Tools employees bring in
Chat assistants, writing tools, and browser extensions used with personal accounts, often with company data pasted in.
US workers using unapproved AI: 67%, the highest of seven countries surveyed (Okta, 2026)
The risk you can't see
Most AI risk sits where no one has looked yet
AI arrives in three ways, and most security teams only track the first.
AI inside software you already own
Vendors switch on AI features in products that passed your security review before those features existed.
Ask: which of your approved vendors now send your data to an AI model?
Agents connected to your systems
Teams give AI agents access to mail, files, tickets, and code. Agents act with whatever permissions they're handed.
53% of organizations have had AI agents exceed their intended permissions (Cloud Security Alliance, 2026)
Services
Fixed scope, fixed price, senior work
Each engagement has a defined set of deliverables and a price agreed before work starts. Buy one, or all three in sequence.
See
AI Risk Assessment
A full picture of the AI in use across your company and the risk it carries, ranked so you know what to fix first.
- Inventory of AI tools, including unapproved ones and AI features inside existing vendors
- Review of what data reaches AI services, and how
- Vendor and model risk review
- Findings ranked by risk, with a 90-day remediation plan
Govern
AI Acceptable Use Policy
A policy written for the tools and data your company actually has, that employees can read and follow.
- Acceptable use policy
- A one-page summary for employees
- An approved-tools list and a process to request new ones
Govern
AI Governance Setup
The structure that keeps AI use under control after the assessment ends.
- Roles and accountability for AI decisions
- An intake and approval process for new AI use cases
- An AI risk register and a review cadence
- Mapped to NIST AI RMF and ISO/IEC 42001
Govern, ongoing
AI Governance Advisory
A monthly retainer that keeps the program current as your company adopts new AI.
- Monthly risk register review
- Review and approval of new AI use cases
- Policy updates as tools and rules change
- Quarterly report to leadership
Foundation bundle: Foundation bundle: all three engagements, delivered in sequence over 8 to 10 weeks.Pricing: Pricing: a fixed quote after a 30-minute call.
Secure · coming next
Monitoring and guardrails
Ongoing monitoring of AI use and technical controls on prompts, outputs, data, and agent actions. Every assessment is built so its findings feed directly into this work.
Approach
See it. Govern it. Secure it.
Our mission is to help organizations see, govern, and secure the AI they depend on. Every engagement follows that order.
See
Start with an honest inventory
Interviews, tool and network data, and vendor reviews show what AI is in use and where your data goes.
Govern
Set rules people can follow
Policy, ownership, and an approval process sized to your company, not copied from a template.
Secure
Keep it under control
Controls and monitoring that keep pace as new tools and agents arrive.
Mapped to recognized frameworks
NIST AI RMFISO/IEC 42001EU AI ActOWASP Top 10 for LLM ApplicationsMITRE ATLAS
EU AI Act obligations for high-risk AI systems now apply from December 2, 2027 (Orrick). Companies with EU customers or staff have about a year to prepare.
Who we work with
Security teams in regulated, mid-sized companies
Companies of roughly 200 to 2,000 people: large enough to have AI spreading across teams, too lean for a months-long consulting program.
Healthcare and life sciences
Patient data, HIPAA, and FDA-regulated products make an unapproved AI tool a compliance problem, not just a policy gap.
Legal and professional services
Client confidentiality depends on knowing which AI tools see client documents.
The person who buys
CISOs, security directors, and IT security leads, working with compliance, privacy, and legal.
About
Waterline Security is led by Linton Harris, a security operator with about 20 years in the field.
Most AI governance advice comes from policy and audit. Ours comes from running security operations.
Linton most recently managed a 20-analyst, 24/7 AI and agentic managed detection and response SOC serving enterprise customers. His background spans SOC leadership, governance and compliance programs (SOC 2 Type II, CMMC, NIST 800-171, FedRAMP, ISO 27001, HIPAA, HITRUST), and work in healthcare, FDA-regulated MedTech, biotech, and legal-tech. He spent two years at Deloitte and teaches as an adjunct professor at St. Petersburg College.
CISSPCCISOCISMCCSPCISACDPSEAWS Security SpecialtyAZ-500M.S. Cyber Security
How we work
Visibility firstYou can’t secure what you can’t see. Every engagement starts with an honest inventory.
Plain answersWe tell you what we found and what to do about it, without hype or fear.
Practical controlsWe recommend what your team can carry out and maintain.
Operator’s judgmentOur advice comes from running security operations, not just writing about them.
Get started
Book a 30-minute AI exposure review
A free call for security leaders. You leave with a clearer view of your AI exposure, whether or not you hire us.
- Which AI tools are your employees using today?
- Which of your vendors have added AI features?
- What company data could reach an AI service?
- Who approves a new AI tool or agent?
- What would you tell your board if asked tomorrow?