Six controls carry most of the weight — AI has raised the price of getting them wrong.
Only 6 cyber controls which are an absolute necessity.
Every business is moving toward AI, and security has to move with it.
The window is closing
AI is collapsing the window between a vulnerability being discovered and being exploited. It helps attackers identify new and older weaknesses, build proof-of-concept exploits to test whether an attack will actually work, and map out attack paths at a speed no human team can match.
In practice, this changes three things:
- Old weaknesses matter again. The unpatched server or forgotten account that was “probably fine” is now found and tested automatically, alongside every new vulnerability.
- Patching windows are no longer measured in weeks. A monthly patch cycle was designed for a slower world. The time between disclosure and exploitation is now short enough that slow processes are exposure.
- Phishing and impersonation are more convincing. Well-written, personalised messages and cloned voices can be produced at scale, which puts pressure on every control that relies on a person spotting something odd.
Attacks that look like normal users
AI has also become good enough at mimicking normal user behaviour that telling human activity from AI-initiated activity is often no longer possible from the logs alone. An attacker using stolen but valid credentials, working at the pace and in the pattern of a real employee, generates nothing that looks obviously wrong.
That shifts the emphasis. You cannot rely on spotting “strange” behaviour after the fact. You need to limit what any single identity can reach in the first place, know which accounts (human and non-human) exist, and be able to revoke access quickly.
The same applies to your own adoption of AI. Every assistant, agent, plug-in or automation connected to your email, files or business systems is a new identity with access and a new route for data to leave. Most businesses have more of these than they realise.
Your supply chain now has AI in it
Think about how many vendors have a foot inside your infrastructure — your business systems, cloud, servers, databases, the places your sensitive data actually lives. Are they using AI agents? Assume yes, even if you can’t confirm it.
If one of their AI systems breaks its guardrails and something goes wrong inside your environment, that incident is yours too. Your customers, your regulators and your insurer will look to you, not to the supplier. Contracts rarely address it, and most businesses cannot currently answer:
- Which suppliers have standing access to our systems or data, and what exactly can they reach?
- Do any of them use AI agents that act on our data or inside our environment?
- Can we see what they do, limit it, and cut it off quickly if something goes wrong?
- What do our contracts say about it?
Fighting AI with AI, in the right order
Fighting AI with AI is a sound principle — but only once the fundamentals underneath it are solid. AI-driven detection and response tools work with whatever they are given. If your asset list is incomplete, they cannot see what is missing. If access is sprawling, they alert on noise. If nobody owns the response, faster alerts simply arrive faster at nobody.
Without those fundamentals, you’re spending money to patch a foundation that isn’t there.
The sequence that works is: get the fundamentals right, prove that they work, then automate on top of them. Five controls do most of that foundational work. They are not exotic, which is exactly why so many businesses assume they are in place rather than verify it.
How We Can Help
There are primarily 6 cyber controls you need to get right — properly, not just on paper. We’ll tell you what they are, which new processes you need to establish, and help you implement or optimise them if you need us to.
You may already have all or most of the right tools but are running them below their potential — usually a process problem, not a technology one — and one we can help close. Here is how we work, and what you receive at each stage.
1. Test the six controls in your environment
We look at how each control actually operates, not just what your policies say. For each one we test coverage (does it apply to everything it should?) and effectiveness (does it work in practice, and can you show it?).
You receive
- A scorecard for the six controls, each rated Effective, Partially effective or Ineffective, with the reasons in plain English
- A coverage map showing which users, systems, cloud services and suppliers sit inside each control and which do not
- An evidence-based findings list: what we saw compared with what was expected, and what is missing
2. Find what your existing tools are not doing
Before recommending anything new, we look at what you already own. Most environments have capable tools that are only partly deployed, poorly configured, or not being acted on.
You receive
- An inventory of your security tools and licences, mapped to the six controls
- A utilisation review: what each tool is capable of, what it is actually doing, and where it is unused, duplicated or unowned
- A list of quick wins that need configuration or process changes rather than new spend
3. Establish the processes that make the controls work
Controls fail most often at the point where a tool needs a person or a routine. We identify which processes are missing or informal and design them so they can be followed, owned and evidenced.
You receive
- A list of the new processes you need, prioritised by the exposure they close
- A one-page design for each process, showing trigger, steps, owner, timing and the evidence it produces
- Typical examples: granting and revoking access, triaging and patching vulnerabilities, onboarding and offboarding suppliers, approving new AI tools, and escalating alerts
4. Bring AI and supplier exposure under control
We map who and what has access to your environment, including the parts you cannot see today.
You receive
- A supplier access map: who has access, to what, whether it is standing or time-limited, and how quickly it can be revoked
- An AI use register covering AI tools and agents used by your own staff and, as far as it can be established, by your suppliers
- An inventory of non-human identities (service accounts, API keys and tokens) with owners and recommended restrictions
- A supplier security checklist and contract clauses for AI use, access limits and incident notification
5. A prioritised plan to get the fundamentals solid
Everything is sequenced so that the largest exposures close first and nothing is added for its own sake.
You receive
- An implementation plan for the six controls, with owners, effort, dependencies and sequencing
- Clear “done” criteria and the evidence that proves each control is working
- A short leadership summary of where you stand and what needs deciding
6. Implement or optimise, if you need us to
You can take the plan and run with it, or we can do the work with you. We configure and optimise the tools you already have, embed the new processes, and stay until the controls are working.
You receive
- Working process runbooks, with named owners who have been walked through them
- An evidence pack showing each control in operation
- A re-test of the six controls, with a before-and-after scorecard
7. Get ready for AI on top
Once the foundations are proven, AI-driven detection and response tools can add real value. We help you use them where they pay off, rather than buying them to compensate for gaps.
You receive
- An AI readiness view: which prerequisites are in place (asset visibility, data quality, response processes) and which are not
- A shortlist of where AI-driven detection or automation would add value for your environment, and where it would not
- A schedule for re-verifying the six controls so they stay effective as your business and your suppliers change
Not sure how many of your six controls are truly working?
Start with a no obligation conversation. We’ll tell you where you stand and what to fix first.