Issue 001 · Spring 2026Toronto · Global

Built by practitioners.
Run from Toronto.

MALTO Cyber is a Toronto-based cybersecurity practice: consulting engagements, and software you can buy today. We were founded by transformation practitioners who got tired of watching security programs die on contact with reality. So we built a firm that ships outcomes, not decks.

At a glance
Founded2018 / 2022 (Cyber)
HeadquarteredToronto, Canada
EngagementsGlobal
FrameworksNIST · SOC 2 · ISO · CIS
●Founded 2018●Toronto · Canada●PMP · CSM · SAFe · MBA●Services Today · Software Shipping●Founded 2018●Toronto · Canada●PMP · CSM · SAFe · MBA●Services Today · Software Shipping
§ 02 · Partners

Two founders. One bet.

M
No. 01
he/him

Marcus Tommy.

Founder & Managing Partner

Marcus co-founded MALTO Cyber to help organizations deliver strategic technology programs with cybersecurity built in from day one. He leads firm strategy and product direction, bringing extensive Program and Portfolio Management experience to every client relationship, prioritizing the organizational vision, stakeholders, and customers behind every engagement.

PMPCSMSAFe Agile
G
No. 02
she/her

Gurbir Mahl.

Founder & Managing Partner

Gurbir co-founded MALTO Cyber and is a recognized authority in Business, IT, and Cyber Services consulting. Her expertise in Strategic Portfolio Management and Organizational Change Management drives enterprise value through transformation and innovation initiatives, with delivery experience across Aviation, Financial Services, Retail, and Manufacturing.

MBAPMPCSM
§ 03 · Principles

What we believe. In practice.

i.

Practitioners first.

Every engagement runs through a senior practitioner, not a junior consultant with a methodology deck.

ii.

Tools over theatre.

We’d rather hand you a working runbook than a 200-page strategy. Outcomes ship.

iii.

Compounding security.

Monthly reviews, continuous evidence, on-call response, instead of point-in-time PDFs that age out the moment they ship.

iv.

Data sovereignty.

Our software defaults to self-hosted. Your sensitive evidence stays on your infrastructure.

§ 04 · Timeline

Eight years. Two products shipping.

2018

MALTO Group founded: strategy & transformation consulting.

2022

MALTO Cyber spun out as a dedicated cybersecurity practice.

2024

Services across 14 industries, including financial services, healthcare, public sector, manufacturing.

2026

NISTForge ships self-serve.

§ 05 · Press

In the press.

§ 06 · Work with us

Let’s build something that lasts.