Staff paste documents into ChatGPT. Developers hardcode API keys into repositories. Systems call AI endpoints no one approved. The data leaving your organisation right now may already be in breach of PDPA, SOC 2, ISO 27001, GDPR, or ISO 42001, and you would not know until it became a problem.
Counterintelligence for Artificial Intelligence
Counterintelligence finds where information leaks to adversaries. CI4AI finds where company data leaks to external AI systems. It is a narrow, named category, not generic cybersecurity, not generic AI consulting.
For companies with an engineering team and a repository.
For companies without a dev team, where the exposure is staff behavior.
Most companies are a mix of both. Engagement starts with a short call to determine which applies.
The Offer
USD 5,000 flat fee: one diagnostic scan engagement (Codebase Profile, Network Profile, or both, as determined at kickoff).
Deliverable: a findings report on AI-related data leakage, mapped against applicable compliance frameworks.
Money-back guarantee: if the scan finds nothing worth acting on, full USD 5,000 refund, no questions asked.
Phase 1 findings are the basis for optional Phase 2 (continuous monitoring) and Phase 3 (remediation and governance) engagements.
What we require
For a Codebase engagement
- Scoped, temporary read access to the source repository, environment config files, and deployment/CI pipeline definitions
- A short kickoff call to understand the stack
- A signed short-form engagement agreement
For a Network engagement
- A Linux server or gateway where the monitoring script can be placed and run for the observation window
- A point of contact for access
- A signed short-form engagement agreement
The signed agreement governs scope, confidentiality, and the refund condition. Findings are CI4AI's work product and are formally delivered to the client under the terms of that agreement.
What Phase 1 surfaces, and what it does not
- Phase 1 (Codebase or Network) is a preliminary scan: enough to determine whether real exposure exists, not an exhaustive inventory of every possible gap.
- It produces evidence of exposure, not a full remediation plan.
- Phase 2 (continuous monitoring, deeper access) surfaces materially more detail and maps each finding to specific controls under PDPA, SOC 2, ISO 27001, GDPR, ISO 42001, and PCI DSS.
- Phase 3 covers remediation, policy enforcement, and an ongoing compliance posture dashboard.
| Phase 1 | Phase 2 | Phase 3 |
|---|---|---|
| Preliminary scan: Codebase and/or Network profile | Continuous monitoring over a defined period | Remediation and policy enforcement |
| Evidence that AI-related exposure exists | Findings mapped to specific framework controls | Staff AI usage policy |
| Encrypted findings report | Compliance mapping: PDPA, SOC 2, ISO 27001, GDPR, ISO 42001, PCI DSS | Ongoing compliance posture dashboard and re-scan cadence |
Start with a conversation
No commitment required. A short call to understand your setup and determine which profile applies; that is how every engagement begins.