This is the right starting point when you know AI is now a meaningful part of your product and you want a clear-eyed read on where the real exposure is — before you commit to a longer piece of work, and before an incident makes the decision for you. We walk the AI surface end to end: the agents and their tools, where models sit on the data path, identity and authorisation boundaries, the eval and monitoring story, and the third-party dependencies you have taken on without quite meaning to. We surface the worst three risks and tell you, concretely, what to fix and in what order.

Use this when there is a particular thing to look at: a feature about to go live, a new agent or tool-use design, an integration that handles data or money, or an existing system that has grown past the point where anyone is confident it is right. We read the design and the code, not a summary of them. We work out whether the agents have the right tools, the right identity boundaries, and the right failure modes — and we hand back specific, named changes rather than a list of themes. Tightly scoped by design, so you get a senior opinion without standing up a programme of work.

This is the shape most teams need once AI is a permanent part of the roadmap rather than a single feature. We start with a Discovery in month one to establish the landscape, then move into ongoing advisory and execution support: sitting in design reviews, threat-modelling new surfaces as they appear, helping design eval harnesses, and preparing you for the audit or regulator conversations that follow. The engagement is principal-led throughout — the person in your reviews is the person doing the work. It is mutually extendable when it is working and easy to close out when the need has passed.