Company Profile
Canvia is a Peru-based enterprise technology, digital transformation and managed-services company with an established cybersecurity operation serving private companies, financial institutions, industrial organizations and public-sector entities.
Cybersecurity is one component of a broader Canvia portfolio that includes cloud transformation, application development, data and analytics, digital workplaces, document management, banking technology and enterprise infrastructure. This wider operating model is important: Canvia is not primarily a manufacturer of one proprietary security product. It functions as an enterprise integrator, managed-security operator and incident-response provider capable of combining its internal specialists with platforms from global cybersecurity vendors.
Its cybersecurity infrastructure is centered on a continuously operating CyberSOC and the CANVIA-CSIRT incident-response team. The company offers monitoring, detection, investigation, containment, eradication and recovery alongside endpoint, network, application, identity, cloud and operational-technology security.
Canvia states that it has more than 350 specialists across cybersecurity and cloud disciplines. Its cybersecurity portfolio is supported by technology partnerships involving Fortinet, Trend Micro, Palo Alto Networks, F5, Splunk, IBM, Rapid7, Kaspersky, VU Security and other providers. Canvia’s official cybersecurity portfolio confirms its CyberSOC, CSIRT and multi-vendor operating model.
Infrastructure Stack
Managed Security Services
Cybersecurity Operations Center
Computer Security Incident Response Team
AI-Assisted Security Operations
Security Information and Event Management
Endpoint Security
Network Security
Application Security
Cloud Security
Hybrid Cloud Security
Multi-Cloud Security
Digital Identity
Operational Technology Security
Ethical Hacking
Incident Detection
Incident Response
Threat Monitoring
Security Automation
Security Systems Integration
Cyber Risk Management
Cybersecurity Compliance
Business Continuity
Digital Forensics Support
Enterprise Technology Operations
Visual Signature
Website
Website
Operational Snapshot
Problem They Solve
Fragmented Enterprise Security Operations
Solution They Provide
Integrated CyberSOC, CSIRT and Security Technology Management
In Plain Terms
What They Really Do?
Primary Operating Model: Managed Security Services and Systems Integration
Security Operations Model: Continuous 24/7/365 monitoring
Incident Response Function: CANVIA-CSIRT
Primary Market: Peru
Extended CSIRT Constituency: Peru and Colombia
Legal Entity: AI Inversiones Palo Alto II S.A.C.
Canvia addresses organizations that need permanent cybersecurity capabilities but may not possess the internal staff, infrastructure, processes or vendor expertise required to operate them independently.
A customer may already own endpoint agents, firewalls, identity systems, cloud platforms, SIEM technology and vulnerability-management tools. The problem is that ownership does not ensure effective operation. The individual systems still need to be configured, integrated, monitored and connected to an incident-response process.
Canvia provides the operational layer between the technology and the customer.
Its CyberSOC monitors security events, investigates suspicious activity and coordinates responses. CANVIA-CSIRT provides a formal incident-response structure for detecting and analyzing incidents, containing the attack, eradicating the cause, recovering affected operations and conducting post-incident activities.
In Plain Terms
Canvia helps organizations operate cybersecurity systems that would otherwise remain fragmented across different products, teams and departments.
It can integrate technologies from several security vendors, monitor the resulting alerts and provide specialists who determine which events require action. When a legitimate incident is identified, its CSIRT can support the customer through containment, eradication and recovery.
The distinction between Canvia and a cybersecurity product company is fundamental.
Fortinet develops security platforms. Palo Alto Networks develops security platforms. Splunk develops data and security-operations technology. Rapid7 develops exposure and detection capabilities. VU Security develops identity and fraud-related systems.
Canvia helps customers select, implement, integrate and operate technologies such as these inside actual enterprise environments.
Its value is therefore measured less by the originality of an individual software product and more by operational availability, local expertise, integration quality, incident-handling capability and familiarity with the customer’s business and regulatory environment.
What Canvia Really Does
Canvia acts as an outsourced extension of the customer’s technology and security organization.
Its position is broader than that of a conventional managed security provider because cybersecurity is connected to Canvia’s cloud, infrastructure, application, data, service-desk, document-management and business-process capabilities.
This gives the company access to systems that cybersecurity teams often need to understand during an incident. An attack may involve an endpoint, but the operational consequences can affect cloud workloads, business applications, customer records, financial processes, internal support systems and regulated documents.
Because Canvia operates across these layers, it can potentially coordinate security with a wider technology-transformation program.
That breadth also creates a requirement for clearly defined responsibility. Customers must establish which systems Canvia monitors, which actions its analysts may perform autonomously, which incidents require customer approval and how responsibilities are divided between Canvia, the technology vendor and the customer’s internal teams.
The platform vendor supplies security capability.
Canvia turns that capability into an operating service.
CANVIA CyberSOC
The CyberSOC is the central monitoring and coordination layer of Canvia’s cybersecurity operation.
It provides continuous surveillance across security technologies and supports the detection, classification, investigation and escalation of suspicious activity. The operating model is intended to reduce the time between the appearance of an indicator and the decision to contain or investigate it.
Security Operations Centers routinely face large event volumes. Endpoint systems, firewalls, identity platforms, applications, cloud services and network infrastructure can generate thousands or millions of signals. Only a small proportion may represent meaningful attacks.
The SOC must therefore perform several functions simultaneously. It must collect telemetry, maintain detection logic, correlate events, suppress noise, investigate anomalies, assign severity and preserve sufficient context for an effective response.
