The AI Security Readiness Assessment.

What does the assessment cover?

• AI usage inventory — sanctioned tools, shadow AI, agent deployments, and the autonomy level of each: who approved what, and what can it touch?
• Vendor & model exposure — which third-party models and AI vendors can reach your data, under what terms, with what audit rights.
• Governance-to-controls gap — what your AI policy promises versus what your environment enforces.
• Agentic risk review — credentials, permissions, and blast radius of any AI agent operating in your environment.
• Incident readiness — would you detect, contain, and disclose an AI-driven incident?

What do you receive?

1. An executive readout deck, built for board consumption.
2. Risk-ranked findings with a ninety-day control roadmap.
3. A one-page AI risk posture summary your board can reuse.

Who is it for?

Mid-market and enterprise companies deploying AI in products or operations — especially in regulated or trust-sensitive industries: healthcare, financial services, media, and B2B software.

Questions we hear before scoping

How long does it take? Two to three weeks from kickoff to board readout, depending on organization size.

How much does it cost? Engagements start at $15,000 fixed-scope. Regulated industries or multi-business-unit reviews are quoted after a scoping call.

Is this a penetration test? No. This is a governance-and-controls review. If testing is warranted, we scope it separately with specialist partners.

Do we need this if we already have a CISO? Often yes — as an independent second opinion on AI-specific exposure, or as senior bandwidth your security team doesn't have right now.