Assessments
Know exactly where you stand before anyone proposes a fix.
Two assessments, one rule: every score line maps to a check that was actually run, the fixes are written for your site or system, and the report is yours whether or not you go further. Start with the one that matches how your business depends on the internet.
At a glance
Which one, and for whom
| Assessment | For an operation that | You receive |
|---|---|---|
| AI Security & Risk Audit | already runs agents, copilots or automations and needs to know who can do what, and where it can be abused | a 25-control NIST AI RMF scorecard, every finding owned and dated, the fix for each |
| Digital Intelligence Assessment | wants the whole operation looked at — how it runs, where it is exposed, and where a structural system pays back first | a scored review of the operation with a prioritised plan and the sequence each step belongs in |
Assessment 1
AI Security & Risk Audit
For a business that already runs agents, copilots or automations. We score the operation against the NIST AI Risk Management Framework: who can do what, where approval gates sit, how secrets and inbound content can be abused, what is logged, and what would stop a bad instruction before it acts. We run the same scorecard on ourselves every week and publish the result, so you can see what the report looks like before you buy it.
- framework
- NIST AI RMF 1.0, 25 controls
- output
- scorecard + a named owner and a date for each fix
- what it is not
- a certification
Assessment 2
Digital Intelligence Assessment
The wide view. How the business runs day to day and what a person still does by hand; what a person still does by hand that a governed system should carry; what the web, app and workflow layer costs in time; and where the security exposure sits. It ends in a prioritised plan with the price of each step, so the first thing you fund is the thing that pays back first.
- scope
- the whole operation
- starts with
- a three-line intake
- output
- scored review + prioritised plan
Straight answers
Which assessment should I start with?
If you already run agents, copilots or automations, start with the AI Security & Risk Audit — it scores what is live today. If you want the whole operation looked at before deciding where a structural system would pay back first, request scoping for the Digital Intelligence Assessment.
What do I actually receive?
A scored report: every check that was run and what it found, the fixes ranked by impact and written for your site or system, and a methodology section that says what was automated and what could not be assessed. Nothing is invented to fill a gap.
After the assessment
Do assessments lock me into anything?
No. Each one is priced once and the report is yours. The sprints and partner engagements are the next step only if the numbers say so.
Is the security audit a certification?
No. It scores your AI operation against the NIST AI Risk Management Framework and assigns each fix a named owner and a date. It is evidence for your own governance, not a certificate, and it does not guarantee that nothing can go wrong.
Request an assessment
Three lines is enough to scope one.
Leave your company, your market, and what you already run — agents, copilots, automations, or nothing yet. You get a written reply naming which assessment fits, what it would cover, and the price, before any work starts.