Do you have a security Challenge?

Cyber Security Advisory

Cyber Governance, Risk & Compliance

CMMC Readiness & Uplift

Essential Eight Readiness and Uplift

OT Security & Risk Assessments

Security Architecture

AI security

Your AI rollout has already passed your security review. Or skipped it.

Copilots switched on across the tenant. A chatbot connected to the customer database. An agent that can raise tickets and change records. Most of these arrived through a business case, with security invited late. We find out what is actually running, what it can reach, and what needs to change before it causes an incident.

Book a 30-minute call

The risk

Old controls still matter. They just don't cover everything.

Instructions and data share a channel

A language model can't reliably tell its instructions from the text it reads. A poisoned document, email or web page can steer what it does next.

Instructions and data share a channel

A language model can't reliably tell its instructions from the text it reads. A poisoned document, email or web page can steer what it does next.

Permissions get used in new ways

An assistant can surface every file its user could technically open. Years of loose sharing that nobody noticed can become searchable overnight.

Permissions get used in new ways

An assistant can surface every file its user could technically open. Years of loose sharing that nobody noticed can become searchable overnight.

Agents act on their own

Once a system can call tools and chain steps, one bad output can become a real transaction with no person in the loop to catch it.

Agents act on their own

Once a system can call tools and chain steps, one bad output can become a real transaction with no person in the loop to catch it.

Engagements

Start with the question you need answered.

AI inventory and exposure review

What AI is in use, including the tools nobody approved, what data each one touches and who owns it. You walk away with an AI register, ranked exposures and quick fixes.

AI inventory and exposure review

What AI is in use, including the tools nobody approved, what data each one touches and who owns it. You walk away with an AI register, ranked exposures and quick fixes.

LLM and agent security review

Architecture review and hands-on testing of a specific application: prompt injection, data leakage, tool permissions, logging and human approval points. Findings reference the OWASP Top 10 for LLM Applications and MITRE ATLAS.

LLM and agent security review

AI governance and ISO/IEC 42001 readiness

Policy, risk assessment, roles and an approval path that lets good projects move quickly, built on your existing ISMS so you don't run a second one.

AI governance and ISO/IEC 42001 readiness

Policy, risk assessment, roles and an approval path that lets good projects move quickly, built on your existing ISMS so you don't run a second one.

Ongoing AI oversight →

Part of a vCISO or compliance retainer: new use cases reviewed as they appear, and the register kept current.

Ongoing AI oversight →

Part of a vCISO or compliance retainer: new use cases reviewed as they appear, and the register kept current.

Frameworks

Mapped to what you already answer to.

We map AI controls to ISO/IEC 42001 and the NIST AI Risk Management Framework, and into the one control model behind your other obligations. That includes the Privacy Act: from 10 December 2026, privacy policies must explain certain automated decisions that use personal information.