Searches every page: governance library, books, services, glossary, tools, insights.
AI Risk Governance & Security™
AI introduces exposure at the data, decision, and vendor layers — and that exposure becomes financial loss, operational disruption, or reputational damage only when it is left unmanaged. AI Risk Governance & Security™ is the protective discipline of the SRJ practice: a standalone executive program to identify, assess, and mitigate AI-driven technology risk before it reaches the balance sheet.
This pillar hosts Books 05 through 09 of The Operating Discipline for AI Library™. Books 05 and 06 move from technical assessment of the AI attack surface to the governance machinery that proves AI risk is controlled. Books 07 through 09 extend the work into product security, application security, and cloud and infrastructure security: the three security disciplines that AI has structurally changed.
The exposure your dashboards cannot see.
Available nowA CISO-grade audit framework for proving AI exposure is known, controlled, and governed. Built on The Visibility Triangle and the six domains of the modern security portfolio, it produces an exposure map, a remediation roadmap, a regulatory crosswalk, and a board briefing that survives scrutiny.
The question your board will ask. The proof you don’t have yet.
Available nowThe operating manual for proving AI risk is governed: ratified policies, an integrated risk register, a regulatory crosswalk, and board reporting that works at a glance. Following the audit’s exposure map, this book builds the governance machinery — a discipline to operate, not a project to complete.
Closing the velocity gap before regulators do.
Available nowEngineering velocity is up an order of magnitude. Security review capacity is not. At the same time, AI introduces vulnerabilities that deterministic tooling cannot reliably find. This book introduces The Dual-Impedance Problem and the five working frameworks that produce a defensible Secure by Design operating model for AI-enabled products.
AppSec for applications that no longer behave deterministically.
ForthcomingEvery AppSec tool in production was built on the assumption that an application produces the same output for the same input. AI invalidated that assumption. This book introduces The Runtime Determinism Gap and the AppSec program model executives need when scans pass and applications still fail in production.
Governance for a cloud where most actors are not human.
ForthcomingCloud security was built on the premise that every meaningful action could be traced to an accountable human. The identity ratio inverted, infrastructure pace outran governance pace, and the audit chain stopped answering its own question. This book introduces The Sovereignty Problem and the operating model cloud security leaders need to catch up.
Browse the full library across both series, or speak with us directly about applying the frameworks in your organization.