How to Pass Client Security Due Diligence as a Vendor

The Deal That Almost Slipped Away

The proposal was accepted. Pricing was approved. Then came the security questionnaire.

Thirty questions about encryption, access controls, incident response, data retention, and backups. The deal stalled for weeks because the vendor did not have documentation ready.

For many Québec SMBs, security due diligence is no longer optional. Buyers now require proof that suppliers protect data properly before contracts are signed.

What Clients Typically Ask For

Even when buyers do not require formal certifications like SOC 2, their questionnaires often use similar language. Common requests include:

• Written information security policy
• Access control and password standards
• Multi-factor authentication confirmation
• Backup and disaster recovery procedures
• Incident response plan
• Vendor risk management policy
• Evidence of employee security training

Many SMBs already have these controls in practice. The problem is documentation.

The Minimal Viable Documentation Bundle

You do not need enterprise-level compliance to pass most client reviews. You need a structured documentation bundle that demonstrates maturity.

A minimal package should include:

• Information Security Policy
• Acceptable Use Policy
• Password and MFA Standard
• Backup and Recovery Summary
• Incident Response Overview
• Data Handling and Retention Statement

This bundle should be clear, concise, and aligned with your actual technical setup.

Technical Quick Wins That Strengthen Your Answers

If documentation exists but controls are weak, questionnaires become risky. The fastest improvements most SMBs can make include:

• Enable MFA for email and remote access
• Implement structured 3-2-1 backups
• Turn on centralized logging
• Apply regular patch management
• Formalize employee security awareness training

These improvements are often delivered through a structured cybersecurity program rather than ad-hoc tools.

How AET Solutions Helps Vendors Close Deals

AET Solutions works with Québec SMBs to close security gaps before they affect revenue.

We help:

• Review and complete security questionnaires
• Build missing documentation
• Align technical controls with written policies
• Provide letters of attestation confirming implemented safeguards

Security readiness is no longer just IT hygiene. It is revenue protection.

Frequently Asked Questions

Do small vendors really need formal security documentation?
Yes. Even mid-market buyers now require proof of security practices.

Is SOC 2 required?
Not usually for SMB vendors. Most buyers accept structured documentation and evidence of controls.

How long does preparation take?
With existing controls in place, readiness can often be achieved within weeks.

Next Step Due Diligence Readiness Session

AET Solutions offers a due diligence readiness session to help vendors prepare documentation and strengthen technical controls.

👉 Book a readiness session and receive our one-page security due diligence checklist.

The Click Rate Story Most Companies Avoid

Many organizations proudly state that their employees have completed security awareness training. The videos were watched, the policies were signed, and the boxes were checked. Yet phishing click rates often remain above 20 percent.

Employees did what was required, and they still clicked.

The issue is not a lack of awareness. It is a lack of behavior change. Training that truly reduces incidents focuses on repetition, relevance, and reinforcement over time. For Montréal SMBs, success is simple to define: fewer risky clicks and faster reporting when something looks suspicious.

This is exactly the goal of AET Solutions’ cybersecurity services for SMBs.

Designing a Program That Changes Behavior

Effective security awareness programs look very different from traditional once-a-year training sessions. Annual marathons overwhelm employees and fade quickly from memory. Programs that drive real change rely on a steady cadence of short training sessions delivered throughout the year.

Micro-learning modules lasting five to eight minutes and focused on a single realistic scenario consistently outperform long, generic videos. Offering content in both English and French removes friction and improves adoption, while using examples tied to everyday tools—such as Microsoft 365, accounting platforms, and shared file systems—makes the training feel relevant.

When this approach is supported by a well-managed environment, such as through managed IT services, behavior change is far more sustainable.

Phishing Simulations and Metrics That Actually Matter

Many organizations track only who clicked on a phishing email. That number alone provides limited insight. Metrics that truly matter show whether behavior is improving over time.

Key indicators include the overall click rate trend, the percentage of employees who report suspicious emails, how quickly the first report reaches IT, and whether the same users repeatedly fail simulations. Success does not mean eliminating clicks entirely. It means faster detection and a consistent reduction in risky behavior.

