity endpoint protection, operated by our SOC
  • FortinetFortiGate, FortiSwitch, FortiAP and Secure SD-WAN
  • Palo Alto NetworksNext-generation firewalls and Panorama
  • Cisco and MerakiSwitching, wireless and SD-WAN
  • SophosSophos Firewall and Intercept X through Sophos Central
  • Amazon Web ServicesLanding zones, workloads and immutable backup targets
  • Google CloudWorkloads and Google Workspace security
  • StarlinkSatellite failover and connectivity for remote sites
Standards

The rules we work to

Frameworks are only useful when they change what happens on a Tuesday. Here is how each one shows up in the work.

  • NIST Cybersecurity Framework 2.0Every service in our catalogue is mapped to a framework function, and quarterly posture reviews are scored against it.
  • CIS Controls and CIS BenchmarksConfiguration baselines for Microsoft 365, Azure, AWS, Google Cloud, Windows and network equipment.
  • PIPEDA and British Columbia's PIPACanada's federal privacy law and BC's provincial law. We run our own privacy programme under both and help clients meet them.
  • SOC 2 and ISO 27001Control design, implementation and evidence collection for clients working towards a report or certificate.
  • PCI DSS v4.0Scoping, segmentation, hardening and evidence for clients who take card payments.
  • HIPAAUS health-data safeguards and agreements for Canadian clients with US patients or partners.

What we hold and what we do not: see Credentials and the Trust Centre.

Canadian company, Canadian law

Zero Day IT Solutions Inc. is a British Columbia company headquartered in Vancouver, governed by PIPEDA and BC's PIPA, with a named Privacy Officer you can reach. Where client data lives is set per service and written into your agreement.

Our AI stays on our hardware

ZeroBot, the advisor on this site, runs on infrastructure we own and operate in Canada. Your questions are not sent to a public AI service, not used for training, and not stored after the reply.

We publish what we watch

The feeds and tools below are the ones our own analysts use. They are free, they need no sign-up, and they send nothing about you to anyone.

Our Office

Find Us in Vancouver

1055 West Georgia Street, Vancouver BC
1055 West Georgia St, Suite 2100Vancouver, BC  V6E 3P3
Let's Talk

Ready to Stop Worrying
About IT?

Book a free 30-minute assessment, no pressure, no obligation. We'll review your current setup, surface your biggest risks, and show you exactly what a properly managed IT environment looks like. Call us anytime at +1 (866) SOS-GEEK or fill out the form and we'll reach out within one business day.

1055 West Georgia St, Suite 2100  ·  Vancouver, BC  V6E 3P3

No sales pressure. No obligation. We respond within one business day.

✓A person replies within one business day
✓A 30-minute conversation about your situation, no slides
✓A written proposal with scope, price and measures