Canvia combines its analysts with technology from partners such as Splunk, Fortinet, Palo Alto Networks, Trend Micro, IBM and Rapid7. The exact architecture can vary depending on the customer’s existing environment and selected technologies.
This makes Canvia’s CyberSOC a multi-vendor operational function rather than a closed proprietary ecosystem.
CyberIA and AI-Assisted Operations
CyberIA is an artificial-intelligence capability developed to support the operation of Canvia’s CyberSOC.
Its purpose is not to replace security analysts. It automates initial tasks associated with high-volume use cases so human specialists can concentrate on complex events, investigations and decisions requiring operational judgment.
Canvia states that CyberIA currently processes use cases representing more than 40% of the alerts monitored within its operation. These include unauthorized access, disconnected security agents and alerts associated with phishing campaigns.
The system was trained using historical alert information and analytical rules applied by Canvia’s SOC specialists. Classification models are supplemented with patterns and criteria derived from the experience of human analysts.
According to Canvia, CyberIA reduced the confirmation time for critical events from approximately 15 minutes to around 50 seconds. This is a company-reported operational result rather than an independently validated benchmark, but it illustrates the intended function of the technology: accelerating the first stage of security-event classification. Canvia published the CyberIA operating details in July 2026.
CyberIA positions Canvia within AI-Driven Security Operations and Security Automation. It does not, by itself, make Canvia a provider of AI model security or machine-learning infrastructure protection. Its present role is the application of AI inside managed security operations.
CANVIA-CSIRT
CANVIA-CSIRT provides the formal incident-response capability behind Canvia’s cybersecurity services.
The team supports all major stages of the incident lifecycle: preparation, detection and analysis, containment, eradication, recovery and post-incident review.
CANVIA-CSIRT has been a member of the Forum of Incident Response and Security Teams, or FIRST, since December 21, 2022. FIRST records the team as having been established in August 2015 and identifies AI Inversiones Palo Alto II S.A.C. as its host organization.
Its declared constituency includes government, public-sector and private-sector organizations in Peru and Colombia. Standard business hours are listed separately, while critical incidents are handled through a 24/7 operating model. The team also maintains a public PGP key for protected incident-related communications. These operational details are independently documented in the FIRST member directory.
FIRST membership is relevant because it connects CANVIA-CSIRT with an international community of incident-response teams. That network can support information exchange, indicators of compromise, cross-border escalation and collaboration during incidents affecting multiple organizations or jurisdictions.
Membership does not prove that every response engagement will be successful. It does, however, establish that Canvia operates a formally recognized incident-response function rather than using CSIRT terminology only as a marketing label.
Endpoint and Network Security
Canvia implements and operates security controls across endpoints and networks.
Endpoint security can include malware prevention, endpoint detection, policy management, agent monitoring and response coordination. Network security covers perimeter controls, segmentation, secure connectivity, traffic inspection and protection of communication between users, applications and infrastructure.
The company’s multi-vendor relationships allow it to build around technologies already used by the customer. This can reduce forced product replacement, but it also increases the importance of integration design.
A firewall, endpoint platform and SIEM may each operate correctly while still failing to provide a coherent picture of an attack. Canvia’s operational role is to connect those layers through monitoring, correlation and response procedures.
Application and Cloud Security
Canvia provides security across hybrid and multi-cloud environments, supported by its broader Journey to Cloud and application-development capabilities.
Cloud security requires visibility into configurations, identities, workloads, data, network exposure and service-provider responsibilities. The challenge is particularly significant for organizations that retain legacy infrastructure while moving selected applications and data to public-cloud environments.
Application security adds testing, secure development, vulnerability identification and protection for customer-facing and internal software. Canvia’s software-development and testing operations allow security work to be connected with the teams responsible for building and maintaining applications.
This operating model supports DevSecOps even when Canvia does not use that term as the primary label for every engagement. Security controls can be incorporated into development, testing, deployment and continuing application maintenance.
Digital Identity
Digital identity is part of Canvia’s declared cybersecurity portfolio.
Its partnerships and wider digital-services operation make identity relevant across customer authentication, employee access, digital signatures, electronic documents and regulated business processes.
The Smart Info service handles digital and electronic signatures, document authentication and legally valid digital records. Smart Banking applies related technology to financial processes involving cheques, legal orders, electronic signatures and regulated documentation.
These activities connect identity security with Digital Identity Verification, fraud prevention, document integrity and compliance. They also place Canvia inside environments where an identity failure can have direct financial or legal consequences.
OT Security and Industrial Environments
Operational Technology Security is included in Canvia’s cybersecurity portfolio.
OT environments may contain industrial systems, production equipment, operational networks and specialized devices that cannot be managed like ordinary enterprise computers. Availability and safety can be as important as confidentiality.
Canvia’s presence across industrial and commercial sectors gives OT security practical relevance. The company has published a case involving Komatsu in which a CyberSOC was implemented to strengthen security and risk management around the organization’s technology environment.
OT engagements require clear boundaries between monitoring, network security, vulnerability management and operational authority. An automated response that is appropriate for an office endpoint may be unsafe when applied to industrial equipment.
Canvia’s role in these environments is therefore partly technical and partly procedural.
Ethical Hacking
Canvia includes ethical hacking within its official cybersecurity portfolio.
Ethical hacking can involve controlled security assessments, vulnerability discovery, penetration testing and examination of weaknesses across applications, networks or infrastructure.
The term does not automatically confirm the depth of every engagement. Buyers should determine whether the work includes automated vulnerability scanning, manual penetration testing, application testing, adversarial simulation or a broader red-team exercise.
The scope, methodology, testing authorization, evidence handling and remediation process should be established before the engagement begins.
