AI security & assurance

Use AI without losing track of your data, your obligations or your accountability.

Most businesses start with the AI Security Assessment, which covers how your people use AI. If you build AI features, AI application security testing attacks them directly. Organizations that need an ISO/IEC 42001 management system or regulatory readiness move on to the governance work.

Assess

Find out where you stand

Fixed-scope reviews that show what is exposed, what matters and what to fix first.

  • AI Security Assessment

    A review of how your people use AI tools, what data goes into them and which controls and policies you need.

    AI use · Data exposure · Copilot

Advise

Keep senior help on hand

Security leadership, architecture and governance that continue after the assessment.

  • AI Governance & Assurance

    An ISO/IEC 42001 AI management system and NIST AI RMF controls, with the evidence an auditor, customer or board will ask for.

    ISO 42001 · NIST AI RMF · Assurance

  • AI Risk & Compliance Advisory

    AI risk and impact assessments, responsible-AI programs and readiness for the EU AI Act and Canadian guidance.

    EU AI Act · AI Risk · Responsible AI

Specialist

Specialist capabilities

Offensive testing of applications and AI, industrial systems, and secure data destruction.

  • AI Application Security Testing

    Security testing of LLM applications, chatbots, RAG systems and AI agents, mapped to the OWASP Top 10 for LLM Applications.

    OWASP LLM Top 10 · RAG · AI agents

Standards we work to

We turn the AI standards that apply to you into a program that fits how you actually use AI.

ISO/IEC 42001
The management-system standard for trustworthy AI, the AI equivalent of ISO 27001.
NIST AI RMF
A risk framework organized around Govern, Map, Measure, and Manage.
EU AI Act
Risk-tiered obligations for AI systems, phasing in over several years.

AI security, answered

We only use vendor AI (Copilot, ChatGPT, embedded features). Do we still need governance?
Yes. Third-party and embedded AI still processes your data and makes decisions on your behalf. Governance means knowing where AI is used, what data it touches, and who is accountable, regardless of who built the model.
How is ISO/IEC 42001 different from ISO 27001?
ISO 27001 governs information security. ISO/IEC 42001 governs AI management specifically, addressing AI-unique concerns like model lifecycle, data provenance, bias, transparency, and human oversight. They are designed to integrate, so we map new AI controls onto your existing program.
Does the EU AI Act apply to a Canadian company?
It can. Like the GDPR, the EU AI Act has extraterritorial reach. If your AI systems or their outputs are used in the EU, obligations may apply. We help you determine exposure and classify your systems by risk.
Where do we start if AI is already in production?
With an inventory and risk assessment. We identify the AI in use (including shadow AI), tier it by risk and impact, and give you a prioritized roadmap so the highest-risk systems get governed first.

Start with how your people use AI today

A free 45-minute call. We will tell you whether you need an assessment, a policy, or a full management system.

Assess Our AI Use