About

Security operator. Not a policy shop.

Waterline Security is led by Linton Harris. Most AI governance advice comes from policy and audit. Ours comes from running security operations — a 20-analyst, 24/7 SOC, enterprise customers, real incidents.

Background

20 years in the field

Linton most recently managed a 20-analyst, 24/7 AI and agentic managed detection and response SOC serving enterprise customers. That work meant tracking AI tools employees were using, reviewing vendor AI features, and responding when agents exceeded their intended permissions — the same problems Waterline Security now helps clients get ahead of.

His background spans SOC leadership, governance and compliance programs (SOC 2 Type II, CMMC, NIST 800-171, FedRAMP, ISO 27001, HIPAA, HITRUST), and work in healthcare, FDA-regulated MedTech, biotech, and legal-tech — industries where an unapproved AI tool is a compliance problem, not just a policy gap.

He spent two years at Deloitte.

[email protected]LinkedIn

Certifications

CISSPCertified Information Systems Security Professional

CCISOCertified Chief Information Security Officer

CISMCertified Information Security Manager

CCSPCertified Cloud Security Professional

CISACertified Information Systems Auditor

CDPSECertified Data Privacy Solutions Engineer

AWS Security SpecialtyAWS Certified Security – Specialty

AZ-500Microsoft Azure Security Engineer Associate

M.S. Cyber SecurityMaster of Science in Cyber Security

How we work

Four principles that shape every engagement

Visibility first

You can’t secure what you can’t see. Every engagement starts with an honest inventory of the AI in use — approved, unapproved, and embedded in software you already own.

Plain answers

We tell you what we found and what to do about it, without hype or fear. The deliverable is a clear picture and a ranked action list, not a 200-page report that sits on a shelf.

Practical controls

We recommend what your team can carry out and maintain. A control that requires a dedicated engineer to run is not a control — it’s a future gap.

Operator’s judgment

Our advice comes from running a 24/7 SOC — tracking shadow AI, reviewing vendor AI features, and responding when agents exceeded their permissions. That’s the experience behind every recommendation.

Frameworks

Mapped to recognized standards

Every engagement maps findings and recommendations to the frameworks your auditors, board, and regulators already know.

NIST AI RMFThe NIST AI Risk Management Framework — the primary US federal reference for AI risk.

ISO/IEC 42001The international standard for AI management systems.

EU AI ActObligations for high-risk AI systems apply from December 2, 2027.

OWASP Top 10 for LLM ApplicationsThe leading reference for LLM-specific application security risks.

MITRE ATLASAdversarial threat landscape for AI systems — tactics and techniques used against ML models.

Book a 30-minute AI exposure review

A free call for security leaders. You leave with a clearer view of your AI exposure, whether or not you hire us.

Get in touch