About
A small team that tests by hand and writes it up properly.
Unit 91 Cybersecurity is a 3-person offensive security team in Sicamous, British Columbia, Canada, founded in 2024. We do one thing: we try to break into systems we have been authorised to attack, and then we explain exactly how we did it.
- 2024
- Founded
- 3
- People, all of whom test
- 6
- Certifications held across the team
10,000+ hours of offensive security work across the team, accumulated across our careers rather than since founding.
How we work
Three things we will not compromise on.
- Manual testing over tooling
- Scanners are a starting point and we use them, but they are not the deliverable. The findings that matter — broken authorization, business logic, token scope — are found by a person who understood how the system was meant to work.
- Findings reported at true severity
- We would rather tell you an issue is moderate than inflate it to justify the invoice. Every report includes what we did not find, and what already worked, because a report that only lists problems is not an honest picture.
- Accountability through retest
- A finding is not closed because we said how to fix it. Every engagement includes a retest of the affected workflows and a written summary confirming what is actually closed.
Credentials
What the team holds.
6 certifications across 3 people, covering web application exploitation, evasion and red team operations. We list only what we hold, and every one of these is independently verifiable with its issuer.
-
OSCP OffSec -
OSEP OffSec -
OSWE OffSec -
OSMR OffSec -
BSCP PortSwigger -
CRTO Zero-Point Security
Background
Where the experience comes from.
Unit 91 is new. The people running it are not. Since 2021, our principal has worked offensive security continuously — as a penetration tester at Vumetric, on the Synack Red Team, and in senior security roles at TELUS, WestJet and RSM Canada.
- Vumetric
- Synack Red Team
- TELUS
- WestJet
- RSM Canada
Listed as professional history only. These are former employers, not clients or partners of Unit 91 Cybersecurity, and none of them endorses this company or its work.
Working with us
What a small team actually means for you.
You talk to the person testing your system, not an account manager relaying questions to a contractor you never meet. Scoping calls, the engagement, the walkthrough and the retest are all the same people. That is the main advantage of 3 people, and it is worth more than it sounds.
It also means we scope honestly. If your application needs four days rather than ten, we will say so, and if we are not the right firm for what you are asking, we will say that too.
Also worth reading