Canvia’s ethical-hacking capability is most valuable when findings are connected to its wider monitoring, architecture, implementation and incident-response functions. Discovering a vulnerability creates limited value unless the organization also understands its operational importance and assigns responsibility for remediation.
Compliance and Operational Certifications
Canvia maintains several certifications relevant to enterprise service delivery.
Its ISO/IEC 27001:2022 scope includes information-security activities associated with its Security Operations Center, Network Operations Center, cloud services, technology operations, software development, testing, help desk and certain banking and document-management services.
ISO/IEC 20000-1:2018 covers service-management activities including data-center operations, NOC, SOC, system administration, technology implementation and support.
ISO 22301:2019 addresses business continuity, including technology operations, monitoring, backups, infrastructure and public-cloud management.
Canvia also reports CMMI Level 5, ISO 9001, ISO 14001, ISO 45001 and ISO 37001 certifications across applicable areas of its organization. The precise scope matters because a corporate certification does not necessarily apply identically to every product, location or customer engagement. Canvia publishes the stated scopes on its official certifications page.
Corporate History and Governance
Canvia describes its organizational and operational history as extending beyond 40 years.
It is not publicly positioned as a contemporary founder-led cybersecurity startup. The present company represents the evolution of a long-standing Peruvian enterprise technology and IT-services operation.
For that reason, a conventional founder profile would be misleading. Governance is more relevant than individual founder mythology.
Canvia currently identifies Augusto Ugarte as President of the Board. Listed directors include Julio Ramirez, Antonio Pedreros, Antonio Tuñon and Enrique Beltrán. Canvia publishes its current board structure.
The legal entity responsible for Canvia’s website and personal-data processing is AI Inversiones Palo Alto II S.A.C.
Security Operations Model: Continuous 24/7/365 monitoring
Incident Response Function: CANVIA-CSIRT
Primary Market: Peru
Extended CSIRT Constituency: Peru and Colombia
Legal Entity: AI Inversiones Palo Alto II S.A.C.
Canvia addresses organizations that need permanent cybersecurity capabilities but may not possess the internal staff, infrastructure, processes or vendor expertise required to operate them independently.
A customer may already own endpoint agents, firewalls, identity systems, cloud platforms, SIEM technology and vulnerability-management tools. The problem is that ownership does not ensure effective operation. The individual systems still need to be configured, integrated, monitored and connected to an incident-response process.
Canvia provides the operational layer between the technology and the customer.
Its CyberSOC monitors security events, investigates suspicious activity and coordinates responses. CANVIA-CSIRT provides a formal incident-response structure for detecting and analyzing incidents, containing the attack, eradicating the cause, recovering affected operations and conducting post-incident activities.
In Plain Terms
Canvia helps organizations operate cybersecurity systems that would otherwise remain fragmented across different products, teams and departments.
It can integrate technologies from several security vendors, monitor the resulting alerts and provide specialists who determine which events require action. When a legitimate incident is identified, its CSIRT can support the customer through containment, eradication and recovery.
The distinction between Canvia and a cybersecurity product company is fundamental.
Fortinet develops security platforms. Palo Alto Networks develops security platforms. Splunk develops data and security-operations technology. Rapid7 develops exposure and detection capabilities. VU Security develops identity and fraud-related systems.
Canvia helps customers select, implement, integrate and operate technologies such as these inside actual enterprise environments.
Its value is therefore measured less by the originality of an individual software product and more by operational availability, local expertise, integration quality, incident-handling capability and familiarity with the customer’s business and regulatory environment.
What Canvia Really Does
Canvia acts as an outsourced extension of the customer’s technology and security organization.
Its position is broader than that of a conventional managed security provider because cybersecurity is connected to Canvia’s cloud, infrastructure, application, data, service-desk, document-management and business-process capabilities.
This gives the company access to systems that cybersecurity teams often need to understand during an incident. An attack may involve an endpoint, but the operational consequences can affect cloud workloads, business applications, customer records, financial processes, internal support systems and regulated documents.
Because Canvia operates across these layers, it can potentially coordinate security with a wider technology-transformation program.
That breadth also creates a requirement for clearly defined responsibility. Customers must establish which systems Canvia monitors, which actions its analysts may perform autonomously, which incidents require customer approval and how responsibilities are divided between Canvia, the technology vendor and the customer’s internal teams.
The platform vendor supplies security capability.
Canvia turns that capability into an operating service.
CANVIA CyberSOC
The CyberSOC is the central monitoring and coordination layer of Canvia’s cybersecurity operation.
It provides continuous surveillance across security technologies and supports the detection, classification, investigation and escalation of suspicious activity. The operating model is intended to reduce the time between the appearance of an indicator and the decision to contain or investigate it.
Security Operations Centers routinely face large event volumes. Endpoint systems, firewalls, identity platforms, applications, cloud services and network infrastructure can generate thousands or millions of signals. Only a small proportion may represent meaningful attacks.
The SOC must therefore perform several functions simultaneously. It must collect telemetry, maintain detection logic, correlate events, suppress noise, investigate anomalies, assign severity and preserve sufficient context for an effective response.
Canvia combines its analysts with technology from partners such as Splunk, Fortinet, Palo Alto Networks, Trend Micro, IBM and Rapid7. The exact architecture can vary depending on the customer’s existing environment and selected technologies.
This makes Canvia’s CyberSOC a multi-vendor operational function rather than a closed proprietary ecosystem.
CyberIA and AI-Assisted Operations
CyberIA is an artificial-intelligence capability developed to support the operation of Canvia’s CyberSOC.
