Our approach to AI adoption and security

Positions we hold. They shape every engagement.

Selection is harder than engineering

Every company can call the same models. The return depends on which project you build, and that choice is usually made in a meeting. That is why the assessment comes first.

Measure the work before you automate it

Most AI projects fail because nobody measured the manual work first. Without a baseline, nobody can show the new system is better, and projects that work get cancelled anyway.

The first project should be internal

Customer-facing AI leaves no room for error. Start where a person still checks the output: drafting, sorting, extracting and summarising internal material.

Accuracy is a budget, not a target

Every system is wrong sometimes. What matters is what a wrong answer costs and who catches it. A classifier at 92% with a cheap review step is worth more than one at 97% that fails silently.

Security is a design question

When a system reads material you do not control and then acts on it, whoever wrote that material can steer it. The fix is in the architecture: least privilege on every tool, no trust in retrieved content, and a person before any action that cannot be undone.

Penetration testing shows what is reachable today. It is a separate discipline, and not ours. We work on the design that decides what is reachable at all.

Limit what an agent can reach

A system that only writes text fails in limited ways. A system that chains actions does not. Guardrails help a little. Tight permissions, and a person on every action that cannot be undone, limit the damage.

Model training is not your data risk

On business terms, the major providers do not train on your data. The real risks are logs nobody classified, retrieval indexes that drop permissions, staff on personal accounts, and an old subprocessor list.

Retrieval is over-prescribed

Many requests for retrieval turn out to be a search problem, a data quality problem, or a few documents that fit in the context window. Retrieval adds its own failures. Use it when the tests show you need it.

Buy the model, build the workflow

Models are a commodity and change every few months. The value is in the workflow around the model: where the input comes from, who checks the output, and what happens when it fails.

In a mid-sized company, AI does not cut headcount

It clears work that was always put off. Selling AI as a way to cut staff fails, because people do not help automate their own jobs. We tell buyers this early.