Ottawa, since 2019 · Two practices, one principal
Built on Evidence.
Driven by Experience.
Depth you can test. A method you can follow.
Those are the two things a client is reaching for when they hire an adviser, and four designations sit behind them: engineering for depth, CMC for method, CISSP for the security judgment a gate actually tests, and an MBA for the commercial half. Sagentix was built so all of it is what every engagement runs on.
Stéphane Raby
Founder & Principal · CISSP · CMC · P.Eng. · MBA
Stéphane has spent twenty-five years on the side of the table that judges the work. He designed two Canada-wide networks, one of them shared across federal departments. He wrote the procurement documents vendors answered, and scored the submissions against criteria he had written himself. Then he read authorization packages as the assessor who had to sign the risk.
He also taught roughly two thousand federal public servants how to assess a cloud provider, in both official languages, for the Canadian Centre for Cyber Security — including the course that certifies assessors. You cannot teach a control to someone who has to apply it on Monday and hide behind abstraction; they will ask the question that finds the gap.
Few advisers have read the evidence from the reviewer’s chair. That is where the standard comes from, and it is why the work is built to survive the reading rather than to impress the buyer.
“Twenty-five years on the client side taught me what people are really reaching for when they hire an adviser: analysis deep enough to survive being pulled apart, and a method they can follow rather than take on faith. I carry four designations and each one guarantees a piece of that — the P.Eng. for depth, the CMC for method, the CISSP for the security judgment a gate actually tests, and the MBA for the commercial half. I built Sagentix so all of it is the default. What clients tell me most often is that the work went further than they expected — and that is the standard I want us judged against.”
Listen
Hear the Sagentix Story
Pick the length that fits your day. AI-narrated from scripts written and signed by Stéphane.
Miniseries — in any order
The founder's career, both practices, what the firm can show you, and how the work is bought.
One engagement, start to finish
“Stephane closed our go-to-market gap. He translated AI-calibration and sensor intelligence into language Municipal, Industrial, and ESG buyers act on — then delivered the pitch deck, vertical solution briefs, and digital roadmap our team uses.”
Ecosystem Informatics builds AI-powered environmental intelligence — sensor calibration and emissions monitoring, led by a professional engineer with a doctorate who is both CEO and CTO. The technology was strong. The work was to make three very different buyers see themselves in it.
A municipal water director, an industrial plant manager and an ESG reporting lead buy on different budgets, in different language, against different standards of proof. One message aimed at all three persuades none of them.
Delivered
Buyer personas, brand message architecture, a pitch deck, vertical solution briefs, and a digital roadmap the team runs itself — the full ten phases, with a separate evidenced answer for each buyer.
More client wordsWhat We Can Show You
Ranked the way a buyer weighs proof — a record you can check yourself first, a credential last.
Public record
Check it yourself
The independence position
Accreditations as a certification body or third-party assessment organization sit in a public register maintained by the national accreditation body. Ours is empty, and so is the applied-for column — anyone can look it up in a few minutes.
Delivery record
15 / 13
Authority-to-operate decisions, thirteen at Protected B
Across a national federal programme, 2023–2025, delivered by the firm on one shared traceability matrix. What the client achieved because of it is the client’s claim to make, not ours.
Work product
1,414
Catalogued IP artifacts behind an 18-check gate
Frameworks, deliverable architectures, research briefs and evidence tables, with citation-integrity and numeric-consistency validation that blocks rather than warns. The gate is inspectable by a prospect.
Credential
4
Professional designations, plus Secret clearance
CISSP, CMC, P.Eng. and an Executive MBA, with an active Government of Canada Secret (Level II) clearance and bilingual delivery. In a scan of 46 firms completed in 2026, the CISSP and the CMC were held together only here — a bounded finding on a stated sample, on a stated date.
Sagentix prepares organizations for independent assessment. The party who reviews the work is always an independent one — a certification body, an examining firm, a regulator, or the department granting the authorization. That separation is what gives the evidence its weight. Readiness and authoring is the whole of what we do; for the assessment itself, the certification decision, a security operations centre or a penetration test, we will point you to a specialist we rate.
Why One Firm Does Both
Regulated buyers do not experience these as two problems. A vendor selling into a bank, a hospital or a federal department meets a gate before it meets a buyer.