Its purpose is not to replace security analysts. It automates initial tasks associated with high-volume use cases so human specialists can concentrate on complex events, investigations and decisions requiring operational judgment.
Canvia states that CyberIA currently processes use cases representing more than 40% of the alerts monitored within its operation. These include unauthorized access, disconnected security agents and alerts associated with phishing campaigns.
The system was trained using historical alert information and analytical rules applied by Canvia’s SOC specialists. Classification models are supplemented with patterns and criteria derived from the experience of human analysts.
According to Canvia, CyberIA reduced the confirmation time for critical events from approximately 15 minutes to around 50 seconds. This is a company-reported operational result rather than an independently validated benchmark, but it illustrates the intended function of the technology: accelerating the first stage of security-event classification. Canvia published the CyberIA operating details in July 2026.
CyberIA positions Canvia within AI-Driven Security Operations and Security Automation. It does not, by itself, make Canvia a provider of AI model security or machine-learning infrastructure protection. Its present role is the application of AI inside managed security operations.
CANVIA-CSIRT
CANVIA-CSIRT provides the formal incident-response capability behind Canvia’s cybersecurity services.
The team supports all major stages of the incident lifecycle: preparation, detection and analysis, containment, eradication, recovery and post-incident review.
CANVIA-CSIRT has been a member of the Forum of Incident Response and Security Teams, or FIRST, since December 21, 2022. FIRST records the team as having been established in August 2015 and identifies AI Inversiones Palo Alto II S.A.C. as its host organization.
Its declared constituency includes government, public-sector and private-sector organizations in Peru and Colombia. Standard business hours are listed separately, while critical incidents are handled through a 24/7 operating model. The team also maintains a public PGP key for protected incident-related communications. These operational details are independently documented in the FIRST member directory.
FIRST membership is relevant because it connects CANVIA-CSIRT with an international community of incident-response teams. That network can support information exchange, indicators of compromise, cross-border escalation and collaboration during incidents affecting multiple organizations or jurisdictions.
Membership does not prove that every response engagement will be successful. It does, however, establish that Canvia operates a formally recognized incident-response function rather than using CSIRT terminology only as a marketing label.
Endpoint and Network Security
Canvia implements and operates security controls across endpoints and networks.
Endpoint security can include malware prevention, endpoint detection, policy management, agent monitoring and response coordination. Network security covers perimeter controls, segmentation, secure connectivity, traffic inspection and protection of communication between users, applications and infrastructure.
The company’s multi-vendor relationships allow it to build around technologies already used by the customer. This can reduce forced product replacement, but it also increases the importance of integration design.
A firewall, endpoint platform and SIEM may each operate correctly while still failing to provide a coherent picture of an attack. Canvia’s operational role is to connect those layers through monitoring, correlation and response procedures.
Application and Cloud Security
Canvia provides security across hybrid and multi-cloud environments, supported by its broader Journey to Cloud and application-development capabilities.
Cloud security requires visibility into configurations, identities, workloads, data, network exposure and service-provider responsibilities. The challenge is particularly significant for organizations that retain legacy infrastructure while moving selected applications and data to public-cloud environments.
Application security adds testing, secure development, vulnerability identification and protection for customer-facing and internal software. Canvia’s software-development and testing operations allow security work to be connected with the teams responsible for building and maintaining applications.
This operating model supports DevSecOps even when Canvia does not use that term as the primary label for every engagement. Security controls can be incorporated into development, testing, deployment and continuing application maintenance.
Digital Identity
Digital identity is part of Canvia’s declared cybersecurity portfolio.
Its partnerships and wider digital-services operation make identity relevant across customer authentication, employee access, digital signatures, electronic documents and regulated business processes.
The Smart Info service handles digital and electronic signatures, document authentication and legally valid digital records. Smart Banking applies related technology to financial processes involving cheques, legal orders, electronic signatures and regulated documentation.
These activities connect identity security with Digital Identity Verification, fraud prevention, document integrity and compliance. They also place Canvia inside environments where an identity failure can have direct financial or legal consequences.
OT Security and Industrial Environments
Operational Technology Security is included in Canvia’s cybersecurity portfolio.
OT environments may contain industrial systems, production equipment, operational networks and specialized devices that cannot be managed like ordinary enterprise computers. Availability and safety can be as important as confidentiality.
Canvia’s presence across industrial and commercial sectors gives OT security practical relevance. The company has published a case involving Komatsu in which a CyberSOC was implemented to strengthen security and risk management around the organization’s technology environment.
OT engagements require clear boundaries between monitoring, network security, vulnerability management and operational authority. An automated response that is appropriate for an office endpoint may be unsafe when applied to industrial equipment.
Canvia’s role in these environments is therefore partly technical and partly procedural.
Ethical Hacking
Canvia includes ethical hacking within its official cybersecurity portfolio.
Ethical hacking can involve controlled security assessments, vulnerability discovery, penetration testing and examination of weaknesses across applications, networks or infrastructure.
The term does not automatically confirm the depth of every engagement. Buyers should determine whether the work includes automated vulnerability scanning, manual penetration testing, application testing, adversarial simulation or a broader red-team exercise.
The scope, methodology, testing authorization, evidence handling and remediation process should be established before the engagement begins.
Canvia’s ethical-hacking capability is most valuable when findings are connected to its wider monitoring, architecture, implementation and incident-response functions. Discovering a vulnerability creates limited value unless the organization also understands its operational importance and assigns responsibility for remediation.
Compliance and Operational Certifications
Canvia maintains several certifications relevant to enterprise service delivery.
