AI security and governance services
Start with the question you need answered: the risks in one workflow, your team's AI-use rules, a supplier decision or a wider delivery decision. The scope and fee are agreed before work begins.
Start here — choose
Choose the question you need answered
- One known AI workflow needs a security reviewDefenders' Window Assessment · £495 +VAT
- One team needs to map AI use across up to three workflowsAI Usage & Governance Discovery Sprint · £2,500 +VAT
- Your team needs practical AI-use rulesAI Governance Starter Pack · £495–£750 +VAT
- You are assessing an AI supplierAI Vendor Due-Diligence Review · £750–£995 +VAT
- A sponsor needs a pilot, change, pause or stop decisionWorkflow Decision Sprint · £2,950 / £3,500 +VAT
Specialist law-firm reviews, workshops, delivery support and ongoing reviews are also available — each service can be discussed on its own. Sprint fee: £2,950 + VAT for a warm introduction; £3,500 + VAT for a new or regulated buyer, confirmed in writing before booking.
Item S.1 — the lead engagement
Workflow Decision Sprint
For a sponsor needing a decision about one important workflow: should we pilot, change, pause or stop? Not another strategy document — a defensible decision.
| Element | Term |
|---|---|
| Fee | £2,950 +VAT (warm introduction: an existing relationship, partner or referral introduces the work) · £3,500 +VAT (new buyer, or any regulated buyer — financial-services, legal-practice or public-sector — including where a warm introduction leads to a regulated business) |
| Payment | 50% reserves the window · 50% on the accepted pack · 14-day invoice terms |
| Elapsed time | Ten working days from accepted scope and inputs |
| Consultant-days | Four to five, capped. More than one workflow is a second Sprint. |
| You provide | One sponsor, one process owner, two working sessions, existing process material, non-sensitive examples |
| You receive | Workflow map · risk & data note · three ranked options · recommended decision · acceptance criteria · 30-day pilot brief (if justified) · decision meeting |
| Excluded | Production builds, connectors, licences, model training, live-data migration, accredited audits, additional workflows |
| Valid outcomes | Pilot · change · pause · stop — all four are successes |
Item S.2 — assessments & diagnostics
The fixed catalogue.
| Item | Description | Fee |
|---|---|---|
| Defenders' Window Assessment | For a business with one identified AI-enabled workflow to review. Question: what security and governance risks need attention in this workflow? You receive human-reviewed findings and an evidence pack for one agreed workflow, with informational NIST AI RMF / ISO 42001 mapping. See an illustrative sample report (fictional scenario, synthetic data — demonstrates format and method, not a customer case study). Not included: mapping is not certification; implementation, penetration testing and follow-up are separate engagements. 72 hours from accepted inputs. | £495 +VAT72 hours · 100% upfront |
| AI Usage & Governance Discovery Sprint | For one team using or considering AI across up to three workflows. Question: where does AI touch the team's work, and what should be prioritised? Three consultant days: where AI is used or wanted, what is permitted, what must stay out of tools, and where people must check outputs. Seven outputs incl. usage map, approved/blocked matrix, data boundaries, human-validation map, ranked workflows, success metrics, 30-min readout. | £2,500 +VAT3 days · 50% to book |
| AI Vendor Due-Diligence Review | For a business considering an AI supplier. Question: what supplier risks and unresolved questions should inform our decision? Review of data handling, controls, retention, sub-processors and exit risk, ranked by exposure. Independent testing and legal advice not included. | £750 one supplier/standard pack · £995 complex processing or 2 suppliers5 working days · 50% to book |
| AI Governance Starter Pack | For a team needing written AI-use rules and human-review checkpoints. Question: what practical rules should govern our use of AI? Policy scaffold, use rules and human-review checkpoints supporting internal governance and data-protection review. No guarantee of legal compliance. | £495–750 +VAT48 hours · 100% upfront |
| Law-Firm Audit (SRA-aligned) | For a legal practice reviewing its use of AI. Question: where are the confidentiality, privilege, client-data and human-review gaps? A scoped AI-use review mapped to relevant SRA guidance. Not an SRA inspection, regulator endorsement or legal opinion. | £1,000 single office/3 systems · £1,500 multi-office or larger estate48 hours · 50% to book |
Item S.3 — when the decision is “go”
Ongoing delivery.
| Item | Description | Fee |
|---|---|---|
| Continuous AI-Risk Monitor | For a customer needing continuing oversight of agreed systems. Question: what relevant AI exposure has changed since the last agreed review? Ongoing exposure monitoring within agreed scope — review cadence agreed in writing; this is not a staffed 24/7 SOC, incident response or continuous detection service. Thirty-day exit, no lock-in. | £300 first system, +£100/system, cap £800per month · in advance |
| Practical Claude Workshop | For a team wanting practical work on its real workflows. Question: how can the team use Claude with clearer working practices and human review? Half-day practical workshop. Independent training — not an authorised Anthropic course, clearly labelled. | £1,250 +VATremote · £1,650 on-site (WM) |
| Delivery & partner days | For a business or delivery partner needing senior programme, PMO or AI-adoption delivery support within an agreed assignment. £550/day applies to work engaged through a delivery partner; £650/day to direct engagements — the Pricing page sets out the categories, conditions and the limited cases where a lower floor can apply. Responsibilities and deliverable boundaries are confirmed per engagement; expenses as agreed. | £550 +VAT/day via delivery partners · £650 +VAT/day directper engagement · 14-day terms |
Engagements over £5,000 are quoted individually after a scoping call. Manufacturing and Made Smarter-aligned work is scoped per engagement: we sell the outcome, never “grant funding” as the proposition.