Atlanta · Fixed fee · Senior people only
Security that holds up when it matters. AI governance and cybersecurity for lean financial-services teams, with healthcare readiness and codebase review.
Clear scope and reviewable evidence for small and mid-market teams. Own your software? Explore codebase review and remediation.
Three ways in.
Each one is fixed scope and fixed fee, written down before anyone starts. For a regulated-team baseline, see AI governance readiness →
- A bank-detail change rule your AP team can follow without thinking
- Email spoofing locked down on your domain
- A live drill with whoever approves payments
- An inventory of how your team already uses AI
- An acceptable-use policy people will actually read
- Vendor review and a short roadmap workshop
- A NIST CSF 2.0 risk assessment with current and target profiles
- Penetration testing of external, cloud, or AI applications, quoted after scoping
- Control evidence ready for an insurance application or renewal
A customer or supplier program needs your security evidence.
Bring the supplier or vendor security requirements, customer questionnaire, OEM or dealer vendor program checklist, prime-contractor flowdown, insurance renewal, or pen-test-report request. We start with what your reviewer actually asked for.
The written scope can include an information security policy, incident response plan and disaster recovery exercise, business continuity plan, acceptable use policy, and AI policy. You receive a requirements-to-evidence list and a plan for the gaps.
Readiness and evidence preparation are advisory work. Penetration testing is quoted separately at scoping and requires written authorization, agreed testing boundaries and scheduling. The reviewer owns the acceptance decision.
Review your requirements → See the review scopeSecurity planning in development
Connect the plan for people, places, and systems.
We are developing a partner-enabled physical-security offering to complement DSE's cyber and AI work. The aim is coordinated planning, clear responsibilities, and specialist delivery matched to the engagement. Physical-security delivery is not currently available through this website.
Scope on paper. Then we start.
Four steps, run by the people you meet on the first call.
-
Fit call
You describe the problem. We say which offer fits, or that none do.
-
Written scope
Fee, deliverables, and dates on one page.
-
The work
Done by the senior people from the call. Weekly check-in.
-
Handoff
What shipped, what's left, who owns it. Yours to keep.
DSE's governed AI workspace reference architecture.
Identity, tenant workspaces, model routing and governance records.
Explore the architecture →PrivateStack is DSE's own product. Deployment work is scoped separately. All work
We build what we recommend.
PrivateStack
A private AI workspace. Open-weight models like Llama, Mistral, and DeepSeek, with every request logged for export.
mcp-warden
Locks an AI agent's tool list and fails the build when it changes without review. MIT licensed, on PyPI. We use it in our own assessments.
See our open-source work →Try it before you call.
27 free tools. Most run in your browser and nothing leaves the page.
- Deepfake Exposure Self-Check See how exposed your payment process is to a deepfake or spoofed request. 3 min →
- Shadow AI Inventory Quiz Find the AI tools your team already uses without approval. 4 min →
- AI Acceptable Use Policy Generator Generate a one-page AI use policy your team will actually read. 5 min →
- Cyber Risk Check A scored snapshot of where your current cyber risk stands. 6 min →
From the Refinery Report
All 103 posts →AI Governance Starter Kit: Startup, Growth, and Enterprise Buyers Need Different Evidence
A practical AI governance starter kit for startup, growth, and enterprise buyers: inventory, policy, vendor review, risk register, evidence checklist, and a 30/60/90-day roadmap.
Private AI Architecture vs Public API: Choosing the Boundary
Choosing between private AI architecture and public model APIs is a control-boundary decision involving data sensitivity, logging, vendor dependence, operations, and cost governance.
OWASP LLM Top 10 Assessment: A Practitioner Guide
A practitioner guide to assessing LLM applications against the OWASP LLM Top 10, and how DSE tests for each risk.
Common questions.
What does DSE actually do?
DSE does three things: stops the payment fraud and account attacks that cost operators real money, puts AI to work with written rules about what data stays out, and builds the evidence a customer, prime, insurer, or examiner asks for in a security review. Every engagement is fixed scope and fixed fee, written down before work starts.
How much does an AI governance or AI security engagement cost?
Engagements are fixed fee and confirmed in writing after a scoping call. These governance packages are quoted privately to your scope. How engagements work explains our starting scopes; security, AI readiness, implementation, data programs and retained leadership all receive a private written proposal.
Is physical-security delivery available through DSE?
No. DSE's partner-enabled physical-security approach is in development and is not currently available through this website. Any future scope depends on a confirmed provider, applicable qualifications and approvals, capacity, insurance, service area, and documented delivery responsibilities.
Do you work with regulated industries like healthcare, banking, and government?
Yes. Healthcare, financial services, and federal or public-sector programs are a primary focus, alongside growth and mid-size operators outside regulated industries. Regulated engagements map to the frameworks that already apply: HIPAA, NIST AI RMF, NIST CSF 2.0, SR 26-2, GLBA, NYDFS Part 500, and CMMC-aware federal requirements.
Do you certify us as compliant with NIST AI RMF, ISO 42001, or the EU AI Act?
No. DSE provides readiness and technical evidence, not certification. We are not an accredited certification body and do not issue ISO/IEC 42001 certificates or certify EU AI Act or NIST AI RMF compliance. We get you ready and assemble the evidence; the certificate, where one exists, comes from the accredited body.
How is DSE different from a big consulting firm?
DSE is a small firm of senior practitioners. The people who scope the engagement are the people who do the work; there is no junior bench running the actual testing or governance build. Engagements are fixed-fee and scoped in writing before work starts, not open-ended time-and-materials retainers.
Tell us what broke.
One paragraph is enough. A senior person replies within one business day with the offer that fits, or tells you we're not the right shop.
Or book a 20-minute call · contact@thedataexperts.us