Its ISO/IEC 27001:2022 scope includes information-security activities associated with its Security Operations Center, Network Operations Center, cloud services, technology operations, software development, testing, help desk and certain banking and document-management services.
ISO/IEC 20000-1:2018 covers service-management activities including data-center operations, NOC, SOC, system administration, technology implementation and support.
ISO 22301:2019 addresses business continuity, including technology operations, monitoring, backups, infrastructure and public-cloud management.
Canvia also reports CMMI Level 5, ISO 9001, ISO 14001, ISO 45001 and ISO 37001 certifications across applicable areas of its organization. The precise scope matters because a corporate certification does not necessarily apply identically to every product, location or customer engagement. Canvia publishes the stated scopes on its official certifications page.
Corporate History and Governance
Canvia describes its organizational and operational history as extending beyond 40 years.
It is not publicly positioned as a contemporary founder-led cybersecurity startup. The present company represents the evolution of a long-standing Peruvian enterprise technology and IT-services operation.
For that reason, a conventional founder profile would be misleading. Governance is more relevant than individual founder mythology.
Canvia currently identifies Augusto Ugarte as President of the Board. Listed directors include Julio Ramirez, Antonio Pedreros, Antonio Tuñon and Enrique Beltrán. Canvia publishes its current board structure.
The legal entity responsible for Canvia’s website and personal-data processing is AI Inversiones Palo Alto II S.A.C.
Founder
Bio
Its corporate roots extend to Graña y Montero Digital, commonly known as GMD. Historical regulatory filings state that the Graña y Montero group partnered with Chilean technology-services company Sonda S.A. in 1985 to establish GMD as its information-technology services subsidiary. The corporate formation is documented in historical SEC filings.
GMD developed enterprise technology, outsourcing, software, infrastructure and data-center capabilities in Peru for more than three decades.
In 2017, Graña y Montero sold GMD to Advent International through AI Inversiones Palo Alto II S.A.C. The company was subsequently repositioned under the Canvia name as a digital-transformation and enterprise-technology organization.
The present Canvia identity therefore represents a continuation and modernization of an established Peruvian technology-services institution rather than the launch of a completely new company.
In January 2025, Colca Capital acquired 100% of AI Inversiones Palo Alto from its previous shareholders. The transaction transferred control of Canvia from Advent International to Colca Capital.
Hugo Goicochea served as Canvia’s CEO at the time of the transaction and described the acquisition as a foundation for expanding the company’s services and exploring new international markets. Canvia’s current website lists Augusto Ugarte as President of the Board, with Julio Ramirez, Antonio Pedreros, Antonio Tuñon and Enrique Beltrán serving as directors.
GMD developed enterprise technology, outsourcing, software, infrastructure and data-center capabilities in Peru for more than three decades.
In 2017, Graña y Montero sold GMD to Advent International through AI Inversiones Palo Alto II S.A.C. The company was subsequently repositioned under the Canvia name as a digital-transformation and enterprise-technology organization.
The present Canvia identity therefore represents a continuation and modernization of an established Peruvian technology-services institution rather than the launch of a completely new company.
In January 2025, Colca Capital acquired 100% of AI Inversiones Palo Alto from its previous shareholders. The transaction transferred control of Canvia from Advent International to Colca Capital.
Hugo Goicochea served as Canvia’s CEO at the time of the transaction and described the acquisition as a foundation for expanding the company’s services and exploring new international markets. Canvia’s current website lists Augusto Ugarte as President of the Board, with Julio Ramirez, Antonio Pedreros, Antonio Tuñon and Enrique Beltrán serving as directors.
Headquarters
Phone
Email
Jirón Chota, Urbanización Cercado de Lima, Lima, Province of Lima, Lima Metropolitan Area, Lima, 15083, Peru
Services & Solutions
Canvia provides enterprise cybersecurity services through a combination of managed security operations, incident response, technology integration, consulting and implementation.
Its role is not limited to installing individual security products. The company designs, integrates and operates security environments built from Canvia’s internal capabilities and technologies supplied by partners such as Fortinet, Palo Alto Networks, Trend Micro, F5, Splunk, IBM, Rapid7, Kaspersky and VU Security.
Managed CyberSOC
Canvia operates a Cybersecurity Operations Center that provides continuous monitoring, event analysis, threat classification and incident escalation.
The service is designed for organizations that require 24/7/365 security coverage but may not maintain a complete internal SOC. Canvia analysts monitor telemetry generated by customer endpoints, networks, applications, identities, cloud environments and integrated security platforms.
The CyberSOC investigates events, determines their severity and coordinates the appropriate response with the customer and CANVIA-CSIRT.
AI-Assisted Security Operations
CyberIA introduces artificial intelligence into Canvia’s CyberSOC operation.
It processes selected high-volume use cases, automates initial event classification and helps analysts prioritize alerts requiring human investigation. Current use cases include unauthorized access, disconnected security agents and alerts associated with phishing campaigns.
CyberIA is an internal operational capability supporting Canvia’s managed services. It should not be described as a complete standalone AI cybersecurity platform.
Incident Response and CANVIA-CSIRT
CANVIA-CSIRT supports customers throughout the incident-response lifecycle.
Its services include incident preparation, detection and analysis, containment, eradication, recovery and post-incident review. During critical incidents, the team can operate through a 24/7 response model.
The CSIRT also provides communication channels for incident reporting, including a dedicated email address and public PGP key. Its FIRST membership allows it to exchange information and coordinate with recognized incident-response teams internationally.
Endpoint Security
Canvia implements and manages endpoint protection across workstations, servers and other enterprise devices.
