Starter Services · Cyber Risk Sprint

Your security review was written before the AI arrived.

The programme you have is probably sound. It was just never asked about model behaviour, prompt leakage, vendor models or agents holding credentials. The sprint inventories the AI you are actually running, scores it against NIST AI RMF and ISO/IEC 27001, ranks every exposure by consequence, and hands your programme the closure path for each — in two to four weeks.

Scope the sprint See exactly what fits in 2–4 weeks

2 to 4 weeksInventory firstFixed scope · fixed feeNIST AI RMF · ISO/IEC 27001

Typical sprint scope

Fixed in the proposal. The constraint is what makes two to four weeks real.

1inventory of the AI in use and in flight — built if you have none
≤8AI systems and their data flows assessed in depth
6exposure classes tested on each
2frameworks mapped — NIST AI RMF and ISO/IEC 27001, plus your sector regime
1exposure register, ranked by consequence, with an owner per line
1readout, written for the board or the audit committee
+findings handed to your existing programme to own

Not includedPenetration testing · red-teaming · remediation engineering · SOC tooling · ongoing monitoring. The readout says which of those are warranted and what they should target.

What does your AI estate look like?

Four ways AI outruns the review process. The sprint finds which is yours.

The engagement is the same shape wherever you start. What changes is what the inventory turns up — and therefore which exposures sit at the top of the register.

Copilots everywhere, no inventory

Teams adopted AI faster than anyone could review it. Nobody can say how many systems are running, or on what data.

The situationLicensed copilots, a few things built in-house, and tools bought on a card. Each one made sense locally. Nobody is holding the list.

What we do differentlyThe inventory is the first deliverable, not an assumption. We build it from licences, logs and the people who use the tools — then rank what it turns up.

What you leave withA register of what is running, which systems arrived without review, and the handful that matter ranked by consequence.

Your estate looks different? Describe what AI is running, who reviewed it and who you answer to. We will tell you what the inventory would likely turn up before you commit to anything.

Assess against what

Six exposure classes on every system. One consequence rating. One control it maps to.

A list of findings is easy to produce and hard to act on. The judgment you are paying for is the ranking — which of forty findings are the three that could cost you the quarter — and the six classes are how that ranking is made, system by system, before anything is written for the board.

Six exposure classes. Then one rating.

01Model behaviour

Can it be made to say, do or decide something it should not?

02Prompt and data leakage

What goes into it, where is that kept, and who can read it back?

03Adversarial input

What can a user, a document or another system make it do?

04Third-party model dependency

Whose model, under what terms, and what changes when it does?

05Data protection

Is the data it touches classified, minimised and protected in flight and at rest?

06Access and identity

What can it reach, with whose credentials, and does anyone revoke them?

Could cost the quarter → SevereWould hurt, bounded → MaterialKnown, controlled → Contained

Inventory

The AI systems and data flows in scope — including the ones that arrived without a review — built from licences, logs and the people who use them, not from the org chart.

You leave withThe inventory: every system, its data, its owner, its review status

Assess

Each system through the six classes, against NIST AI RMF and ISO/IEC 27001, with the AI-specific exposure your current controls were never designed to look for.

You leave withA scored posture, control by control

Rank and plan

Every exposure rated by consequence rather than by category, with the closure path for each: what can be done this week, what is a project, and who owns it.

You leave withThe exposure register, ranked, with an owner per line

Readout

Presented live at the level the audience needs — the engineering detail for your team, and a version written for the board or the audit committee.

You leave withThe readout, in the audience's language, and the findings handed to your programme

Under the hoodWhat one line of the register is made of — and the standard every line is held to before the readout

# register/EXP-004.yaml — illustrative
system:        support-assistant            # inventory ref AI-07
class:         03 adversarial input
exposure:      retrieval not scoped to caller; any account readable on request
consequence:   severe   # customer data · regulated · external user
evidence:      traced 2026-xx · transcript + log excerpt attached
maps_to:       NIST AI RMF MANAGE 2.2 · ISO/IEC 27001 A.8.3, A.5.15
close:
  now:         scope retrieval to authenticated caller   days
  then:        log and alert on cross-account attempts   weeks
  test:        prompt-injection case in release checks   # your team runs it
owner:         head of platform engineering
status:        open → handed to security programme

Ranked by consequence. Severity follows what it would cost you, never the category it came from.
Mapped. Every finding lands on a NIST AI RMF function and an ISO/IEC 27001 control your auditors already use.
Evidenced. Each exposure carries the trace that showed it — not an opinion, a log line.
Owned. One name per line, agreed in the room, before the readout.
Separated. What closes this week is kept apart from what is a project, so the quick wins are not held hostage.

The register, as handed over

Five exposures, in the order they would hurt.

A page from the document your team gets, illustrative. The order is the point: a board does not need forty findings, it needs the three that matter and what closing them takes.

AI security posture — exposure registerIllustrative example

Exposure	Rating	Close it by
Prompt injection · customer assistantAI-07 · class 03 · adversarial input	Severe	Scope retrieval to the caller; log cross-account attempts; add the test to release checks. Days.
Vendor model · no contract termsAI-02 · class 04 · third-party dependency	Severe	Data-use and model-change terms; egress record; fallback model. Procurement owns, security beside.
PII in prompts, kept in logsAI-07, AI-11 · class 05 · data protection	Material	Redact at ingestion; set retention; restrict log access to a named role. Weeks.
Agent with standing credentialsAI-14 · class 06 · access and identity	Material	Short-lived, scoped tokens; a revocation path; an owner who reviews quarterly.
Copilot rollout · unreviewedAI-01 · class 02 · prompt and data leakage	Contained	Tenant settings already prevent training on your data. Document it; add to the inventory. Done.

