Castellan Information Security Services
Castellan Information Security Services is an Indigenous-led Canadian cybersecurity professional services firm offering GRCP consulting, staff augmentation with a ~100-expert bench, and CPCSC/CMMC certification services to government, defense supply chain, and private sector clients across Canada.
- Company typePrivate
- Founded2019
- HeadquartersWinnipeg, Canada
- Headcount11–50
- GTM typeB2B
- OfferingServices
What Castellan Information Security Services does
Castellan Information Security Services Inc. is an Indigenous-led Canadian cybersecurity professional services firm headquartered in Winnipeg, Manitoba, founded in 2019. The company delivers a unified portfolio of Governance, Risk, Compliance, and Preparedness (GRCP) services — covering security policy and process development, threat and risk assessments, penetration testing, source code review, vulnerability assessments, PCI-DSS assessments, compliance audits, security program and roadmap development, business continuity, and disaster recovery — alongside a staff augmentation model that markets a bench of approximately 100 industry-leading certified information security experts to clients that need to bridge internal skills gaps. Specialized CPCSC and CMMC certification preparation services target the Canadian and US defense supply chain ahead of mandatory CPCSC Level 1 enforcement in summer 2026, and a subscription-based monthly vulnerability scanning service and 24/7 Security Operations Centre offering extend the portfolio into recurring managed services.
The underlying technology stack is services-led rather than product-led: Castellan operates no public API, no software platform, and no proprietary model, and integrates manual and automated techniques across black-box, gray-box, and white-box testing for networks, cloud, web applications, mobile, wireless, and IoT environments. The firm is differentiated by its Indigenous-led positioning, CAMSC Aboriginal/Minority supplier certification, CCIB membership, and CAN/DGSI 104:2021 Rev 1 2024 certification, all of which pre-qualify it for government, Crown corporation, and defense procurement that weight supplier diversity and cyber credentials.
The business model is professional services revenue — primarily project-based consulting and staff augmentation — sold through direct enterprise engagement, with bottom-of-funnel leads captured via a Winnipeg-based sales contact and a Canadian HQ phone line, mid-funnel relationships built at CANSEC and through the CEO's Halifax Connector Program participation, and top-of-funnel demand generated through an educational blog covering ransomware, phishing, business continuity, and compliance. Government (federal, provincial, Crown corporations) is identified as the primary customer segment alongside telecommunications, insurance, healthcare, education, retail/manufacturing, non-profit, and defense supply chain clients across Canada, with pricing quote-based and tailored per engagement except for the monthly vulnerability scanning subscription.
Castellan Information Security Services firmographics
Firmographics- Name
- Castellan Information Security Services
- Legal name
- Castellan Information Security Services Inc.
- Website
- https://castellaninformationsecurity.com
- Company type
- Private
- Founded year
- 2019
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Castellan Information Security Services is an Indigenous-led Canadian cybersecurity professional services firm offering GRCP consulting, staff augmentation with a ~100-expert bench, and CPCSC/CMMC certification services to government, defense supply chain, and private sector clients across Canada.
- Ownership category
- akta.pro rank
Castellan Information Security Services industry classification
Industry- Product category
- Cybersecurity Professional Services
- NAICS
- Management, Scientific, and Technical Consulting Services (5416)
- SIC
- Services-Engineering, Accounting, Research, Management (8700)
- akta.pro primary industry
- Security Governance, Risk & Compliance (GRC) Advisory (BPAKADAG)
- akta.pro secondary industries
- Governance, Risk & Compliance (GRC) Advisory & Assessments (BPAKAHAH), Security Audits & Compliance (ISO 27001, SOC 2, PCI DSS, HIPAA, SOX) (BPAKADAC)
Keywords
Where Castellan Information Security Services is headquartered
LocationHeadquarters
- HQ city
- Winnipeg
- HQ country
- Canada
- HQ region
- North America
Offices3 records
Markets served
Castellan Information Security Services business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Operations, Marketing or Sales, Technology or R&D, Others
Revenue model
- GRCP Professional Services: Core professional services revenue stream including governance, risk, compliance, and preparedness consulting. Services delivered by certified security experts for security program development, risk assessments, compliance audits, and business continuity planning.
- Staff Augmentation: Providing organizations with cybersecurity professionals to supplement their internal IT teams. Services include contracting security architects, analysts, engineers, consultants, and project managers on temporary basis to address specialized cybersecurity needs.