Services can include endpoint-agent deployment, policy configuration, malware protection, endpoint detection, agent-health monitoring, alert investigation and response coordination.
Canvia may operate endpoint technologies supplied by different vendors, allowing the service to be adapted to the customer’s existing infrastructure.
Network Security
Network-security services include the implementation and management of controls governing traffic between users, applications, cloud environments and internal infrastructure.
The operating scope may include firewalls, segmentation, network monitoring, secure connectivity, intrusion detection and integration of network telemetry with the CyberSOC.
The objective is to establish visibility and control across the paths through which an attacker could enter, move laterally or communicate with external infrastructure.
Cloud and Multi-Cloud Security
Canvia supports security across hybrid and multi-cloud environments as part of its wider Journey to Cloud practice.
Cloud-security services can include architecture review, configuration management, identity controls, workload protection, security monitoring, compliance support and integration with existing enterprise infrastructure.
The combination of cloud specialists and cybersecurity analysts allows Canvia to connect cloud migration with continuing protection rather than treating security as a separate project added after deployment.
Application Security
Application-security services support the identification and reduction of weaknesses within customer-facing and internal applications.
Canvia’s broader software-development, maintenance and testing capabilities allow application security to be connected with the teams responsible for designing, modernizing and operating software.
The service may include security assessment, vulnerability identification, secure-development guidance, testing and remediation coordination.
Ethical Hacking and Penetration Testing
Canvia includes ethical hacking within its official cybersecurity portfolio.
Controlled security assessments can examine applications, infrastructure and networks for weaknesses that could be exploited by an attacker. The engagement should define the authorized scope, methodology, testing conditions, evidence-handling requirements and remediation process.
Ethical hacking should be categorized under Penetration Testing unless Canvia provides specific evidence of full Red Team Operations involving multi-stage adversarial campaigns.
Digital Identity
Digital-identity services address authentication, account protection, access management and verification across employee and customer environments.
Canvia also operates digital-document and electronic-signature services through Smart Info and Smart Banking. These services connect identity with document authenticity, legal validity, financial operations and regulated digital processes.
The resulting capability extends beyond conventional workforce access into Digital Identity Verification and the protection of transactions and electronic records.
OT and Industrial Security
Canvia provides Operational Technology Security for industrial and commercial environments.
OT security may include network visibility, segmentation, risk assessment, monitoring and the protection of systems supporting industrial operations. These environments require special care because automated containment actions appropriate for office IT systems may interrupt physical processes or affect operational safety.
Canvia’s industrial customer base and wider infrastructure capabilities provide a practical foundation for connecting OT security with enterprise CyberSOC monitoring.
Cybersecurity Consulting
Canvia advises customers on cybersecurity strategy, architecture, technology selection, security maturity and risk reduction.
The consulting function can define requirements before implementation and help establish governance, escalation procedures and division of responsibility between Canvia, the customer and individual technology vendors.
Consulting is most valuable when recommendations are converted into operational controls, monitoring and tested incident-response procedures.
Compliance and Business Continuity
Canvia supports organizations working within regulatory, information-security and continuity requirements.
Its own management systems include ISO/IEC 27001, ISO/IEC 20000-1 and ISO 22301 scopes covering applicable SOC, NOC, cloud, data-center, software, support and business-continuity operations.
Customer services can connect security monitoring, incident response, infrastructure management, backups, recovery planning and compliance reporting.
Its role is not limited to installing individual security products. The company designs, integrates and operates security environments built from Canvia’s internal capabilities and technologies supplied by partners such as Fortinet, Palo Alto Networks, Trend Micro, F5, Splunk, IBM, Rapid7, Kaspersky and VU Security.
Managed CyberSOC
Canvia operates a Cybersecurity Operations Center that provides continuous monitoring, event analysis, threat classification and incident escalation.
The service is designed for organizations that require 24/7/365 security coverage but may not maintain a complete internal SOC. Canvia analysts monitor telemetry generated by customer endpoints, networks, applications, identities, cloud environments and integrated security platforms.
The CyberSOC investigates events, determines their severity and coordinates the appropriate response with the customer and CANVIA-CSIRT.
AI-Assisted Security Operations
CyberIA introduces artificial intelligence into Canvia’s CyberSOC operation.
It processes selected high-volume use cases, automates initial event classification and helps analysts prioritize alerts requiring human investigation. Current use cases include unauthorized access, disconnected security agents and alerts associated with phishing campaigns.
CyberIA is an internal operational capability supporting Canvia’s managed services. It should not be described as a complete standalone AI cybersecurity platform.
Incident Response and CANVIA-CSIRT
CANVIA-CSIRT supports customers throughout the incident-response lifecycle.
Its services include incident preparation, detection and analysis, containment, eradication, recovery and post-incident review. During critical incidents, the team can operate through a 24/7 response model.
The CSIRT also provides communication channels for incident reporting, including a dedicated email address and public PGP key. Its FIRST membership allows it to exchange information and coordinate with recognized incident-response teams internationally.
Endpoint Security
Canvia implements and manages endpoint protection across workstations, servers and other enterprise devices.
Services can include endpoint-agent deployment, policy configuration, malware protection, endpoint detection, agent-health monitoring, alert investigation and response coordination.
Canvia may operate endpoint technologies supplied by different vendors, allowing the service to be adapted to the customer’s existing infrastructure.
Network Security
Network-security services include the implementation and management of controls governing traffic between users, applications, cloud environments and internal infrastructure.
The operating scope may include firewalls, segmentation, network monitoring, secure connectivity, intrusion detection and integration of network telemetry with the CyberSOC.
