Services

Your team learns to use AI agents on tasks from your own backlog, with good habits from day one.

Half or full day.

• I set up the AI tools your team already uses, or help you choose them, with safe settings for everyone.
• We take one real task from start to finish together.
• Your people learn how to check the agent's work before it goes anywhere.
• They also learn what to do when an agent does something unexpected: how to stop it and who to tell.
• You keep the setup, a one-page set of team rules and a plan for the next few weeks.
• Two weeks later, we meet for an hour to review what's working and what isn't.

Pick the task that takes the most hours. Together with your team, I build an agent to handle it and put it into daily use.

3 to 4 weeks. One workflow.

• We choose it together on the first call. Support emails, incoming documents and weekly reports are common picks.
• It's built on the tools, cloud and data you already have, not as a demo.
• We agree up front what data it may see and what must never leave your systems.
• The agent gets access only to what it needs, a person signs off on anything important, and everything it does is recorded.
• It has an off switch and a way to roll back its changes.
• Before it goes live, we test it on real cases from your own work. Your team learns to run those tests again whenever the AI model behind it changes.
• We measure the time it saves against how the work was done before.
• Your team gets a short guide and a handover, so they can run it and change it on their own.

Your developers use AI coding agents every day, from the ticket to production, with rules your security team can live with.

3 to 6 weeks.

• I work with the coding assistants and agents your developers already use, or help you choose them, and set them up with safe settings, limited permissions and no access to production secrets.
• We agree which parts of the work agents may take on, like writing tests, reviewing code, upgrades and documentation, and where a person stays in charge.
• Code an agent writes goes through the same reviews, tests and checks as everyone else's, and your pipeline shows what an agent changed.
• I check the plugins, connectors and extensions your developers install, since that's where coding agents get attacked.
• We measure the effect on delivery, like time from ticket to merge, review load and bugs that reach production, against how things ran before.
• Your tech leads keep a short playbook and the rules, so they can run it without me.

A clear picture of how your team uses AI today, what could go wrong, and what to do next.

2 weeks.

• I map the AI tools your team uses, including the ones nobody approved, and what each one can access. You keep the list and can update it yourself.
• I talk to your people and look at how the work gets done day to day, not only what the policy says.
• I read the terms of the AI vendors you rely on: where your data goes, whether it's used to train their models, and who else can see it.
• We rank the risks together and decide which ones to fix, which to accept and which to avoid.
• If an AI tool makes decisions about people, such as customers, patients or job applicants, I flag what privacy law expects of you.
• You leave with a short AI use policy, clear rules for approved tools and data, a 90-day plan and a one-page summary. I walk your leadership through all of it.

The findings are mapped to ISO/IEC 42001 and the NIST AI RMF, and to the EU AI Act if it applies to you.

I test your AI agents the way an attacker would, then help you close the gaps. It doesn't matter how they're built: off-the-shelf tools, pipelines your team wrote, AI services on your cloud platform, or the coding agents your developers use.

2 to 4 weeks, depending on how many agents you have.

• Can someone trick your agent with instructions hidden in an email, a document or a web page?
• Can it reach data or systems it shouldn't?
• Can a plugin or connector you installed be turned against you?
• If something goes wrong, would you notice, and could you tell what it did?

Before any testing starts, we agree in writing on what's in scope, which environment I test in and what data I can see.

You get a ranked list of problems, each with a clear fix, written so both your engineers and your leadership can act on it. Once the fixes are in, I test again at no extra cost.

I can also run a half-day exercise where your team works through an agent incident, from the first alert to the cleanup. You keep the playbook.

Agents change as models and tools update. If you'd like, I can come back every quarter to test again and look at anything new you've added.

For audits, findings are mapped to the OWASP Top 10 for Agentic Applications, MITRE ATLAS, the SOC 2 Trust Services Criteria, ISO/IEC 27001:2022 Annex A, ISO/IEC 42001 and the NIST AI RMF.

When you're ready to go beyond one workflow, I join your leadership team part time and help guide the AI rollout.

10 to 20 hours a week. 3 months to start, then month to month.

• We agree on a plan and the numbers that matter, and I report on them every month.
• I'm hands-on: I build, review your team's work and join your meetings.
• I help set up how AI is governed: who approves new tools, how risks are tracked, and what happens when something goes wrong.
• I review new AI vendors before you sign with them, and I retest your agents every quarter as they change.
• I help answer your customers' security questions and sit in on audits.
• I help hire and train the people who take it over from me.

In the first 3 months, we set up the tools and rules, get the first workflow running, and then bring in the rest of the team.

Already have a CTO? I work alongside them as your go-to person for AI and agent security.