- CPCSC/CMMC Certification Preparation: Specialized consulting services to help defense sector suppliers prepare for Canadian and US cybersecurity certifications. Includes gap analysis, roadmap development, implementation support, policy documentation, and audit preparation services.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Other | Multi-year contract | Custom professional services engagements |
| Subscription | Monthly | Monthly vulnerability scanning subscription |
Go-to-market motion3 records
Distribution channels3 records
Marketing channels6 records
Castellan Information Security Services product offering
Product offeringCore offering
Castellan Information Security Services is a Canadian Indigenous-led cybersecurity firm that delivers Governance, Risk, Compliance, and Preparedness (GRCP) professional services, including security program development, risk and vulnerability assessments, penetration testing, source code review, PCI-DSS and compliance audits, and business continuity and disaster recovery planning. The company also provides staff augmentation by placing certified information security experts (security architects, analysts, engineers, consultants, project managers) from its bench of approximately 100 industry-leading professionals into client organizations, and offers specialized CPCSC/CMMC certification preparation for defense supply chain contractors.
Product overview
Castellan Information Security Services is a cybersecurity services firm offering a unified portfolio of GRCP (Governance, Risk, Compliance, and Preparedness) professional services and Staff Augmentation. The core GRCP Services platform encompasses governance consulting, risk assessments, penetration testing, vulnerability assessments, source code review, PCI-DSS assessments, compliance audits, security program development, business continuity, and disaster recovery planning. These services are delivered alongside a staff augmentation model providing access to approximately 100 industry experts. The firm also provides specialized CPCSC/CMMC certification preparation and monthly vulnerability scanning subscription services. All offerings are delivered through certified security professionals without a software product or API.
Differentiator
Problem solved
Functional benefit
Products and services
- GRCP Services
- Staff Augmentation Services
- Information Security Policy and Process Development
- Risk Assessment Services
- Penetration Testing
- Source Code Review
- Vulnerability Assessment Services
- PCI-DSS Assessment
- Security Compliance Audits
- Security Program and Roadmap Development
- Business Continuity Services
- Disaster Recovery Services
- CPCSC / CMMC Certification Services
- Monthly Vulnerability Scanning Service
Quantifiable outcome
- Organizations can enhance security posture while focusing on core operations
- +2 more outcomes
Companies that use Castellan Information Security Services
Customer profileNamed customers8 records
Segments5 records
Ideal customer profiles4 records
Castellan Information Security Services technology and API
TechnologyTechnology focussed No
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Feature4 records
Castellan Information Security Services partnerships and signals
Strategic signalPartnerships
Nine partnerships are on record, tiered flagship, core and minor.
- Turtle Island FamilyflagshipStrategic partnership creating a fully Indigenous-led integrated professional services group. Castellan joined Turtle Island Family to form a national security and technology group delivering cybersecurity, technology, and physical security services across Canada. CEO Michael Hebert serves as leader in both Castellan and Turtle Island Technology Solutions.
- Turtle Island Technology SolutionscoreAffiliated Indigenous-led technology company. CEO Michael Hebert serves as CEO of both Castellan and Turtle Island Technology Solutions. Companies collaborate on cybersecurity and technology projects with joint team members across both organizations.
- Halifax PartnershipminorMichael Hebert participates in Halifax Connector Program as a Connector, part of the National Connector Program presented by RBC and funded by Government of Nova Scotia. Program helps connect business professionals for networking and economic development.
- Core Data CentresminorMichael Hebert delivered land acknowledgement and spoke at Core Data Centres annual BBQ about Indigenous-owned technology businesses role in Canada's AI ecosystem.
- Neural Edge Solutions Inc.minorOrganizations helping drive innovation and digital infrastructure across Canada mentioned together at Core Data Centres event.
- Carapace Security ConsultingminorSecurity consulting firm mentioned together with Castellan in industry discussions and LinkedIn posts.
- Canadian Council for Indigenous Business (CCIB)minorCCIB logo displayed on website indicating membership or partnership supporting Indigenous businesses.
- Canadian Aboriginal and Minority Supply Council (CAMSC)coreCAMSC certified supplier of information security services. Certification provides competitive advantage in government and corporate procurement processes targeting diverse suppliers.
- Canadian Association of Defence and Security Industries (CADSI)minorIndustry association for defense and security companies. Castellan attends CANSEC conference organized by CADSI for industry networking and business development.
Scale indicators6 records
Recent moves7 records
Expansion highlights6 records
Castellan Information Security Services competitors and assessment
Company assessmentBroad incumbents
- eSentire: Canadian-headquartered cybersecurity firm offering MDR plus advisory/professional services. Comparable customer base and Canadian presence, though significantly larger and product-led versus Castellan's pure services model.