A responsive IT helpdesk plays a critical role by receiving reports quickly and responding before an incident escalates.

Why Manager Involvement Makes the Difference

Security awareness improves significantly when managers are actively involved. When leaders participate in the same simulations as their teams and openly discuss the results, employees follow their lead.

Effective programs recognize teams that report suspicious emails quickly, coach repeat clickers privately instead of publicly shaming them, and include security behavior as part of regular performance conversations. This approach fits naturally into a broader cyber risk management strategy.

Reinforcing Policies Where They Matter Most

Training must reinforce policies employees actually use, not abstract threats. Staff should clearly understand expectations around password managers and unique passwords, mandatory multi-factor authentication for email and remote access, acceptable use of personal devices and USB drives, and the exact steps required to report suspicious activity.

These policies are easier to enforce when supported by tools and processes delivered through structured IT services.

An Example 90 Day Security Awareness Curriculum

A structured, progressive rollout produces better results than one-time training programs.

In the first month, the focus should be on phishing fundamentals. A baseline phishing simulation combined with a short training module establishes click and reporting benchmarks.

In the second month, the program should shift toward credential theft, using targeted simulations to reduce repeat clickers and reinforce good security habits.

In the third month, the emphasis moves to business email compromise, using executive-style phishing simulations and reporting drills designed to accelerate escalation and response.

This type of program is often documented through AET Solutions resources and guides to ensure consistent follow-up.

Frequently Asked Questions

How often should security awareness training run?
Monthly micro-training with quarterly reviews produces stronger long-term behavior change than annual sessions.

Are phishing simulations risky?
When properly designed, phishing simulations are safe, controlled, and essential for measuring real-world behavior without exposing the business to harm.

Is this suitable for small businesses?
Yes. Small and mid-sized businesses are frequently targeted precisely because training is inconsistent or missing.

Next Step Training Pilot and Baseline

AET Solutions offers a security awareness training pilot for Montréal SMBs that includes baseline phishing simulations and a structured 90-day curriculum.

👉 Request a training baseline to understand your current risk level and see how quickly employee behavior can improve.

Hook: Most Attacks Start With a Single Bad Click

Many SMBs in Montréal are exposed to drive-by malware, phishing pages, and malicious redirects triggered simply by visiting compromised websites. Because these threats activate before traditional antivirus tools can react, blocking them at the DNS layer is one of the most effective ways to keep teams secure while maintaining productivity. DNS filtering quietly prevents dangerous domains from loading so employees stay focused on work instead of cyber risks.

How DNS Filtering Works (Resolver, Policy, Logging)

DNS Resolver

When someone types a website address, the device asks a DNS resolver to translate the domain into an IP address.

Policy Engine

Instead of allowing every request to the internet, a DNS filtering solution checks whether the domain is linked to malware, phishing attempts, newly registered or suspicious websites, cryptomining activity, or sits in a blocked content category.
If the domain is safe, the website loads normally.
If the domain is risky, access is blocked instantly before any connection occurs.

Logging and Reporting

Each request is logged, giving IT teams clarity into attempts, user patterns, and possible risks without disrupting day-to-day work.

Policy Design for SMBs (Categories, Exceptions, Roles)

An effective DNS filtering policy supports security and productivity together.

Recommended categories to block for SMBs include:
• Malware, botnets, and command and control callbacks
• Phishing campaigns and newly registered domains
• Cryptomining, proxies, and known malicious activities
• Adult content
• Gambling and high-risk entertainment
• Optional productivity drains depending on company culture

Smart exceptions are equally important.
Examples include allowing approved cloud apps, vendor portals, research tools, and specific websites required by marketing, development, or other specialized teams.

A well-designed policy is strong enough to keep your environment safe yet flexible enough for employees to work without interruption.

Rolling Out DNS Filtering With Minimal Friction

A modern DNS filtering rollout is simple and smooth.
Deploy lightweight agents on laptops and desktops, set baseline policies based on roles or departments, run a monitor-only phase for visibility, then enable blocking gradually starting with the most dangerous categories.
Provide employees with an easy way to request access to blocked sites so productivity is never hindered.

