VERITAS
Verified assessment
Evidence-based truth across your controls, your vendors and your AI systems, not self-attestation.
Approach
Proven with evidence, measured in one score
Four pillars define how we deliver every engagement, from a single vendor assessment to an AI management system.
How we deliver
The four pillars
AEGIS
Integrated defense
Closing gaps through remediation plans, contract clauses and AI guardrails that extend your defences.
APEX
Strategic oversight
One measurable view of technology, cyber, third-party and AI risk for executives and boards.
FLUXUS
Future resilience
Horizon scanning built into every review: CPS 230, DORA, the EU AI Act and emerging AI threats.
APEX in practice
Risk you can measure
The TPR Score turns complex findings into a single number from 0 to 100, weighted by domain importance and control severity. It covers every assessed vendor, with an AI risk domain for vendors that provide or use AI.
100
= a verified, fully aligned security posture
90–100Exceptional / verified alignmentNo action; re-assess at next scheduled review
80–89Acceptable / minor remediationLow-priority remediation plan
70–79Moderate risk / needs attentionHigh-priority remediation plan (AEGIS)
< 70Critical risk / unacceptable exposureContract review and executive notification (APEX)
Third-party risk management
The four-stage lifecycle
Identify & scope
Master vendor inventory, including shadow IT and AI tools, and criticality tiering.
APEXAssess & verify
Tiered questionnaires with mandatory evidence for critical controls such as MFA and backups.
VERITASContract & protect
Security addendum, right-to-audit and breach-notification clauses.
AEGISRemediate, report & review
Verified closure of findings, executive TPR Score reporting and scheduled re-assessment.
APEX · FLUXUS
ISO/IEC 42001
Your path to a certifiable AI management system
ISO/IEC 42001:2023 is the world’s first international standard for AI management systems. We guide you from first gap analysis to certification audit.
Initiation & gap analysis
Leadership endorsement, scope, AI system inventory and gap analysis against Clauses 4–10 and Annex A.
AI policy (draft), gap report, roadmap
Framework design
AI risk and impact assessment method, controls selection and integration with your existing frameworks.
Risk register, Statement of Applicability, procedures
Implementation
Process rollout, training, documentation, performance measurement and evidence collection.
Populated registers, training records, KPI dashboards
Assurance & certification
Internal audit, management review, corrective actions and Stage 1 and 2 certification audits.
Audit reports, board papers, certification
Ready to secure your third key?
Book a discovery session to baseline your cyber, third-party and AI risk posture.