- Optiv Security: Large North American cybersecurity solutions and advisory provider covering risk, compliance, and offensive security services. Competes for the same enterprise/budget envelopes as Castellan's GRCP practice at much larger scale.
- Mandiant (Google Cloud): Global cybersecurity leader in incident response, threat intelligence, and cyber risk advisory. Competes for premium incident response, risk assessment, and breach-related work Castellan would otherwise pursue.
- Herjavec Group (Pomeroy/now part of Optiv): Canadian-founded cybersecurity services and MSSP firm competing in the same advisory/SOC/managed security space as Castellan with strong enterprise and government presence.
- ISA Cybersecurity (TELUS): Acquired by TELUS, ISA is one of Canada's largest pure-play cybersecurity consultancies offering GRCP-adjacent services including managed detection, advisory, and incident response. Directly comparable in offering mix but with much larger scale and TELUS backing.
- KPMG Canada (Cyber Risk Services): Big Four advisory practice offering GRC consulting, cyber assessments, and compliance audits including PCI-DSS. Competes directly for Castellan's compliance audit and GRCP engagements with enterprise clients.
- Deloitte Canada (Cyber Risk): Big Four cyber risk practice serving Canadian government and enterprise with compliance audits, GRCP advisory, and incident response — directly competes for Castellan's regulated and large-enterprise mandates.
Direct peers
- Cycura: Toronto-based cybersecurity consulting and penetration testing firm serving Canadian enterprises and government. Closest comparable on size and offensive-security/assessment focus, with similar GRCP-style advisory and vulnerability work.
- Bulletproof (GLI): Canadian-headquartered cybersecurity services firm offering compliance, penetration testing, and managed security. Closest comparable size and GRC-style positioning to Castellan with similar customer base.
- Sentia (acquired by CDW): Canadian cybersecurity and cloud consulting firm. Comparable in size and GRCP-adjacent services for mid-market and enterprise customers across Canada.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat4 records
Key risks7 records
Key highlights7 records
Customer concentration
Castellan Information Security Services social profiles
Digital presenceCastellan Information Security Services compliance and trust
Trust signalCompliance4 records
Castellan Information Security Services financial estimates
Financial estimateRevenue estimate
Valuation estimate
Castellan Information Security Services leadership team
Management profileNumber of profiles
Profiles5 records
Castellan Information Security Services funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Castellan Information Security Services M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Castellan Information Security Services
What does Castellan Information Security Services do?
Castellan Information Security Services is a Canadian Indigenous-led cybersecurity firm that delivers Governance, Risk, Compliance, and Preparedness (GRCP) professional services, including security program development, risk and vulnerability assessments, penetration testing, source code review, PCI-DSS and compliance audits, and business continuity and disaster recovery planning. The company also provides staff augmentation by placing certified information security experts (security architects, analysts, engineers, consultants, project managers) from its bench of approximately 100 industry-leading professionals into client organizations, and offers specialized CPCSC/CMMC certification preparation for defense supply chain contractors.
Is Castellan Information Security Services a public or private company?
Castellan Information Security Services is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was Castellan Information Security Services founded?
Castellan Information Security Services was founded in 2019. It employs 11 to 50 people.
Where is Castellan Information Security Services based?
Castellan Information Security Services is headquartered in Winnipeg, Canada, in the North America region.
How does Castellan Information Security Services make money?
Three revenue lines are on record. GRCP Professional Services are the primary driver. The others are staff Augmentation and CPCSC/CMMC Certification Preparation.
Who are Castellan Information Security Services's main competitors?
Broad incumbents on record are eSentire, Optiv Security, Mandiant (Google Cloud), Herjavec Group (Pomeroy/now part of Optiv), ISA Cybersecurity (TELUS), KPMG Canada (Cyber Risk Services) and Deloitte Canada (Cyber Risk). Direct peers are Cycura, Bulletproof (GLI) and Sentia (acquired by CDW).
Does Castellan Information Security Services have an API?
No public API is recorded for Castellan Information Security Services.
What industry is Castellan Information Security Services in?
Castellan Information Security Services's product category is Cybersecurity Professional Services. Its primary akta.pro industry code is BPAKADAG, Security Governance, Risk & Compliance (GRC) Advisory, with a secondary code of BPAKAHAH, Governance, Risk & Compliance (GRC) Advisory & Assessments. Its NAICS code is 5416 and its SIC code is 8700.