Section · V

How to engage.

The firm’s engagement shapes, and the path through them.

The deliberate path, and the urgent incident remediation path.

i.Deliberate path

Four stages, first call to closing review. Pre-defined shapes are listed under stage one. For engagements that are already incidents in progress, the urgent incident remediation path follows.

  1. 00 Stage zero

    Initial conversation. Free, around 35 minutes.

    An exploratory call to understand the situation, the question on the table, and the shape the engagement should take.

    If the help you need is somewhere else, we’ll point you there. Either way, you leave the call with a clearer sense of what to do next.

  2. 01 Stage one

    Defining the engagement.

    When we agree to proceed, we set the shape of the engagement in writing: the question, the scope, the people we’ll need access to, the materials we’ll need to read, the timeline, the deliverable, and the fee.

    Named shapes sit alongside bespoke briefs.

    • Codebase and infrastructure security & health assessment. A principal security and structural read of the codebase and supporting infrastructure, with gap analysis. The written assessment names what is at risk, what is structural, what is cosmetic, what is contained, and what is spreading, plus the CI guardrails worth putting in place.
    • Cost trajectory and lock-in model. Not a forecast. The model plays the possibilities out across the knowns: token, vendor, and infrastructure cost paths under different scaling and pricing scenarios. Lock-in implications named explicitly.
    • AI governance readiness assessment. A fast-moving area: no single framework was designed for agentic AI, and the standards bodies are still catching up. The assessment maps the organisation’s posture across the layered stack that, together, does cover it (ISO 42001, APRA CPS 230 where regulated, OWASP Top 10 for Agentic Applications, Singapore IMDA’s agentic governance model, NIST AI RMF, EU AI Act where applicable). Findings, gaps, named owners per layer; revisited as the standards bodies catch up.
    • Programme oversight engagement (long term). A standing observer across the life of a major AI programme. Quarterly written reviews, scoped per programme. The firm stays engaged across the consequences arc, seeing the impact through and mitigating consequences as they emerge.
    • Team training & education. Workshops and sustained programmes for teams adopting AI-era tooling. The disciplines that make the work safe at scale (scope, review, guardrails); the patterns that cost teams when they’re missed; the practices that turn velocity into team capability rather than dependence.
    • Controlled (re)implementation. Implementing an AI capability, or rebuilding one that was implemented without them, with the right controls, governance, and safeguards in place from the start. Scoped per capability, delivered with the Co when the brief calls for hands.

    Remediation engagements begin with a focused assessment phase scoped the same way, with subsequent remediation phases scoped after the assessment is complete.

  3. 02 Stage two

    The work.

    For a pre-decision engagement, the deliverable is a written assessment (findings, named risks, a clear recommendation, the reasoning behind it) and the working sessions to make sure the people who need to act on it understand it. If the brief extends into shaping or delivering the strategy, the Co engages as it does in remediation.

    For a remediation engagement, the deliverable is the assessment first, followed by sequenced remediation phases each scoped, agreed, and delivered as discrete pieces of work with the Co engaged as the brief requires.

  4. 03 Stage three

    Review and what’s next.

    Every engagement has an explicit review point.

    For a pre-decision engagement, the review is a follow-up conversation, after the deliverable has had time to land, about how the recommendation has been received and whether further work is warranted.

    For a remediation engagement, each phase ends with a review of what was done, what changed, and whether the next phase should proceed as planned, be revised, or stop.

ii.Urgent incident remediation path

When the engagement is an incident.

If something has already gone wrong (a security incident, a near-miss, an audit observation requiring response, or a production system behaving in ways no one fully understands) the deliberate path above does not apply. The first call is a triage, not an exploration, and the work begins immediately.

In an incident engagement:

  • Call Ryan directly on +61 418 186 604, or email [email protected] with the word incident or urgent in the subject line. We respond outside business hours when the severity warrants it.
  • The first session is a triage call with the principals and the Co operators relevant to the situation. We agree what is in front of you, what is contained, what is spreading, what is reportable, and what should happen in the next twenty-four hours.
  • The engagement is scoped by day or by phase rather than by deliverable, until the situation is stable enough to revert to the deliberate model. Commercial terms are agreed in writing before the work continues past the triage.
  • A post-incident assessment follows the immediate response: findings, named risks, and recommendations on what should change so the same situation does not recur. This commonly transitions into a remediation engagement scoped under the deliberate path above.

Talk to us