The objective is to establish visibility and control across the paths through which an attacker could enter, move laterally or communicate with external infrastructure.
Cloud and Multi-Cloud Security
Canvia supports security across hybrid and multi-cloud environments as part of its wider Journey to Cloud practice.
Cloud-security services can include architecture review, configuration management, identity controls, workload protection, security monitoring, compliance support and integration with existing enterprise infrastructure.
The combination of cloud specialists and cybersecurity analysts allows Canvia to connect cloud migration with continuing protection rather than treating security as a separate project added after deployment.
Application Security
Application-security services support the identification and reduction of weaknesses within customer-facing and internal applications.
Canvia’s broader software-development, maintenance and testing capabilities allow application security to be connected with the teams responsible for designing, modernizing and operating software.
The service may include security assessment, vulnerability identification, secure-development guidance, testing and remediation coordination.
Ethical Hacking and Penetration Testing
Canvia includes ethical hacking within its official cybersecurity portfolio.
Controlled security assessments can examine applications, infrastructure and networks for weaknesses that could be exploited by an attacker. The engagement should define the authorized scope, methodology, testing conditions, evidence-handling requirements and remediation process.
Ethical hacking should be categorized under Penetration Testing unless Canvia provides specific evidence of full Red Team Operations involving multi-stage adversarial campaigns.
Digital Identity
Digital-identity services address authentication, account protection, access management and verification across employee and customer environments.
Canvia also operates digital-document and electronic-signature services through Smart Info and Smart Banking. These services connect identity with document authenticity, legal validity, financial operations and regulated digital processes.
The resulting capability extends beyond conventional workforce access into Digital Identity Verification and the protection of transactions and electronic records.
OT and Industrial Security
Canvia provides Operational Technology Security for industrial and commercial environments.
OT security may include network visibility, segmentation, risk assessment, monitoring and the protection of systems supporting industrial operations. These environments require special care because automated containment actions appropriate for office IT systems may interrupt physical processes or affect operational safety.
Canvia’s industrial customer base and wider infrastructure capabilities provide a practical foundation for connecting OT security with enterprise CyberSOC monitoring.
Cybersecurity Consulting
Canvia advises customers on cybersecurity strategy, architecture, technology selection, security maturity and risk reduction.
The consulting function can define requirements before implementation and help establish governance, escalation procedures and division of responsibility between Canvia, the customer and individual technology vendors.
Consulting is most valuable when recommendations are converted into operational controls, monitoring and tested incident-response procedures.
Compliance and Business Continuity
Canvia supports organizations working within regulatory, information-security and continuity requirements.
Its own management systems include ISO/IEC 27001, ISO/IEC 20000-1 and ISO 22301 scopes covering applicable SOC, NOC, cloud, data-center, software, support and business-continuity operations.
Customer services can connect security monitoring, incident response, infrastructure management, backups, recovery planning and compliance reporting.
Operational Focus
Methodology
Canvia’s methodology can be described as an integrated managed-security lifecycle. This is an editorial description of its operating model rather than the name of a formally branded Canvia framework.
Assessment and Business Context
The process begins by identifying the customer’s critical systems, business processes, regulatory requirements, existing security technologies and operational dependencies.
Canvia must understand what the organization needs to protect, which interruptions would create the greatest damage and which teams possess authority during an incident.
This stage connects technical security requirements with business risk.
Architecture and Service Design
Canvia then defines the target security architecture and managed-service scope.
This includes determining which endpoints, networks, applications, identities, cloud systems and OT environments will be monitored. It also establishes which tools will generate telemetry, how alerts will reach the CyberSOC and which systems Canvia may access.
The service design should document responsibilities between Canvia, the customer and third-party vendors.
Technology Integration
Canvia integrates the selected security platforms into the customer environment.
Because the company operates through a multi-vendor ecosystem, this stage may involve technologies from Fortinet, Palo Alto Networks, Trend Micro, Splunk, IBM, Rapid7, F5, Kaspersky, VU Security and other providers.
The objective is to create a connected operating environment rather than a collection of isolated products.
Baseline and Detection Configuration
Once visibility is established, Canvia configures monitoring rules, detection logic, alert priorities and escalation conditions.
Normal operating behavior must be distinguished from suspicious activity. Customer-specific context is applied so analysts can understand which systems are critical and which events require immediate attention.
Historical alerts and analyst decisions may also be used to refine CyberIA’s classification capabilities.
Continuous Monitoring
The CyberSOC monitors telemetry and alerts on a 24/7/365 basis.
Security events are collected from endpoints, networks, applications, cloud platforms, identities and other integrated controls. Automated systems reduce noise and classify high-volume events, while human analysts review suspicious or high-impact activity.
Monitoring is continuous because enterprise environments and attacker behavior change over time.
Detection and Triage
Potential incidents are validated and prioritized.
Canvia analysts determine whether an alert represents expected activity, a security-policy violation, suspicious behavior or a confirmed incident. CyberIA can automate selected first-level classification tasks, but significant decisions remain under human supervision.
Confirmed events are enriched with available context before escalation.
Containment and Incident Response
When an incident is confirmed, CANVIA-CSIRT coordinates the response process.
Containment attempts to limit the attacker’s access and prevent further damage. Depending on established authority, actions may involve isolating endpoints, disabling accounts, blocking infrastructure or restricting network communication.
Critical decisions must follow customer-approved escalation and authorization procedures.
Eradication and Recovery
After containment, the team identifies and removes the cause of compromise.
Malicious software, unauthorized access, exposed credentials, vulnerable configurations and persistence mechanisms must be addressed before normal operations are restored.
