Your AI features are shipping. Who reviewed them?

I find the security gaps in AI features before attackers—or enterprise customers—do. Three weeks. Fixed price. A clear executive summary and findings your engineers can act on.

Start a conversationWhat I do ↓
{
  "Effect": "Allow",
  "Principal": { "Service": "bedrock.amazonaws.com" },
  "Action": "lambda:InvokeFunction",
  "Resource": "arn:aws:lambda:us-east-1:123456789012:function:agent-tools"
}
--- a/agent/action-group-policy.json
+++ b/agent/action-group-policy.json
@@ -9,6 +9,12 @@
 {
   "Effect": "Allow",
   "Principal": { "Service": "bedrock.amazonaws.com" },
   "Action": "lambda:InvokeFunction",
-  "Resource": "arn:aws:lambda:us-east-1:123456789012:function:agent-tools"
+  "Resource": "arn:aws:lambda:us-east-1:123456789012:function:agent-tools",
+  "Condition": {
+    "StringEquals": { "aws:SourceAccount": "123456789012" },
+    "ArnEquals": {
+      "aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:agent/AGENT1234B"
+    }
+  }
 }
{
  "Resource": "arn:aws:lambda:us-east-1:123456789012:function:agent-tools"
}
@@ -9,6 +9,12 @@
-  "Resource": "arn:aws:lambda:us-east-1:123456789012:function:agent-tools"
+  "Resource": "arn:aws:lambda:us-east-1:123456789012:function:agent-tools",
+  "Condition": {
+    "StringEquals": { "aws:SourceAccount": "123456789012" },
+    "ArnEquals": {
+      "aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:agent/AGENT1234B"
+    }
+  }

What I do

Fixed scope, fixed price, stated up front. You work directly with the person doing the work. Here’s who that is.

EngagementWhat it solvesWhat you leave with
AI security review$9,000 · 3 weeksWhere untrusted input reaches a model that can call tools, and what an attacker gets by controlling them. Agent permission blast radius, data flow to model providers, tenant isolation, output handling, and whether your human-in-the-loop gate is actually enforceable.Ranked findings, hardened examples, a 90-minute readout
Fractional CISO$3,500/month · 3-month minimumSecurity leadership without the hire. Questionnaire and RFP support, SOC 2 and enterprise-readiness guidance, architecture review before features ship, model-provider risk, policy, and the security voice in your customer conversations. This is advisory work, with no on-call, no attestation signing.Senior security leadership for the decisions that cannot wait
Roadmap sprint$2,500 · 1 weekA week to establish where you actually stand and what to do in what order. The right starting point if you know the AI questions are coming but not what they’ll surface.A prioritized plan your team owns

Every engagement starts with a free 30-minute call. If I’m not the right person, or your sector is one I don’t work in, I’ll say so on that call and point you somewhere better.

How an engagement runs

Four stages, in order. Each one produces something you keep.

  1. Scope

    A call to pin down what you’re protecting, what you suspect is weak, and what “done” means. Fixed scope, written down.

  2. Assess

    I read the architecture, the IAM policies, the network paths, the code that guards them. Findings land as we go, not in a surprise report at the end.

  3. Prioritize

    Findings get ranked and paired with hardened examples, roadmap priorities, or advisory decisions, depending on the offer. You leave with a written answer your team can act on, not just a description of the problem.

  4. Readout

    I walk your team through the result: what’s exposed, what to address first, and the written record you keep. A review ends with a readout; a sprint ends with a roadmap; the retainer continues with decisions and guidance in writing.

How this practice runs

Part-time by design, async-first by default. Set up front so it’s never a surprise mid-engagement.

Availability
Part-time by design. One practice, deliberately not scaled into a team.
Communication
Async-first: findings and updates in writing as they happen, not saved for a standing call.
Response time
You’ll receive a response within one business day and clear updates throughout the engagement.

Tell me what you’re building

A few sentences is plenty. I read every message and reply myself. No sales handoff. You’ll speak directly with the person doing the work.

Rather just email
hello@wannerlabs.com
Response time
Within one business day, from me.
Under NDA
Happy to sign yours before we talk specifics.