Reporting and Coaching Moments

DNS reports create visibility into:
• The number of phishing attempts blocked
• Emerging threats targeting the company
• Repeated risky browsing behaviour
• Departments that may need extra cybersecurity coaching

These insights become positive coaching opportunities that strengthen overall security awareness.

FAQ

Q1: Will DNS filtering slow down my internet?
No. Modern resolvers are extremely fast and often outperform the default DNS provided by internet service providers.

Q2: Can it block only dangerous websites and leave the rest alone?
Yes. Policies are fully customizable with categories, exceptions, and role based rules.

Q3: Do employees need to use a VPN?
No. With endpoint agents, protection follows them anywhere.

Q4: How fast can this be deployed?
Most SMBs in Montréal can activate full protection in under one business day.

Q5: Is this the same as a firewall?
No. DNS filtering works at a different layer and blocks threats before they reach your network.

Hook: The Click Rate Story Every SMB Experiences

Most SMBs in Montréal start security awareness training because of one painful metric: too many employees click phishing emails. It usually begins with a 25 to 40 percent click rate. With proper design and reinforcement, that number can be reduced to below 5 percent within three to six months. The difference is not more training, but better training that fits how people actually learn and behave.

Program Design: Cadence, Micro Learning, Language

Effective awareness programs are built around consistency, not intensity.

Cadence

Short monthly sessions keep attention high and reduce training fatigue.
Example: 7 minutes per month plus quarterly refreshers.

Micro Learning

Employees remember short, practical lessons far better than long lectures.
Topics like safe browsing, MFA approval fatigue, clean desk habits, and device security should be broken into small modules.

Language Matters

In Montréal, training must be available in both EN and FR to ensure full understanding and reduce compliance gaps across teams.
Bilingual content increases completion rates and improves behavior change because employees receive guidance in the language they are most comfortable with.

Phishing Simulations: Measuring What Really Matters

Phishing simulations are not a punishment tool. They are a learning tool that reveals risk patterns.

Key metrics that matter:
• Click rate: how many users clicked a malicious link
• Report rate: how many users correctly reported the test
• Repeat offender rate: who consistently needs coaching
• Time to report: how quickly users escalate suspicious messages

A good simulation program gradually introduces harder emails, including brand impersonation, shared document lures, voicemail attachments, and MFA push scams.

Manager Involvement and Incentives

Training programs that involve managers see far higher adoption.
Managers can help by:
• Setting expectations during team meetings
• Recognizing employees who report threats quickly
• Allowing 5 minutes per month for micro learning
• Reinforcing security culture during onboarding

Positive incentives outperform negative reinforcement. Teams that celebrate progress build habits faster and maintain them longer.

Policy Reinforcement: Passwords, MFA, Devices

Awareness training works best when tied directly to daily policies.

Examples of reinforcement:
• Password creation habits
• MFA use and how to avoid MFA fatigue
• Device locking rules
• Safe use of cloud applications
• Clean desk and removable media guidelines

The purpose is not to overwhelm employees but to explain why these policies matter and how they protect the business.

90 Day Curriculum Table (Sample for SMBs)

This structure keeps training light but impactful, with measurable behavioral improvement every month.

FAQ

Do employees get annoyed by ongoing training?
Not when it is short, relevant, and practical.

How often should phishing simulations be sent?
Once per month is ideal for sustained improvement.

What if someone keeps failing simulations?
Provide short coaching instead of penalties. Personalized micro learning works better than punishment.

Can we train remote and hybrid users consistently?
Yes. Modern platforms deliver the same experience across laptops, office devices, and phones.

How long until we see improvement?
Most SMBs reduce phishing click rates by half within 60 to 90 days.

Modern Attacks Have Outgrown Traditional Antivirus
Ten years ago, a signature-based antivirus was enough to keep small business endpoints safe. Today, that’s no longer true. Modern threats use fileless malware, credential theft, and living-off-the-land techniques that don’t rely on static signatures at all. By the time a traditional antivirus recognizes the pattern, the attacker has already moved laterally across the network. For SMBs in Montréal, the question is no longer “Do we need security?” — but “What level of endpoint protection actually makes sense for our size and risk profile?”

