MainAI No competition
We work under your name and method. You keep the contact, the decisions and the follow-up advice.
A risk product for audit and law firms
Cyber risk,
in plain language.
You keep the advice and the client relationship. We deliver the professional basis: a clear risk picture, documented findings and independent follow-up — gathered in a trail you can audit.
15 minutes · no obligation · we only start after a mandate
One fixed deliverableno loose analysis
Three decision layersmanagement · operations · control
One free follow-upafter a documented fix
Fixed priceafter an agreed scope
White label · documentedWritten mandate · roles · stop conditions
A calm run
A small area.
A clear picture.
See how the work stays inside the frame, and how findings become three decisions — without tech in the way. The example is illustrative.
Agreed area · read onlyPrivate inference · Denmark
Ready · 0/48 checks · 0 changes
This area only · everything else stands still
Only what was agreed.
The whole picture.
The client sees the three targets. Nothing outside the frame is touched.
Public · website
WebsiteWaiting
Access · API
APIWaiting
Behind the scenes · internal
Internal servicesWaiting
No changes. Evidence saved and repeatable.
Ready · 0/48 checks · 0 changes
Working · {n}/48 checks · 0 changes
Working
Done · 1 red · 1 yellow · 1 green
Start the run
See again
Checking
Waiting
Red · decide
Yellow · plan
Green · control
No changes. Evidence saved and repeatable.
Decision: red first. Yellow gets a deadline. Green goes in the file.
Findings explainedChoose a finding
Press start. Findings open here in plain language as they are validated.
Access without a second check
Some staff can open internal administration with a password alone. That is an extra way in if a password is shared or guessed.
Next stepDecide a second check now. Operations gets a concrete task and a deadline.
Security certificate expires
The website’s security certificate expires shortly. Without renewal, clients may meet a browser warning and lose confidence.
Next stepOperations gets a deadline to renew and monitor. Status is tracked in the action plan.
A second check works
The client API rejects a correct password without the second factor. The control is validated and can go into the audit trail.
Next stepNo fix. The evidence is kept with the rest of the case file.
Ready for a risk brief · 1 red, 1 yellow and 1 green
See a risk briefIllustrative run · runs in our private inference cluster in Denmark · nothing outside the frame is touched.
Why a Risk Desk?
You own the relationship.
We deliver the basis.
The client should not have to choose between business advice and technical insight. Our work makes your advice concrete — without taking the client.
Tech becomes consequence
Management gets the risk, the meaning and a decision. Operations gets a concrete task. No scanner reports.
Ready for the file
Every finding has evidence, an owner, a deadline and a status. The final record shows whether the risk is closed.
One deliverable · three readers
One risk picture.
Three decision layers.
The client does not get 80 pages of tech. The client gets a decision basis that management, operations and control can each read on its own.
01 · MANAGEMENTOne page: risks and decisions
02 · OPERATIONSPlan with owner and deadline
03 · CONTROLEvidence, method and closure
04 · FOLLOW-UPFree re-test and new status
Due diligenceBoard reportVendor managementInsurance basisYear-endClient review
Can be delivered alongside an audit, transaction, advisory process or management report.
What the client brief looks like · example
Problem.
Meaning. Action.
Findings are ranked by what they mean to the client — not by how technical they are. The example is illustrative.
Risk brief · excerptCONFIDENTIAL
| Risk | What is the problem? | What does it mean? | Action and deadline | Status |
|---|---|---|---|---|
| Critical | Anyone can log into administration without a second factor. | Access to client information. | Enable a second factor · 7 days | Open |
| High | One client can see another client’s invoice by changing a number. | Breach of confidentiality. | Separate client data · 14 days | Planned |
| Medium | The website’s security certificate expires soon. | Browser warning and lost trust. | Renew and monitor · 9 days | Open |
| Low | Source code is publicly available. | Insight into the build. | Assess closure · 30 days | Not planned |
Example · not a client run. The risk matrix is agreed before start.
Roles that fit the firm
You advise.
We document.
A clear split makes the client comfortable, the evidence useful and responsibility visible throughout.
Your role
Relationship and advice
- Contact, needs and mandate
- Risk matrix and client dialogue
- Prioritisation and follow-up
- The follow-up advice
Our role
Measurement and documentation
- Public and internal measurement
- Validation and evidence
- Action plan and re-test
- Technical sparring with operations
Together: set the scope, review the findings and sign the final record.
How it runs
Short agreement.
Calm process.
There are no surprises along the way. Everything is agreed in writing before we begin.
Short meeting
Client, purpose, scope and who decides.
Written mandate
Scope, contact paths and stop conditions.
Measurement and risk brief
Findings are validated and scored with the client.
Closure and attestation
One free re-test. Closed or reopened.
Scopes
From one page
to the whole firm.
Choose the smallest scope that answers the client’s question. Fixed price after an agreed scope.
The client’s website
The outside picture, risk brief, action and follow-up.
The whole external surface
More services and countries, management annex and ranked plan.
Inside the firm too
Internal systems and access via a secure connection.
Safe harbour
Mandate first.
Then we measure.
The client gives written permission, and both you and the client can see exactly what may be touched.
- Scope, period and named systems
- No changes by default
- Stop conditions and a fixed contact chain
- Minimal data and a local trail
- Private inference cluster in Denmark · data does not leave the cluster to think
- One free re-test after a documented fix
Next step
A short chat.
No obligation.
15 minutes about the client, the scope and how the product can sit under your name. Afterwards you decide whether to continue.
Reply within one working day · no newsletters · no commitment