Improve
AI security and governance
Use AI tools with clear rules, sensible permissions and evidence.
We help you adopt AI tools safely: find what is in use, agree which tools are approved and for what, check what information they can reach, prepare for assistants such as Microsoft 365 Copilot, and put controls around AI-assisted fraud. This is a review of how your business adopts AI. Specialist testing of AI applications is a separate penetration testing service, and readiness is not certification.
Request a quote- Price
- Quoted on scope
- How you can engage us
- One-off project
- Delivered by
- Cyber Guys
Who it is for
Businesses whose staff use, or want to use, AI assistants and tools with client or business information.
Scope
The AI tools, assistants and connectors used by the business, and the data and permissions they can reach, as agreed in the scope.
What is included
- An AI tool register: what is in use, by whom and for what
- An approved-use policy in plain English
- Sensitive data handling rules for AI tools
- Review of access permissions for AI tools, agents and connectors
- Readiness review for Microsoft 365 Copilot or another assistant
- Oversharing review of files and sites an assistant could surface
- Human review requirements for AI output used in client work or decisions
- Supplier and configuration review of approved AI tools
- Staff awareness on safe AI use
- Controls for AI-assisted fraud, such as voice cloning and deepfake calls
- Governance evidence for clients, insurers or auditors
What is not included
- Work outside the agreed scope, which is quoted separately
- Specialist security testing of AI applications or models, available through the penetration testing service
- Building, training or integrating AI systems
- Purchasing AI licences
- Legal advice, including on privacy or intellectual property
- Certification against any AI standard
How delivery works
- 01
Discover
We find the AI tools in use, what they connect to and what information they can reach.
- 02
Decide
We agree which tools are approved and for what, and which oversharing and permission issues to fix first.
- 03
Put controls in place
We write the policy, adjust permissions and sharing, and brief staff.
- 04
Verify
We check the permission and sharing changes held and record the governance evidence.
- 05
Hand over
We hand over the register, policy and evidence, with a review date for the register.
Who does what
You
- Tell us which AI tools staff use and which you want to adopt
- Decide which tools and uses are approved
- Adopt the policy and require staff to follow it
- Approve each permission or sharing change
Cyber Guys
- Build the AI tool register
- Draft the approved-use policy and data handling rules
- Review permissions, connectors and oversharing, and plan each change with its business impact
- Make or coordinate the agreed changes and verify them
- Brief staff and record the governance evidence
Your IT provider or partner
- Your IT provider, where they manage the tenant, makes or approves permission and sharing changes
Access we need
- Administrator access to review app consent, sharing and permissions in Microsoft 365 or Google Workspace
- A list of AI tools in use, or access to app and sign-in reports to find them
We never ask for your password. Access is through a named account that you or your IT provider create for the engagement, and can remove at any time.
Dependencies and licences
- Assistants such as Microsoft 365 Copilot can surface any content the user already has access to, so oversharing is reviewed before rollout
- Some discovery and data protection features depend on your Microsoft 365 or Google Workspace licence
What you receive
- AI tool register
- Approved-use policy and data handling rules
- Oversharing and permissions findings with change log
- Assistant readiness report
- Staff briefing material
- Governance evidence pack
How we know it is finished
- The register and policy are adopted by an authorised person
- Agreed permission and sharing changes are verified, or recorded as exceptions you accepted
- The governance evidence pack is delivered
Related services
Microsoft 365 security
Secure your Microsoft 365 tenant without breaking how your business works.
Quoted on scopeRequest a quoteStaff awareness and phishing simulation
Short, relevant training and realistic practice for your team.
Quoted on scopeRequest a quotePenetration testing and assurance
Coming soonAuthorised, scoped testing that shows what an attacker could do.
Register interest
Request a quote for AI security and governance
Tell us a little about your business. We will arrange a short scoping call to agree what is in scope and send a written quote. The call is about scope and price — it is not free security advice.