Working together · Expertise
Govern the AI your people are already using
Staff are using AI tools whether or not there is a policy. We help your board see what is in use, decide what is allowed, and put controls around the data those tools can reach and the actions AI agents can take.
Who it is for
Is this you?
- Firms whose staff use public AI services and that have no clear view of what data is being shared
- Firms rolling out Microsoft 365 Copilot or similar assistants that can read across mail, files and chat
- Firms building or buying AI agents that can act on systems, not just answer questions
- Boards asked by clients or regulators how they govern AI
Available through Foundation Advisory
What you get
What is included
An AI inventory
A register of the AI tools and agents in use or planned, who owns each, what data it can reach and what it can do.
An acceptable use policy
A short, workable policy for public AI services and internal tools that staff can actually follow.
Data readiness for assistants
A check that permissions and labels are in order before an assistant that searches across your data is switched on.
Threat modelling for agents
A structured look at what could go wrong when an AI agent acts on your systems, and which controls limit the damage.
Board reporting on AI risk
Plain-language reporting so the board can approve high-risk uses and see how risk is changing.
How it works
From first conversation to results
Discover
We establish what AI tools and agents are in use, sanctioned or not.
Decide
With your leadership, we agree what is allowed, for which data, and who approves new uses.
Control
Access, data and monitoring controls are put in place, starting with the highest-risk uses.
Review
The inventory and controls are reviewed as tools and regulation change.
What this is not
- We do not build AI products, and we have no commercial ties to AI vendors.
- We are not lawyers. Where AI use raises legal questions, such as contracts or data protection, we will work alongside your legal advisers.
Related thinking
Read more
The AI-Accelerated Evolution of Ransomware
Technical paper on ransomware's move from encryption to exfiltration to AI-assisted extortion, mapped to MITRE ATT&CK.
White paper · AI security and governanceThe Evolution of Extortion: AI as Insider Threat
Whitepaper on the shift from ransomware to agentic AI insider risk, with a governance framework.
Infographic · AI security and governanceWhat can your AI tell the wrong person?
Interactive board summary on AI assistants and over-shared company data.
Questions
Common questions
Should we just ban public AI tools?
Bans tend to push use out of sight. A short policy, an approved alternative and controls on sensitive data usually work better.
Is Microsoft 365 Copilot safe to switch on?
It can only see what a user can already see, which is exactly the problem if permissions have drifted. Fixing over-shared data first is the most important step.
Start with a conversation
Tell us about your organisation, your regulators and what is worrying you. We will say plainly whether we can help, and how.
Book a conversation