Practice one
Sagentix Cyber & AI
Authoring the evidence a governed decision runs on — federal authorization at Protected B, ISO 27001 and SOC 2 readiness, privacy programmes across several regimes, AI governance and post-quantum migration.
See the practicePractice two
Sagentix Go-to-Market
Ten phases from market intelligence to roadmap, run in the same order every time, with a median of 38 APA citations per phase deliverable. Every claim traced to a source your board can check.
See the practiceBoth practices, one engagement
Clear the gate, then build the motion that sells through it — one purchase order, one accountable principal.
Regulated Market AccessA way to fund the work
Where your Industrial Technology Advisor at the National Research Council has approved a Management Advisory Services allocation, we deliver inside that scope as a CMC-designated consultant.
NRC IRAP Management Advisory ServicesHow the Standard Holds on the Last Day of a Long Engagement
Eighteen checks run on every deliverable. Two of them block rather than warn, and those two are worth naming.
Citation integrity — a blocking check
Every in-text citation must resolve to exactly one entry in the reference list, matched by exact identity rather than by similarity. That distinction is the whole point: a similarity match passes a fabricated citation whenever one entry carries the right surname and another carries the right year. Truth and attribution fail independently, so the source gets its own gate.
Numeric consistency — a blocking check
A stated count is a claim about the document itself, so it fails independently of whether the underlying facts are right. "Four of six pairs align" above a table showing three survives every fact-check, because each individual fact in it is correct. The gate reconciles the sentence against the table, the subset against the universe, and the summary against the model it summarizes.
Every claim carries its own status
A claim we can source carries its citation; one still being run down carries an [Unverified] tag and keeps it until the source arrives. Every dollar figure is converted to one currency before any arithmetic runs. And every deliverable is read and signed by Stéphane before it reaches you — automation does the checking machines are better at, a person does the judgment that needs a human.
Verified credentials
CISSP
(ISC)²
CMC
CMC-Canada
P.Eng.
OIQ (Ordre des ingénieurs du Québec)
MBA
uOttawa Telfer
Plus an active Government of Canada Secret (Level II) clearance and bilingual delivery. In a scan of 46 firms completed in 2026, the CISSP and the CMC were held together only here — a bounded finding, on a stated sample, on a stated date.
Industries We Already Know on Day One
Every engagement runs the same methodology. What changes by industry is the vocabulary, the regulator, and what a buyer there treats as proof — grouped by the kind of buying system, because that is what actually differs.
Regulated & public sector
Where an authorization, a certification or a statute decides whether you can sell at all.
- Government & Public SectorFederal delivery record
- Defence & National SecurityMultiple defence engagements
- Banking & Financial ServicesCentral bank + Caribbean banking
- Healthcare & Digital HealthDelivered engagements
- Insurance & Employee BenefitsCarrier + broker channel
Industrial, resource & infrastructure
Long capital cycles, procurement-driven buyers, and a regulator in the room from day one.
- Mining & Critical MineralsROI modelling delivered
- Environmental Intelligence & MonitoringP.Eng. + delivered engagements
- Energy, Oil & GasUpstream to downstream
- Construction Compliance & PermittingActive engagement
- Logistics & TransportationDelivered engagement
Technology, security & professional services
Where the product is genuinely good and the positioning is what is failing.
- CybersecurityCISSP-certified
- Cloud & InfrastructureAuthorization advisory
- Safety-Critical Systems AssuranceEngineering background
- Satellite, Space & BroadcastDelivered engagement
- B2B SaaSGrowth-stage focus
- Higher Education & ResearchActive engagement
- RegTech & Privacy TechnologyActive engagement
- Management ConsultingCMC-designated
Your industry not on the list? The methodology is industry-agnostic. What the list buys you is a shorter run-up — the vocabulary, the regulator and the buying system understood on day one rather than learned on your time.
Depth you can test. A method you can follow.
Thirty minutes is enough to establish which gate applies to you, what the evidence you already hold is worth against it, and what the elapsed time realistically looks like.
Go-to-Market Phase 1 carries a money-back guarantee: if it reveals nothing you did not already know, you receive a full refund and keep the deliverable.