AI security.
Your team is already shipping AI features. Procurement is approving SaaS that ships with an LLM bundled in. AI risk is a security problem you can't defer. We help you frame it, govern it, and pass an AI risk review.
What we cover
- NIST AI Risk Management Framework (AI RMF) 1.0. Map / Measure / Manage / Govern, applied to your AI use cases.
- OWASP LLM Top 10. Prompt injection, data leakage, insecure plugin design, model DoS, foundation-model supply chain risk.
- Model governance. Inventory of models in use, lifecycle policy, model card requirements, retirement criteria.
- Data-pipeline review. Where training data comes from, how it's sanitized, how PII is filtered, how prompts are logged and retained.
- AI vendor risk. Reviewing the AI clauses in your SaaS contracts (data residency, training opt-out, breach notification, model versioning).
- ISO/IEC 42001 readiness. The new AI management system standard, for organizations that need a certifiable governance program.
- Acceptable use policy. Practical guidance for what employees can and cannot put into LLMs.
What this is not
This is not red-team prompt-injection-of-the-week theater. It's governance, risk, and compliance for AI, designed so that when a regulator, an auditor, or a customer asks how you manage AI risk, you have a written answer.
Common engagements
- AI Risk Workshop. Half-day session with leadership. Around 4 hours.
- AI Use Case Review. One model, end-to-end. Around 10 hours.
- AI Acceptable Use Policy & governance baseline. Around 20 hours.
- NIST AI RMF readiness. Around 40 hours.
- ISO/IEC 42001 readiness. 80+ hours.
Common questions
We are not an AI company. Do we need this?
If you use Microsoft Copilot, Google Gemini, ChatGPT Enterprise, Claude, an AI coding assistant, or any SaaS that ships with AI features bundled in, you have AI risk to govern. Most of what we cover is policy and process, not model science.
Do you assess our model itself?
Not directly. We're not ML researchers and we'll tell you when you need one. We govern the program around the model: inputs, outputs, vendors, policies, monitoring, and incident playbooks.