AI Governance & Security
AI is already inside your organization. The question is whether anyone is governing it.
AI is in tools your teams adopted on their own, in the platforms you buy, and in decisions now being made faster than your controls can follow. Apogee helps boards and executives put defensible AI governance in place, so they can adopt AI at speed without trading away security or trust.
The work is a structured risk assessment. We start from the AI already running in your business rather than a theoretical target state, because the exposure that matters is the exposure you carry today.
Our point of view
A risk discipline, not a technology project
AI exposure belongs on the enterprise risk register with a named owner. An unowned risk is an accepted risk.
Oversight now has to be documented
The duty of care has shifted from awareness to documented oversight. A missing record is increasingly the basis of a claim.
Agents inherit whatever access you give them
Identity-first design, tiered guardrails, runtime authorization, and audit trails come before agentic AI goes live.
Governance lets you move fast
Clear risk tiers and sanctioned tools let most AI use proceed without a committee, and focus scrutiny where it matters.
One AI failure travels a consequence chain
A deepfake call impersonating an executive is a cyber event that becomes a financial loss and a human trust failure. We assess AI risk across all three, not as a technology issue alone.
What we deliver
Six workstreams, scoped at the briefing to the AI you actually use. Every engagement delivers clear findings, prioritized risk levels, and a practical roadmap your teams can execute.
Governance framework
A board-approved AI policy, an AI governance council, and an operating model with decision rights and accountable owners, using NIST AI RMF and ISO/IEC 42001 as reference frameworks.
Inventory and risk tiering
Discovery of shadow AI and AI embedded in vendor platforms, then impact tiering so low-risk use moves fast and scrutiny concentrates on high-impact use.
AI security and agentic risk
Assessment of prompt injection, tool misuse, privilege escalation, and data leakage, plus identity readiness, runtime authorization, and audit trails before agents go live.
Board and executive oversight
Committee charters, reporting cadence and metrics, disclosure readiness, and a review of how D&O and cyber coverage may respond to an AI-related loss.
Third-party AI risk
Vendor diligence and recommended contract terms: no training on your data, notice of model changes, data deletion, and audit rights.
Regulatory alignment
Mapping of AI use to the obligations that apply in your jurisdictions and sector, such as the EU AI Act, state AI laws, or federal agency guidance, where they apply. Alignment is assessed, not promised.
Five questions every board should be able to answer
- InventoryWhat AI is in use, by whom, and on what data?
- ImpactWhich automated decisions touch people or regulated outcomes?
- OwnershipWho approves new AI use, and how often does the board see it?
- VendorsWhich third parties supply AI, and what do our contracts allow?
- CoverageDoes our D&O and cyber insurance respond to an AI loss?
NIST AI RMF Alignment
Apogee uses NIST AI RMF as a reference for assessing AI risk and designing governance around the organization's use of AI. The engagement documents gaps, prioritizes actions, and establishes accountable roles, policies, and reporting. Scope is agreed at the briefing; alignment is not a certification.
ISO/IEC 42001 Readiness
Readiness work applies Apogee's assessment and governance-design approach to the organization's AI management practices, using ISO/IEC 42001 as the reference. The work identifies gaps and prepares a prioritized roadmap, ownership, and evidence for independent review. Apogee prepares and governs; an independent party conducts any certification assessment.
How we engage
Assessments run on Apogee Vanguard, our GRC platform, delivered by senior practitioners who have built the programs they advise on.
Apogee Ascend
AI governance as a standalone entry engagement.
Apogee Meridian
AI governance as a core workstream within a broader risk program.
Apogee Zenith
AI governance fully integrated with ongoing board reporting.
In the field
M.K. Palmore speaks on AI risk, governance, and executive accountability, including the AI Risk & Governance track at InfoSec World 2026 and a plenary keynote at the NICE Conference 2026. Apogee also delivers executive AI governance briefings and curricula for higher education and law enforcement leaders.
Founder speakingAdvisory boundaries
Apogee provides risk assessment and governance advisory services. We do not certify AI systems, provide legal advice, or determine insurance coverage. Regulatory alignment is assessed against the obligations that apply to your jurisdictions and sector, in coordination with your counsel; coverage review findings should be confirmed with your broker and carrier. Your AI inventory, findings, and exposures are handled with complete discretion.
Request an executive AI governance briefing
A Risk Briefing is forty-five minutes with a senior practitioner. You leave with a straight answer on the fastest path forward, whether or not it runs through us.
Request a Risk Briefing