Use AI without opening new doors.
AI brings new ways for data to leak and systems to be misused. I help you find those risks, design against them and keep them under control, so you can use AI with confidence.
The short version, in a few minutes.
A plain-English walkthrough of this page. Prefer reading? Everything in the video is covered below.
You might be here because…
- Staff are pasting customer data into free AI tools.
- We're giving an AI assistant access to our systems. What could go wrong?
- Our supplier says their AI is secure, but we have no way to check.
- Nobody can tell me where our data goes once it's in the model.
What's really going on.
AI systems don't behave like ordinary software. They follow instructions written in plain language, and they can't reliably tell your instructions apart from text hidden in an email, web page or document. That's prompt injection, and it becomes serious once an assistant can read your data or take actions through tools and MCP servers.
Add data leaking through prompts and outputs, unapproved tools and suppliers you can't see into. A standard security review can miss all of this.
Sound like you?
- You're building or buying an AI assistant, chatbot or agent.
- You're connecting AI to internal systems or data, for example through MCP servers.
- Staff are already using AI tools without clear rules.
- A customer, auditor or board member is asking how you manage AI risk.
- You need to show how your AI use fits with GDPR.
Step by step.
- Step 01Map AI use
I find where AI is used across your organisation, approved or not, and what data and systems each use can reach.
- Step 02Model threats
I threat-model each AI system for prompt injection, data leakage, excessive permissions and supplier risk.
- Step 03Design controls
Least-privilege access for AI tools, human approval for risky actions, checks on inputs and outputs, and logs you can audit.
- Step 04Test it
I test AI systems the way an attacker would, including attempts to make them leak data or misuse their tools.
- Step 05Set the rules
A clear AI policy and training, so staff know which tools to use, with which data, and how.
The outcome.
- A clear picture of where AI is used and what it can reach.
- AI tools that can only access what they need.
- Fewer ways for sensitive data to leak.
- Risky actions that need a person's approval.
- An AI policy staff actually follow.
However you need me
Advisory, a fixed-scope project, a support retainer, or embedded in your team. Day rate, fixed price or monthly.
See engagement models →Is AI security different from normal cyber security?
It builds on the same discipline, but adds new risks. Prompt injection and data leakage through AI tools need specific defences that a standard review may not cover.
Can prompt injection be fully prevented?
Not today. No current technique stops it completely. That's why the strongest defence is limiting what an AI system can access and do, and requiring a person's approval for anything risky.
Should we ban staff from using AI tools?
Bans rarely work: people use the tools anyway, just out of sight. A clear policy, approved tools and practical training are usually safer.
Can you work with our AI supplier?
Yes. I can review what the supplier provides, ask the right questions about data handling and model risk, and design the controls on your side.
Often goes with…
Cyber security
Find out where you're exposed, fix what matters first, and be ready when something goes wrong. Hands-on security work, from reviews and hardening to live incidents and compliance.
Read more →Cloud & infrastructure
On-prem, cloud or hybrid: I design and build platforms that stay up, grow when you need them to, and cost what they should. Then I make sure your team can run them.
Read more →Integration & abstraction layers
You run ERPs, CRMs, EPOS and more that were never designed to talk to each other. I design the layer that connects them, so data flows, people stop re-keying it, and changing one system doesn't break the rest.
Read more →Is your AI use secure?
Tell me where you're using AI, or planning to, and what it can reach. I'll show you where the risks are.