Recovery includes validating systems, restoring services and monitoring for renewed attacker activity.
Post-Incident Review
Canvia reviews the incident after immediate operations have stabilized.
The review examines how the attacker gained access, which controls failed, how the incident was detected, whether escalation worked and which changes are required.
Lessons learned are converted into improved detections, updated procedures, architectural changes and customer recommendations.
Continuous Improvement
Security findings, incident experience, new threat intelligence and changing business requirements are incorporated into the managed service.
This continuous-improvement model is consistent with Canvia’s broader ISO management systems, CMMI maturity and FIRST incident-response participation.
The methodology is not based on a one-time technology installation. It is based on continuous operation, measurement, adaptation and response.
Assessment and Business Context
The process begins by identifying the customer’s critical systems, business processes, regulatory requirements, existing security technologies and operational dependencies.
Canvia must understand what the organization needs to protect, which interruptions would create the greatest damage and which teams possess authority during an incident.
This stage connects technical security requirements with business risk.
Architecture and Service Design
Canvia then defines the target security architecture and managed-service scope.
This includes determining which endpoints, networks, applications, identities, cloud systems and OT environments will be monitored. It also establishes which tools will generate telemetry, how alerts will reach the CyberSOC and which systems Canvia may access.
The service design should document responsibilities between Canvia, the customer and third-party vendors.
Technology Integration
Canvia integrates the selected security platforms into the customer environment.
Because the company operates through a multi-vendor ecosystem, this stage may involve technologies from Fortinet, Palo Alto Networks, Trend Micro, Splunk, IBM, Rapid7, F5, Kaspersky, VU Security and other providers.
The objective is to create a connected operating environment rather than a collection of isolated products.
Baseline and Detection Configuration
Once visibility is established, Canvia configures monitoring rules, detection logic, alert priorities and escalation conditions.
Normal operating behavior must be distinguished from suspicious activity. Customer-specific context is applied so analysts can understand which systems are critical and which events require immediate attention.
Historical alerts and analyst decisions may also be used to refine CyberIA’s classification capabilities.
Continuous Monitoring
The CyberSOC monitors telemetry and alerts on a 24/7/365 basis.
Security events are collected from endpoints, networks, applications, cloud platforms, identities and other integrated controls. Automated systems reduce noise and classify high-volume events, while human analysts review suspicious or high-impact activity.
Monitoring is continuous because enterprise environments and attacker behavior change over time.
Detection and Triage
Potential incidents are validated and prioritized.
Canvia analysts determine whether an alert represents expected activity, a security-policy violation, suspicious behavior or a confirmed incident. CyberIA can automate selected first-level classification tasks, but significant decisions remain under human supervision.
Confirmed events are enriched with available context before escalation.
Containment and Incident Response
When an incident is confirmed, CANVIA-CSIRT coordinates the response process.
Containment attempts to limit the attacker’s access and prevent further damage. Depending on established authority, actions may involve isolating endpoints, disabling accounts, blocking infrastructure or restricting network communication.
Critical decisions must follow customer-approved escalation and authorization procedures.
Eradication and Recovery
After containment, the team identifies and removes the cause of compromise.
Malicious software, unauthorized access, exposed credentials, vulnerable configurations and persistence mechanisms must be addressed before normal operations are restored.
Recovery includes validating systems, restoring services and monitoring for renewed attacker activity.
Post-Incident Review
Canvia reviews the incident after immediate operations have stabilized.
The review examines how the attacker gained access, which controls failed, how the incident was detected, whether escalation worked and which changes are required.
Lessons learned are converted into improved detections, updated procedures, architectural changes and customer recommendations.
Continuous Improvement
Security findings, incident experience, new threat intelligence and changing business requirements are incorporated into the managed service.
This continuous-improvement model is consistent with Canvia’s broader ISO management systems, CMMI maturity and FIRST incident-response participation.
The methodology is not based on a one-time technology installation. It is based on continuous operation, measurement, adaptation and response.
Market Scope
Geography
Canvia’s primary commercial market is Peru.
Its strongest vertical positioning includes financial services, banking, public administration, healthcare, retail, telecommunications, industry and commerce. These sectors require a combination of cybersecurity, cloud operations, digital processes, regulatory knowledge and continuing technology support.
CANVIA-CSIRT formally identifies both Peru and Colombia within its constituency. This supports a limited regional incident-response dimension, although Canvia should not be presented as having the same geographic reach as a global cybersecurity platform vendor.
Its strongest market position is that of a large, locally embedded enterprise technology operator with international vendor partnerships and an established Peruvian delivery organization.
This local position can be strategically important. Incident response often requires familiarity with the customer’s language, operating environment, decision-making structure, legal obligations and local business conditions. Global platforms can provide technology, but they do not always provide local operational coordination.
Its strongest vertical positioning includes financial services, banking, public administration, healthcare, retail, telecommunications, industry and commerce. These sectors require a combination of cybersecurity, cloud operations, digital processes, regulatory knowledge and continuing technology support.
CANVIA-CSIRT formally identifies both Peru and Colombia within its constituency. This supports a limited regional incident-response dimension, although Canvia should not be presented as having the same geographic reach as a global cybersecurity platform vendor.
Its strongest market position is that of a large, locally embedded enterprise technology operator with international vendor partnerships and an established Peruvian delivery organization.
This local position can be strategically important. Incident response often requires familiarity with the customer’s language, operating environment, decision-making structure, legal obligations and local business conditions. Global platforms can provide technology, but they do not always provide local operational coordination.
