Question 1

What if we barely use AI?

Accepted Answer

That's exactly the right time to assess. Policy and governance are cheaper to build before the sprawl. Most clients are surprised by how much shadow AI we uncover even when they 'don't use much.'

Question 2

How disruptive is the process?

Accepted Answer

Minimal. Most discovery is automated or runs in the background. We need 6–10 hours of stakeholder time total over 2 weeks. No production access required for the assessment itself.

Question 3

Do you need access to our LLMs / production systems?

Accepted Answer

Only if you have customer-facing AI you want pen-tested. For governance and inventory work, we operate from identity logs, browser telemetry, and interviews — no production touch.

Question 4

What if we have our own AI engineers?

Accepted Answer

Great. This is governance and risk work, not AI engineering. Your engineers stay focused on shipping; we deliver the policy, audit posture, and risk register your security and compliance teams need.

Question 5

How is this different from a regular pen test?

Accepted Answer

Traditional pen tests don't cover prompt injection, RAG extraction, agent hijacking, or MCP vulnerabilities. We do. We also produce the governance artifacts you need for compliance — pen tests don't.

Question 6

Will this satisfy our SOC 2 / ISO auditor?

Accepted Answer

Yes. The risk register and policy artifacts are written specifically to satisfy AI-related control requirements in SOC 2 (CC-series), ISO 27001 (Annex A), and ISO 42001. We've successfully supported clients through audits.

Question 7

Can you help with EU AI Act classification?

Accepted Answer

Yes. We classify each AI system in your environment against the EU AI Act risk tiers (prohibited / high-risk / limited / minimal) and map your obligations accordingly.

Question 8

What happens after the 14 days?

Accepted Answer

30 days of email support included. We can also engage on a Managed AI Governance retainer (separate service) to execute the roadmap, vet new tools, and report to your board on a monthly cadence.

Question 9

Is the policy template legally reviewed?

Accepted Answer

Our template has been reviewed by tech-employment counsel and is the starting point — we strongly recommend a 1-hour pass with your own employment lawyer before finalizing.

Question 10

Do you sign NDAs?

Accepted Answer

Mutual NDA is signed before any discovery. We can sign yours or use ours.