Services

Five engagements, in the order most companies need them. Each has a fixed scope and a fixed price, agreed before work starts.

AI opportunity assessment

Finds where AI is worth applying in your business, and where it is not.

What we do

• Interview the people who do the work and watch the systems they use.
• Measure how long the work takes today, how often it is wrong, and what a mistake costs.
• Check that the data exists, can be reached and is usable.
• Flag anything customer-facing, regulated or hard to undo.
• Score each candidate on value, feasibility, risk and ownership. You see the rubric first.

What you get

• A ranked shortlist, with the hours each candidate would save.
• A do-not-automate list, with the reason for each entry.
• Baseline measurements for the top candidates.
• A build brief: scope, data, success measure, error budget, review step.
• A tooling recommendation, including where to buy instead of build.

Your team, or another firm, can run the brief without us. It covers the first project only.

Pilot build

Takes one workflow from brief to production.

What we do

• Build the test set and the scoring method before any code.
• Measure how people perform today on the same test set.
• Start with the simplest design that could work. Add retrieval or fine-tuning only when the tests call for it.
• Design the failure path: who reviews, what happens at low confidence, and what an action that cannot be undone needs first.
• Apply secure AI design to anything that reads outside material or acts on its own.
• Release to real users, with monitoring and a cost view.

What you get

• A running system in your infrastructure and your repositories.
• The evaluation suite, with the baseline and final scores.
• Monitoring and cost reports.
• A runbook and a threat model.
• A recommendation on what to do next, including stopping.

One workflow per engagement. If the system does not beat the baseline, we report it and stop. You keep everything.

Secure AI design

Designs AI systems that hold company data, read material you do not control, or take actions on their own. It works best before the architecture is settled, and also on a running system.

Most failures in these systems are design decisions, not bugs. Decisions are cheapest to change while they are being made.

What we review

• Data flows: where company and customer data goes, including prompts, logs, caches, indexes and vendors.
• Trust boundaries: what the system may treat as an instruction, and what only as information.
• Tool permissions: what each tool may do, and which actions need a person to confirm.
• Access control in retrieval: whether an index keeps the permissions of its source.
• Output handling: model output treated as untrusted.
• Review and audit: thresholds, escalation, logs and how long they are kept.
• Vendors: service tiers, retention, processing agreements, and where models and packages come from.
• Cost limits: rate limits, spend caps and behaviour under load.

We check coverage against the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications.

What you get

• A threat model your engineers can maintain.
• The design decisions, written down with their reasons.
• For a running system: a ranked list of gaps, each with a fix.
• A working session with the engineers who will maintain it.

What this is not

We do not do offensive work. No penetration testing, no red teaming, no adversarial engagements. We will recommend firms that do.

We are not auditors. We cannot certify SOC 2, ISO 27001 or ISO 42001.

Customer security diligence

Answers the AI section of a customer's security questionnaire, with evidence for each answer.

• We write the answers and keep them current for the next deal.
• Where an honest answer is weak, we say what would fix it.
• We join the call with your customer's security team.
• Where the gap is governance, we map you against the NIST AI Risk Management Framework, ISO 42001 and the EU AI Act.

We prepare. We do not attest.

Fractional AI lead

Ongoing technical direction for teams with several AI projects and no AI lead yet. Monthly, with a standing weekly slot.

• Architecture and build-or-buy decisions.
• Vendor and model choice.
• Review of AI work before release.
• Evaluations, monitoring, spend and security.
• Hiring the person who takes over: the role, the interview and the onboarding.

We advise and review. Your team builds. There is no on-call. We do not sell this as a first engagement.