Your people started using AI. That changed what you are exposed to, what your insurer will ask, and what your customers will demand in their next contract. Almost nobody sells you one answer to both. We do, and only that.
Prices published on every page. No discovery call required to find out what something costs.
of small and midsize businesses have no AI-specific security policies, while 83% believe AI has increased their threat exposure.
Pax8 SMB research, reported by ChannelE2E, June 2026.
of midmarket executives use a formal AI governance framework. Meanwhile 96% say they are confident in their security posture, and about one in four had a ransomware attack or demand in the past year.
RSM Middle Market Business Index, 501 executives surveyed, January 2026.
prioritise digital identity management — the way most ransomware actually gets in, and the exact control AI adoption puts under new pressure.
Read those three together and you have the whole problem. Confidence is high, governance is thin, and AI is quietly multiplying an exposure most companies were already not measuring. The firms selling you AI advice and the firms selling you security advice are, almost without exception, different firms.
Every engagement produces both halves. A list of what to protect, and a list of where AI actually earns its keep in your business. One without the other is how companies end up either frozen or reckless.
Three weeks. One read on both halves: where AI is already running in your company and what it exposed, and which use cases are worth the effort. Ends in ranked decisions with costs.
From $9,500, fixed.
Half and full day, built on your business. Your team leaves with a written position, not a deck. Includes the session that ends with your AI ground rules drafted in the room.
From $6,500 per session.
For the questions that arrive mid-quarter. A vendor proposal, an insurance questionnaire, a customer security review, a policy your team drafted at 11pm.
From $2,750 a month. 90-day cycles, cancel any cycle.
You have an IT lead who is already busy, a finance leader asking what the spend is buying, and an owner or CEO who wants a straight answer. What you do not have is somebody senior whose entire job is to think about where this is going.
We work with commercial companies. Larger organizations occasionally engage us, almost always by referral and usually for a single assessment or a board session. We do not market upward. The enterprise end of this market is crowded, undifferentiated, and not where we are useful.
The Texas Responsible Artificial Intelligence Governance Act took effect 1 January 2026 and reaches any business offering products or services to Texas residents. It also contains something unusual: a statutory safe harbor for organizations that document alignment to the NIST AI Risk Management Framework.
That is a rare thing in compliance — a law that tells you in advance exactly what evidence protects you. Producing that documentation is a defined, finishable piece of work, and it is part of every assessment we run for a Texas company.
Statute analysis: Norton Rose Fulbright on the Texas Responsible AI Governance Act.
No reseller agreements, no partner tiers, no referral fees. When we name a product it earns us nothing. It is the only way our advice and your interest point the same direction.
No credentials, no agents, no scanning. We work from documents, structured questions and conversations. Nothing we do can take something down, which is also why we can start next week instead of after a security review.
Almost nobody in this market does. You should not have to sit through a discovery call to learn what a three-week assessment costs.
Advisory runs in 90-day cycles and you can end any cycle. Multi-year contracts are common in this category. We think they are a confession.
There is a monthly briefing, a set of self-scored tools that need no email address, and research we publish for this size of company because nobody else does. Use all of it without ever talking to us.