Cybersecurity / AI security / Law 25, PIPEDA and Bill C-8 readiness

OpsSecureHub

Cybersecurity and compliance for businesses that use AI: threats, vulnerabilities, Law 25, PIPEDA, Bill C-8

Assistants, coding copilots, agents and MCP servers now hold access to a company’s files, terminals, email and API keys, and the antivirus and SIEM tools in place were never designed to watch them — while Law 25 and PIPEDA, and Bill C-8 once in force for critical sectors and their suppliers, expect the same company to show it is in control. OpsSecureHub brings AI-related threats, vulnerabilities, alerts, incident response and compliance evidence into one platform, self-serve or fully managed, with data hosted in Canada.

8 services sharing the same facts, account and evidence
5 ITIL ticketing tools connected both ways, one PSA per client account
12 reference obligations tracked for Bill C-8 (CCSPA) readiness, with a 72-hour incident timer

Status: In production — invitation-only access
Model: B2B · SMBs, MSP / MSSP
Market: Canada
Website: opssecurehub.com

The problem

A Canadian SMB that adopts AI opens doors its current tools cannot see: an agent with shell or full-disk access, API keys stored in plaintext in an assistant’s configuration, a model server listening on the network, AI tools installed without approval and processing data outside any control. Meanwhile the vulnerability feed never stops, alerts arrive without priority, and nobody can say who is on call, who approves a fix or what evidence will be produced if a regulator, a customer in a critical sector or the privacy officer asks. Bill C-8 received Royal Assent on June 15, 2026; its Part 2 enacts the Critical Cyber Systems Protection Act, with obligations for designated operators — including a 72-hour incident-reporting deadline — that reach their suppliers by contract, all of it without a SOC team to prepare for it.

The solution

One platform, eight services, one view of risk. A lightweight read-only agent on Windows and macOS endpoints keeps an inventory of software and AI components continuously up to date, and the company’s existing EDR/XDR feed detection; vulnerabilities, threats and AI risks are verified, grouped into clear incidents and prioritized with ITIL P1–P4 priorities and SLAs. Fixes are one-click software updates applied by the endpoint agent with mandatory approval; incident response goes through approved actions recorded in the audit log. Readiness for Bill C-8, Law 25 and PIPEDA is built from the same facts: tracked obligations, an exportable responsibilities register and PDF dossiers. The company runs the console itself or lets the team at SOFT M POWER CANADA operate it as a managed service — it decides, the team executes.

What the platform does

AI-related threats, mapped to OWASP LLM and MITRE ATLAS A catalogue of threats specific to AI tooling: prompt injection, overpowered agents, secrets exposed in AI configurations, compromised AI supply chain, shadow AI, exposed AI servers, booby-trapped models and AI framework vulnerabilities. For each one, the platform flags the affected component — a privileged MCP server, an unpinned extension, a plaintext key, a model in a dangerous format — and, where one applies, the fix.
Vulnerabilities fixed in one click, with approval Vulnerability and active-exploitation intelligence, including AI libraries, grouped into one incident per software rather than one alert per CVE. The fix is a software update applied by the endpoint agent after mandatory approval; dual approval, alternates and delegations are available, and remediation is verified against the evidence received from the endpoint. In an internal test in October 2026, 237 vulnerabilities were grouped into 2 incidents and a single update fixed 167 of them.
Incident detection and approved response Correlation of endpoint and tool logs, event search and a timeline linked to incidents and audited actions. To respond, the team requests approved actions — isolate an endpoint, revoke sessions, disable an account — each of which goes through approval and is recorded in the audit log, so that no response action runs without a recorded approval.
Organization, on-call and escalation Teams, a RACI by domain, on-call coverage with alternates, automatic escalation and automatic incident assignment. A five-step setup assistant and a “My responsibilities” view make ownership clear, and an exportable responsibilities register supports Bill C-8, Law 25 and PIPEDA evidence.
Bill C-8 (CCSPA) readiness An applicability questionnaire, tracking of the 12 reference obligations, automatic evidence drawn from the inventory, risk analysis, incidents and audit log, a 72-hour incident timer and a PDF readiness dossier. As of October 22, 2026 the Act is not yet in force and no class of operators has been designated: OpsSecureHub helps a company prepare; it is neither a certification nor legal advice.
Personal information: Law 25 and PIPEDA Local analysis by the browser extension of what employees send to AI services, DLP and CASB signals from Microsoft Purview and Defender for Cloud Apps, a privacy incident register and the “AI usage, Law 25 and PIPEDA” PDF report — observed AI services, sensitive data sent or blocked and the register — ready for leadership and the privacy officer.
AI security and governance An AI bill of materials (AI-BOM) of every endpoint, seven checks on AI components — overprivileged agents, misconfigured MCP servers, unapproved tools, exposed local models — DNS-based discovery, by the Windows agent, of the AI services used by applications and scripts even outside the browser, and a usage policy that classifies each tool as approved, to review or rejected. Sensitive values stay on the device: only names and metadata are transmitted.
Alerts, reports and ITIL ticketing Six families of immediate alerts, one email per grouped incident, quiet hours that critical alerts and C-8 deadlines can bypass, and weekly and monthly FR/EN reports in executive or technical versions. Incidents become tickets in Autotask, ConnectWise PSA, HaloPSA, ServiceNow or Jira Service Management, with ITIL priority (impact × urgency, P1–P4), SLA deadlines and assignment group, and ticket status synchronized in both directions.

Architecture

A cloud platform with data hosted in Canada, operated in French and English. On the endpoint side, a lightweight read-only agent for Windows and macOS and a Chrome and Edge extension; on the integration side, connections to the EDR/XDR already in place (Microsoft Defender, Cynet, CrowdStrike, SentinelOne, Sophos), to DLP/CASB tools (Microsoft Purview, Defender for Cloud Apps, Netskope, Zscaler), to identity and cloud services (Microsoft Entra ID, Microsoft 365, Google Workspace) and to five ITIL ticketing tools. The platform applies its own rules to itself: strict isolation between clients, invitation-only access with two-factor authentication, a chained audit log, no secret values or file contents ever transmitted, and reports signed with a hash.

Who uses it

SMBs adopting AI that want protection against assistant and agent threats without a SOC team; suppliers of critical sectors that must meet their customers’ Bill C-8 requirements; and MSPs and MSSPs that run several clients from one console, with strictly isolated data, one PSA per client account and per-client priorities, SLAs and reports. Two ways to work: self-serve, with onboarding help, or fully managed by the team at SOFT M POWER CANADA.

Markets

Canada, for SMBs and their partners. The compliance services are built around Canadian frameworks — Québec’s Law 25, the federal PIPEDA and the Critical Cyber Systems Protection Act created by Bill C-8 — and the data stays in Canada. Access is by invitation, granted after the scope has been validated with the client. OpsSecureHub is a trademark of SOFT M POWER CANADA.

Where AI fits — and where it does not

Facts before AI. Every alert first goes through the platform’s knowledge base — event sheets, playbooks, MITRE ATT&CK, CWE — and official sources; detection, grouping, prioritization and compliance evidence rest on verified facts and rules, not on a model. AI only steps in afterwards, to explain an incident or a triggered check in plain language, and never contradicts the verified facts. It takes no action: every fix and every response action requires a human approval recorded in the audit log. The analysis of what employees send to AI services happens on the device, in the browser extension — the text never leaves the endpoint; only the type of data and its count are transmitted.

My role

Founder and architect: product vision, platform architecture, threat model and technical direction; my team at SOFT M POWER CANADA built it and operates it under my direction, including the managed service.