5–10 working days
Plan AB Global Holding / Trust and resilience
AI Leakage & Cyber Risk Review
See where sensitive information, institutional knowledge and human judgment may escape through everyday AI use.
Discuss this engagement →View a sample output ↓A focused first engagementIndicative duration Starting scope Working format
Start with Manager Room & Exposure Review.
One department and up to three AI-enabled workflows, followed by a 90-minute leadership simulation.
Exposure mapping, a facilitated Manager Room and a controls-prioritization session.
Leave with: An exposure register, decision log and a prioritized 90-day controls plan.
What we need from you: A business owner, security or IT representative and examples of how AI is currently used. Sensitive material can be described or redacted.
This is a suggested starting format. Scope, schedule, availability and fees are confirmed in a written proposal before kickoff.
Request a starter proposal →The challenge
Where the work begins.
AI leakage is not only a technical breach. Staff may paste confidential material into tools, use unapproved agents or act on unverified outputs. Leaders need a shared view of exposure and practical controls.
Who it is for: Organizations handling sensitive data, complex operations or high-consequence decisions.
How we work01 / Trace 02 / Test 03 / Decide 04 / Control
A focused path from question to action.
Trace
Map the AI tools, prompts, data flows and critical decisions in selected workflows.
Test
Walk through realistic leakage, shadow-AI and output-reliance scenarios with responsible teams.
Decide
Use a Manager Room to pressure-test executive decisions, escalation and accountability.
Control
Prioritize policy, technical and human safeguards with a staged implementation path.
What you receive
Tangible outputs.
Scope and timing are agreed with you; these are the core deliverables we would shape around your context.
- Sensitive-data and AI-use exposure map
- Risk register and scenario findings
- Manager Room decision record
- Priority controls and 90-day action plan
In practice
Inside the Manager Room
A facilitated executive simulation: a sensitive document appears in an external AI workflow. Participants decide what to contain, who owns the response, what evidence matters and which control prevents recurrence. This is a proposed engagement format tailored to scope, not a claim of prior client deployment.
See the work
What a working output looks like.
Illustrative sample · fictional scenario · no client dataAn AI exposure and decision register
| Exposure | Decision and owner | Verification |
|---|---|---|
| A confidential tender is pasted into an unapproved AI tool. | Stop the workflow; preserve facts; security owner assesses what was shared. | Record tool, data class, affected parties and follow the incident process. |
| An AI summary becomes an approval with no human check. | Restore named human approval; process owner defines decision rights. | Sample decisions show a reviewer, sources and an exception route. |
| AI outputs circulate without source or version history. | Use approved storage; knowledge owner requires traceable sources. | A review can reconstruct the source, output version and final decision. |
Open the working brief
- Room scenario
- A manager learns that a confidential document may have been used in an external AI tool.
- Decisions to practise
- Containment, fact-finding, escalation, communication and workflow redesign.
- What leaves the room
- A decision log: what was decided, by whom, why, and what evidence is still missing.
- Scope boundary
- This starting format is an advisory review and simulation. Penetration testing or technical incident response is separately scoped.
This sample shows the structure and level of specificity of a deliverable. The final output is built around your workflows, people and agreed scope.
Next step
Start a conversation →Bring us the real challenge.
We will frame the right starting engagement around your context and decision.