These anonymised notes are qualitative. They show the operating problem, the decision that changed and the evidence teams kept.
What these are, and what they are not
Every note below is behaviour-change work: helping people act on a real incident. That capability is now included with paid ACP rather than sold as a separate course, which is why these read as operating lessons rather than product proof. They are not AI-governance case studies, and they are not the evidence behind the AI Data Leakage Risk Assessment, which is produced from your own organisation. Current evidence is on the evidence page.
No heroic transformation claims. Just the practical work of giving decisions owners, controls and an evidence trail.
A qualitative account of turning a difficult, multi-site response requirement into a repeatable operating process.
A qualitative account of helping clinical and support teams act on lessons from a disruptive ransomware event.
How an insurance team connected a supplier incident to the people who approve, manage and use third-party services.
A qualitative account of moving from annual awareness activity to accountable action after a real credential compromise.
How a near-miss helped security and engineering teams make safe access practical in an operational environment.
How a growing software company added consistent classification, ownership and follow-through to everyday security events.
Ten questions expose where AI use, sensitive data and accountable evidence are drifting apart.
Check Your AI Exposure