The posture, as handed over

2 severe · 2 material · 1 contained

Inventory: 14 systems found; 6 had no review; 8 assessed in depth
Frameworks: NIST AI RMF and ISO/IEC 27001, every finding mapped
This week: Two closures that need no budget — scoped retrieval, log access
Readout: Engineering version to your team; a four-page version to the audit committee

Still open: whether the second vendor model is replaced or re-papered. Recorded, with the owner's view and the date it is decided by.

Illustrative. Systems, exposures and ratings are examples; no client data. Your register describes your estate, mapped to the frameworks you are held to.

Who rates the consequence

Severity is a judgment about your business, not a scanner output.

A tool can list findings. Deciding that the unscoped retrieval could cost the quarter and the unreviewed copilot could not — and saying plainly where your existing programme already has it covered — is the part that needs a person.

The engagement is led by a senior security practitioner who has run programmes as well as assessed them, is named in the proposal, and presents the readout. The rest of the team is sized to the estate.

InventoryEvery AI system in scope, its data, its owner, its review status

AssessSix classes on each, mapped to NIST AI RMF and ISO/IEC 27001

Rank and planBy consequence, with a closure path and an owner per line

ReadoutLive, for your team and for the audit committee, in their language

Fit

Right-sized when AI is already running and the review has not caught up.

If you recognise yourself in the first list, the sprint is the right size. If the second reads truer, we will point you at the engagement that answers your actual next question.

This is a good fit when

AI is in use — copilots, assistants, vendor features, a pilot or two — and nobody can say with confidence what it can reach.
You have a security programme and want AI's exposure handed to it in its own terms, not a parallel one.
An examination, an audit or a board question about AI is coming and the answer has to be in NIST AI RMF or ISO/IEC 27001 language.
You can give read access to configuration and logs, and time with the people who own each system.
You want a ranking, not a list.

Start somewhere else when

You are not sure security is the weak dimension — that is the Assessment Sprint, which screens it alongside five others.
You want a specific assistant attacked — that is red-teaming in the security practice, and the readout will say whether it is warranted.
You need the controls built, not found — that is remediation engineering, which the register is written to scope.
Nobody will own the register afterwards; a ranked list with no owner is a document.

Deliberately outside the windowPenetration testing · red-teaming an assistant · remediation engineering · SOC or SIEM tooling · DLP implementation · incident response · ongoing monitoring · an AI governance policy. Those are the practices, and the sprint is built to lead into them with the exposures already ranked — which is why this is two to four weeks and not two quarters.

Where it sits

Three questions. Three paths.

The sprint is where a known exposure gets ranked and handed over. Before it is finding out whether security is the dimension to worry about; after it is whatever the register says to close first.

Want a free read first?

AI & Data Cyber Risk Screen

The self-service version of the same question, in a few minutes. Bring us the result.

AI running, review behind?

Cyber Risk Sprint

Inventory, assess, rank by consequence, hand over. Two to four weeks, fixed scope.

Register in hand, controls to build?

AI Security & Cyber Risk

Red-teaming, remediation, data protection and security governance — scoped from the register.

Not sure security is the weak dimension? The Assessment Sprint screens it alongside five others, against your own systems.

Before you ask

The buying questions that matter.

The six things a CISO or a CIO asks before an AI security assessment is approved, answered the way we answer them in the proposal.

We have a security programme already. Why this?

Because AI introduces exposure that a programme written before AI arrived does not look for: model behaviour, prompt and data leakage, adversarial input, third-party model dependencies, agents holding credentials. The sprint covers that surface specifically, maps every finding to a control your programme already recognises, and hands the findings to your programme to own. It is built to strengthen the programme you have, not to replace it.

Is this a penetration test?

No. It is a posture assessment against recognised frameworks, focused on AI and data. Where a technical test is warranted — a red-team exercise against a specific assistant, say — the readout says so, says what it should target, and that becomes a scoped piece of work in the security practice rather than something hidden inside this one.

Do you need production access?

Read access to configuration, logs and the data flows in scope, and time with the people who own each system. We do not need to run anything against production, and nothing in scope is changed by us. The specifics are written into the proposal before you commit.

Which frameworks?

The NIST AI Risk Management Framework and ISO/IEC 27001 as the structure, so every finding lands on a control your auditors already recognise. Where you are held to a sector regime — financial services supervisory guidance, for instance — the register carries that mapping too. We use the frameworks you are measured against, not a proprietary one you would have to translate.

What does it cost?

The fee is fixed in writing before work starts and depends on the number of AI systems and data flows in scope and on whether an inventory already exists. Work inside that boundary is not billed hourly.

What do you need from us before kickoff?

Whatever inventory of AI systems exists, even an informal one; read access to the configuration and logs of the systems in scope; the people who own them; and the frameworks and regulators you are held to. The specifics are written into the proposal before you commit.

Start from what is running

Tell us what AI is in use, and who reviewed it.

Not a framework name. Describe what is running — bought, built and piloted — who looked at it, what data it touches and who you answer to. We will tell you what the inventory would likely turn up, and the window and fixed fee, before you commit to anything.

What is runningCopilots, assistants, vendor features, pilots

Who reviewed itEven if the answer is nobody

What it touchesCustomer data, regulated data, credentials

Who you answer toBoard, audit committee, examiner

Scope the sprint See all starter services

Want a read first? Take the free AI & Data Cyber Risk Screen and bring us the result.

Rank the exposure. Then close it. Tell us what AI is running.

Rank the exposure AI introduced

Scope the sprint