Phase 0 — Enterprise AI Risk Assessment
The six pillars of the AI security program are not sold off a shelf — they are built into your ecosystem, and that requires knowing the ecosystem first. Phase 0 is a scoped, fixed-fee assessment that maps your environment end to end: every AI system in use (sanctioned and shadow), the DevSecOps reality, the data and identity stack, the SIEM / EDR / tooling landscape, and where testing should start. It defines how each pillar gets built for you (BYOK and open-source first, commercial upgrades where they earn their place), designs the integration seams into what you already run, and plans the deployment topology for distributed sites. The output is the current-state map, the future-state design and a sequenced build plan — and only then does the program get a number. CISO Marketplace members get the Phase 0 fee credited toward the program if they proceed.
In scope
- AI and security footprint map: sanctioned and shadow AI, data, identity, SIEM / EDR and tooling
- Functional model for each of the six pillars (BYOK and open-source first)
- Integration seams into the platforms and tools you already run
- Deployment topology for distributed sites and segments
- Sequenced, risk-ordered build plan for the pillars
You receive
- Current-state ecosystem map
- Future-state program architecture
- Sequenced build plan with the entry-point pillars
- Executive readout and build vault hand-over
Tiers
Choose the depth.
Essential Phase 0
$17.5K
One business unit or platform, up to ~250 employees, delivered remotely: footprint map, pillar model and sequenced build plan
- employees
- 250
- Sites
- 1
- — On-site week
- — Sibling entities or additional platforms
- — Distributed collection-plane design
Standard Phase 0
$30K
The standard engagement: 10 business days with week 1 on site, the full ecosystem map, integration seams, deployment topology and the executive readout
- employees
- 2500
- Sites
- 5
- — Sibling entities or additional platforms
- — Board-level readout
Enterprise Phase 0
$45K
Multi-site, multi-entity or regulated enterprises: adds sibling entities or platforms, the distributed collection-plane design and a board-level readout
- employees
- 25000
- Sites
- 50
Members: engagement coupons from the CISO Marketplace coupon book apply to services. There is no blanket discount.
What's inside this engagement
Phase by phase.
How a readiness & governance assessment engagement runs, what happens in each phase and what you see. Exact scope, tier and timeline are fixed in your proposal and SOW.
01Scoping & framework selection
The standard or regulation, the systems and the business units in scope are fixed.
You see · Your audit or regulatory driver.
02Evidence collection & interviews
Policies, configurations and records reviewed; control owners interviewed.
You see · Documents and time with control owners.
03Gap analysis
Each requirement mapped to current state: met, partial or missing, with the evidence behind it.
You see · A clear gap register.
04Roadmap & evidence plan
Prioritized remediation with owners, and the evidence an auditor will ask for.
You see · A plan you can execute or hand to us.
Commercials
From first call to final report.
- 01
Scoping call
A practitioner, not a salesperson, walks through targets, constraints and what a good outcome looks like for you.
- 02
Proposal & rules of engagement
A fixed-scope proposal with tier, price and deliverables. Rules of engagement, contacts and out-of-bounds systems are agreed in writing.
- 03
Sign, then start
MSA and SOW are signed electronically and the deposit is paid. Only then does testing begin.
- 04
Execution
Testing runs to the agreed plan. Critical findings are escalated as they are found; you don't wait for the report.
- 05
Report & debrief
An executive summary plus technical findings with evidence, reproduction steps and fixes, walked through with your team.
- 06
Retest
Where the tier includes it, we verify your fixes and reissue the report, so auditors and customers see the issues closed.
Timelines are set per engagement in the SOW.
Related
Non-Human & Machine Identity Security
Assess and govern non-human identities — secrets, API keys, service accounts, workload identities, and AI agent identities — covering issuance, rotation, least-privilege, and lifecycle.
Zero Trust Security Assessment
Comprehensive evaluation of your organization's zero trust architecture implementation, examining identity verification, network segmentation, and access controls. Our assessment identifies gaps in your zero trust strategy and provides a roadmap for enhancing security beyond traditional perimeter-based approaches.
CISO Comprehensive Security Assessment
Holistic evaluation of your organization's entire security program across all critical domains. This efficient, structured assessment provides CISOs and security leaders with a complete diagnostic of security capabilities, maturity gaps, and prioritized improvement opportunities. Our comprehensive approach delivers actionable insights across governance, technical controls, and operational security to inform strategic decision-making and resource allocation.
Research
Latest from the blog
ciso-strategy · Nov 3, 2026
Tool Churn Isn't a Technology Problem. CISOs Keep Replacing Tools They Rate Highly
Security tools rate higher than ever, yet most teams still plan to replace them. A SINET panel says the fix is contractual, not technical — name an owner, set a value deadline, and hold vendors accountable.
ciso-strategy · Oct 30, 2026
MSPs Are Becoming De Facto CISOs for SMBs. Here's the Contract Checklist Buyers Need
As MSPs increasingly fill the CISO gap for SMBs, buyers need a contract checklist defining scope, accountability, certifications and boundaries before signing.
cryptography · Oct 27, 2026
The eMudhra CA Breach Is a Board Briefing on Crypto-Agility, Not a One-Off Patch
Eight eMudhra intermediate CA keys were trivially computable, not stolen. For boards, the lesson isn't about one Indian CA — it's about why static trust in any single root is now a risk to manage.
Start an engagement