AI security and governance · Dallas–Fort Worth, Texas
AI Security & AI Governance
AI is already in the business: in the tools staff bought, in the features your vendors switched on, and in the pilots nobody risk-reviewed. The inventory, the policy, and the review trail usually are not. We build them before a customer, a regulator, or an incident forces the conversation.
What AI governance actually involves
AI security is not a prompt filter and AI governance is not a policy PDF. It is an inventory, a tier, a rule, a review, and evidence. Six workstreams, built in that order.
AI use-case inventory
Every AI tool and use case in the business, including the ones bought on a credit card: who uses it, what data goes in, and what output comes out.
Risk tiering
Each use case scored on data sensitivity, customer impact, autonomy, and reversibility. A tier tells you which uses need review, which need approval, and which need to stop.
Acceptable-use policy
One policy staff can follow: approved tools, banned data, permitted use, review steps, and how to report a mistake. Written for the warehouse, the clinic, and the finance team.
LLM and AI vendor review
Data handling, training use, retention, subprocessors, model changes, and security commitments. Reviewed before the pilot expands, not after.
Approval and review process
A lightweight intake and approval path so the business can adopt AI without waiting six months, and without a new tool appearing in production unmanaged.
Board evidence
A one-page register the board can read: use cases by tier, open risks, decisions taken, and the evidence behind them.
Where AI risk shows up in a mid-market company
These are the three patterns we see most often. None of them requires a sophisticated attacker; they arrive with normal business use.
Data leaving through prompts
A team pastes a customer list, a contract, or a patient record into a public model. The data leaves your control and the vendor's terms decide what happens next.
AI features you already bought
Your CRM, WMS, HR platform, and email provider add AI features and switch them on. Nobody on your side reads the data-use terms or records the change.
Content and code with no review
AI-generated scripts, emails, and code enter production without an owner. The risk is not that AI is wrong; it is that nobody is accountable for the output.
NIST AI RMF alignment
We use the NIST AI Risk Management Framework as the spine because customers, insurers, and regulators increasingly recognise it. The four functions give the program a structure your team can keep using after the engagement.
- Govern: policy, roles, and the review process.
- Map: the inventory and the risk tiers.
- Measure: tests, evidence, and the metrics you report.
- Manage: owners, dates, and the decision to stop or continue.
EU AI Act readiness
You may not sell into the EU directly, but your customers do. When a customer sends an AI questionnaire or a contract adds AI terms, you need to know what you can show. We help you work out what is in scope, what evidence exists, and what to build next.
We are not your law firm
We prepare readiness and evidence. We do not give legal advice or decide which obligations legally apply to you. Your counsel makes that call, and we make sure the evidence supports it.
What you get
The program is written to be read by people who are accountable for it: owners, directors, customers, and insurers.
AI risk register
Use cases, tiers, owners, and status in one table. Updated as new tools arrive, not rewritten from scratch each quarter.
Approved-tool list
What staff may use, for what data, and where the answers live. The list is short enough to remember and specific enough to enforce.
Board one-pager
The top AI risks, the decisions required, and the evidence behind each statement, in language a director can act on.
The paid Security & AI Risk Diagnostic
AI governance starts inside the diagnostic: we inventory use cases, tier them, and give you the first policy draft and a board-ready readout. 15 business days.
If the program needs ongoing ownership, it converts to the Fractional CISO retainer: $9,500 a month, two days a week, 90-day term. Never a free audit.
AI governance questions
What does AI governance actually involve?
An inventory of the AI tools and use cases in the business, a risk tier for each one, an acceptable-use policy, review of the vendors and models involved, and evidence the board or a customer can read. It is a management system, not a policy document filed once.
Can we just ban AI tools?
Bans tend to move use underground. Staff keep using the tools and stop telling you. We help you replace a ban with an approved-tool list, clear data rules, and a review path that takes days instead of months.
Is this legal advice on the EU AI Act?
No. We build readiness and evidence: what is in scope, what the obligations touch, and what you can show a customer or regulator. Your counsel decides the legal obligations that apply to you.
How do you review an LLM or AI vendor?
We read the data-processing terms, whether your data trains the model, retention and deletion, subprocessors, model change notices, security commitments, and exit. Then we write the decision down so the next reviewer does not start from zero.
Find out what AI is actually running.
The diagnostic inventories the AI tools in use, tiers the risk, and puts the first policy on the table. Tell us where AI is showing up in the business.