AI security · Fixed price · Two weeks
Adopt AI without leaking customer data
Most companies of 20 to 200 people are already using AI, with or without a decision to. Our two-week AI security review finds where it is being used, what data is flowing to which vendors, whether your own AI features can be manipulated, and what to fix first. Fixed price, written report, and a remediation quote you can accept or ignore.
Six risks we find most often
None of these require a sophisticated attacker. Most are the by-product of staff and vendors adopting AI faster than policy.
Shadow AI
Staff pasting customer records, contracts and source code into personal ChatGPT, Gemini or Copilot accounts, outside any agreement or retention control.
Vendor terms nobody read
SaaS tools that quietly added AI features and now send your data to a model provider under terms that permit training or offshore processing.
Prompt injection
Your own assistant or agent can be instructed by a customer, an email or a document to reveal data or take actions it should not.
Data exfiltration through AI features
Retrieval systems that answer any question for any user, because access controls were applied to documents but not to the index.
Agents with too much authority
AI agents with API keys, inboxes and payment access, and no limits on what they may do or how often.
Compliance exposure
Personal information in prompts and logs, and automated decisions that must be disclosed under the Privacy Act from 10 December 2026.
What the two weeks include
A review scoped for a business of 20 to 200 people, not a 200-page enterprise audit.
- Shadow AI discovery: which AI tools are in use, by whom, with what data, from identity, network and expense records
- Data-flow map: every path by which company or customer data reaches a model provider, and under which terms
- Vendor and contract review of the AI features inside your existing SaaS tools
- Prompt-injection and data-exfiltration testing of your own AI features, assistants and agents
- Access-control review of retrieval systems, indexes and agent permissions
- An AI use policy your staff will follow, with approved tools and clear rules for sensitive data
- Mapping to the Essential Eight and the Australian Privacy Principles, including the 2026 automated-decision disclosure rules
- A prioritised remediation plan with a fixed quote, and a short briefing for your leadership team
How it runs
Two weeks from kick-off to the leadership briefing.
Week one: discover
Interviews, identity and network data, vendor terms, and the data-flow map. You see early findings by the end of the week.
Days 1 to 5Week two: test and write
Hands-on testing of your AI features, policy drafting, framework mapping and the remediation plan.
Days 6 to 10Briefing
A 60-minute session with leadership and your MSP: findings, risk ranking, what to fix first, and the quote.
Day 10How we work
Practical security for growing companies, not a compliance exercise.
Risk first
We rank findings by likelihood and business impact, then by effort to fix. The report leads with the three things that matter most.
Alongside your MSP
Most clients have a managed service provider for IT. We review the AI layer, hand them clear remediation tasks, and do not try to replace them.
Testing, not theory
We attempt prompt injection, data extraction and privilege escalation against your real AI features, with your permission and in writing.
Plain language
The report is written for a founder or managing director, with a technical appendix for engineers and the MSP.
Tools and platforms we use most
Pricing
One fixed price for the review. Remediation is quoted separately and you decide who does it.
| Option | Price |
|---|---|
| AI security reviewTwo weeks. Discovery, testing, policy, framework mapping, remediation plan and leadership briefing. | $6,900 |
| RemediationFixing the highest-risk findings, with your MSP or our engineers, with evidence captured for customers and insurers. | fixed quote |
| Safe AI at work training90 minutes for all staff on using AI tools safely, aligned to the new policy. | $120 per seat |
| Ongoing AI security partnerQuarterly re-review, vendor change monitoring and questionnaire support. | from $3,500/mo |
All prices in AUD, excluding GST. Registered startups under two years old receive 15% off their first engagement. We do not resell security products or take commissions from vendors.
What this looks like in practice
A representative engagement of this kind.
Questions
We already have an IT provider. Why do we need this?
Your MSP secures devices, identities and networks. AI adds a new layer: data leaving through prompts, vendors changing terms, and AI features that can be manipulated. Most MSPs have not yet built that capability, and we hand them the fixes rather than compete with them.
We don't build AI. We just use ChatGPT and Copilot. Does this apply to us?
Yes, and it is the most common situation. The review focuses on how staff use AI tools, what data is shared, and which vendors receive it. The testing component is reduced and the price stays the same.
Is this an Essential Eight assessment?
The review maps findings to the Essential Eight and the Australian Privacy Principles, so you can see where AI use affects your maturity. It is not a formal certification; we prepare you for audits and accredited auditors certify.
What is prompt injection?
An attack where text in a customer message, email or document instructs your AI system to ignore its rules, reveal data or take an action. It is the top risk in the OWASP list for LLM applications, and most assistants built in the last two years are vulnerable to some form of it.
Will testing disrupt our systems?
No. Testing is agreed in writing, performed against your AI features with test accounts where possible, and never involves denial of service or destructive actions.
What does the Privacy Act change mean for AI?
From 10 December 2026, organisations that use personal information in automated decisions that significantly affect people must disclose this in their privacy policy. The review identifies where that applies to you and what the disclosure needs to say.
Often paired with
AI cost audit
A fixed-price, one-week audit of what your AI features cost per answer, document and customer, with a ranked savings plan that protects quality.
Read moreEssential Eight · Privacy Act · SOC 2 prepSecurity and compliance
Practical security for growing companies: Essential Eight alignment, Privacy Act readiness and the evidence enterprise customers ask for.
Read moreLLM agents · RAG · Document AIAI and automation
Assistants, agents and document pipelines built on your own data, measured for accuracy and handed over running in your cloud.
Read moreFind out where your AI is exposed
A 30-minute conversation to scope the review. Fixed price, two weeks, and a report your leadership team can act on.