AI & Cybersecurity
Deploy AI you can defend, and defend with AI.
Legal
Recurring
A certificate has to be maintained. A register has to be current. An AI system has to be reviewed again when it changes. That work is cheaper continuous than rediscovered.
Recurring services give you a named senior contact, an agreed capacity each month, and a rhythm: a monthly review, a quarterly report, and someone to call when a customer sends a security questionnaire on a Friday afternoon.
They are priced monthly, committed by quarter, and can be stopped at the end of any quarter with thirty days' notice. No minimum term of one year, because a service you would leave if you could is not a service worth selling.
A senior security leader on your management team for a defined number of days each month: strategy, board reporting, supplier reviews, incident decisions and the compliance calendar.
Your compliance obligations run continuously: evidence collected as it is produced, internal audits on schedule, regulatory changes watched, and the audit answered without a scramble.
A designated data protection officer with the independence the GDPR requires, handling the register, impact assessments, data subject requests and the supervisory authority.
The person who owns your AI register, reviews each new use case against the AI Act, and keeps governance moving at the speed your teams are actually adopting these tools.
Standing engineering capacity that keeps pipelines, guardrails and compliance evidence working as your platform changes, with a named engineer and a monthly review.
Detection and response around the clock, delivered with a PDIS-qualified partner, with detection use cases written for your environment and a single point of contact on our side.
Continuous scanning of what you own and what is exposed in your name, with findings filtered, prioritised and tracked to closure rather than published as a raw list.
Discuss this service — Vulnerability and attack-surface management
Continuous cost management: allocation kept accurate, commitments managed, waste removed each month, and savings reported as measured figures.
A year-round programme rather than an annual module: short role-based content, phishing simulation with coaching, and reporting that holds up as NIS2 evidence.
One point of contact for regulatory questions across Europe, French-speaking Africa and South America, answered with local partners who practise in that jurisdiction.
We do not ask for a retainer on the first call. The sequence below is what actually happens, in that order, and each step is a decision you make with the previous step's output in hand.
1
A fixed-price engagement with a defined scope. It answers one question — where do we stand, or how do we meet this deadline — and ends with evidence.
2
Every pack ends with a costed, prioritised plan. It is written so your team can execute it without us, and it is yours whatever you decide next.
3
Most clients hand us the part of the plan that never finishes: the calendar, the evidence, the reviews, the reporting. Known capacity, known monthly cost.
4
The discrete items — a pentest, a landing zone, a certification push — are run as separate engagements from the catalogue, scoped and priced individually.
If you already know which recurring service you need, we can scope it directly. If not, a pack first is usually cheaper and always clearer.