Defining the Landscape: AV, NGAV, EDR, and MDR/XDR
Before comparing costs, it’s important to understand the terminology:

Term	Description	Typical Use Case
Antivirus (AV)	Signature-based scanning for known malware.	Basic protection for small offices with limited risk exposure.
Next-Gen Antivirus (NGAV)	Uses behavioral and AI models to detect new or unknown threats.	Step up from AV, minimal configuration needed.
Endpoint Detection & Response (EDR)	Adds real-time monitoring, investigation tools, and containment actions.	For organizations that need visibility and control.
Managed Detection & Response (MDR/XDR)	EDR backed by a 24/7 security team analyzing alerts and taking action.	Ideal for SMBs without in-house security expertise.

Feature Comparison: Detection, Containment, and Response

Feature	Traditional AV	EDR / MDR
Threat Detection	Signature-based; known malware only	Behavioral + AI; detects unknown attacks
Response	Quarantine infected files	Isolate endpoints, kill malicious processes, rollback changes
Visibility	Limited	Full endpoint activity timeline
Integration	Standalone	Integrated with SIEM, SOC, and cloud platforms
Reporting	Basic logs	Actionable analytics and incident reports
Traditional antivirus reacts after an infection is identified. EDR systems, on the other hand, detect, contain, and respond to suspicious activity — before business operations are disrupted.

Staffing Reality for SMBs
For most SMBs, having a dedicated SOC or cybersecurity analyst isn’t realistic. That’s why EDR platforms are often bundled with managed response services — providing enterprise-level protection without hiring a full-time team. At AET Solutions, we see SMB clients adopt EDR mainly because it outsources the monitoring and response to experts who can act on alerts 24/7, rather than leaving notifications unreviewed in a dashboard.

Cost Model: Agent + Service
While antivirus is typically a low, flat annual cost per device, EDR pricing combines two layers: (1) per-endpoint agent license (e.g., $3–$6 per month per device) and (2) managed service fee for monitoring and response (optional, but strongly recommended). The total cost for a small business with 25–50 endpoints is usually $1,500–$4,000 per year, depending on whether the service is fully managed. That’s still a fraction of the potential losses from a ransomware attack or extended downtime.

Implementation Pitfalls
Even the best EDR or AV solution can fail if deployed incorrectly. Common issues include overly broad exclusions that create blind spots, lack of alert tuning leading to alert fatigue, agents not deployed consistently across all devices, and no clear incident response playbook for follow-up actions. Partnering with an experienced Managed IT provider ensures your configuration is aligned with both security and productivity needs.

Decision Tree: When AV Is Enough — and When to Step Up
Antivirus is sufficient if: you have fewer than 10 endpoints and no remote access or shared servers; devices are used for basic email and office tasks only; you already have strong email filtering and network firewalls.
EDR is essential if: you store or process client data (financial, medical, or confidential); you use Microsoft 365, cloud drives, or hybrid environments; you allow remote work, VPN, or mobile access; or you need to meet compliance or cyber-insurance requirements. In 2025, with the rise of AI-driven phishing and zero-day exploits, EDR is quickly becoming the new baseline for endpoint protection — not a luxury.

FAQ
Is EDR the same as antivirus? No. Antivirus detects known threats; EDR detects behaviors and allows real-time response.
Can EDR replace my antivirus? Yes — most EDR solutions include NGAV capabilities, replacing legacy antivirus entirely.
Do SMBs really need 24/7 monitoring? If your staff doesn’t review alerts overnight or on weekends, then yes — managed EDR ensures continuous protection.
What’s the main cost driver? Licensing is predictable, but managed response hours and data retention often define the total annual cost.

Next Steps
Not sure which solution fits your business? AET Solutions helps Montréal SMBs evaluate endpoint security through our Cybersecurity Baseline Assessment — covering EDR readiness, policy compliance, and ROI comparisons.
Book your assessment today: https://aetsolutions.ca/cybersecurity