Cyber threats
Cloud, SaaS and remote work have widened the attack surface. Boards now expect cyber risk to be governed like any other business risk.
Technology, cyber & AI risk management
Your risk doesn’t stop at your walls. Neither do we.
The Third Key brings structure, evidence and executive clarity to cyber risk, third-party risk and AI compliance, including alignment to ISO/IEC 42001.
- You
- Your vendors
- Their vendors
The challenge
Three fronts, usually managed in silos
Extended supply chain
Every vendor with access to your data or systems carries part of your risk, and most programs still rely on unverified self-attestation.
AI adoption
AI tools are entering operations faster than governance can keep up. ISO/IEC 42001 and the EU AI Act are setting new expectations.
Our approach
Structure. Verification. Oversight.
The three ideas behind our name and our mark: the hexagon is the framework, the tick is verified evidence, and the three nodes form an apex of oversight.
Structure
Every engagement is anchored to recognised frameworks: ISO/IEC 27001, NIST CSF 2.0, ISO/IEC 42001 and the Essential Eight.
Verification
Critical controls in your environment, your vendors’ and your AI systems must be proven with evidence, not self-attested.
Oversight
We turn technical findings into one measurable risk picture, so executives and boards can make fast, prioritised decisions.
What we do
Three connected service lines
Technology & Cyber Risk
A clear, framework-based view of where you stand, and a prioritised plan to close the gaps that matter.
Cyber risk servicesThird-Party Risk Management
Evidence-based assessment of every vendor that touches your data, systems or AI.
Third-party risk servicesAI Risk & Compliance
Understand where AI is used, what could go wrong, and govern it to ISO/IEC 42001.
AI risk servicesReady to secure your third key?
Book a discovery session to baseline your cyber, third-party and AI risk posture.