VIGILIAvih-JIL-ee-ah
AI Security Monitoring
The vigiles were Rome’s night watch: they walked the streets so trouble was caught early. Monitoring does that for AI: a regular round of your tools, your settings, and your systems.
A monthly check on new AI tools, new exposure, and your AI systems, as both keep changing.
A monthly fee set by the number of tools, staff, and AI systems in scope, quoted in writing. Starts after a shadow AI review or a red-team assessment.
Is this for you?
- Companies after a shadow AI review that want new AI tools caught as they appear
- Teams shipping AI features often, which need retesting as prompts and models change
- Leaders who want a monthly AI security line in their reporting
The problem
AI changes every month. So does your exposure.
New AI tools appear, vendors change their terms, settings drift, and your own AI systems change with every new prompt or model. A review or a test is a snapshot.
How we work
A regular round, from a known baseline.
Starting from your shadow AI review or red-team report, we check each month for new AI tools and features, changed vendor terms, and drift in your controls. AI systems you build get a focused retest each quarter or after a major change.
A monthly report of two pages or fewer says what changed, what we found, and what to fix.
What gets watched
Typical monthly checks.
Set in the agreement for each client.
- Tools
New AI tools
From the sources agreed in your review.
- Features
New AI features
Switched on inside software you already use.
- Vendors
Changed terms
Retention and training terms for tools in use.
- Controls
Setting drift
Policy controls checked against the record.
- Built AI
Quarterly retests
Focused retests of the AI systems you build.
What you receive
New tool watch
New AI tools and AI features in use, found each month from the sources agreed in the review.
Control drift checks
The policy’s controls checked monthly, so a changed setting is caught.
Quarterly retests
For AI systems you build, a focused retest each quarter or after a major change.
A monthly report
What changed, what was found, and what to fix, in two pages or fewer.
How it works
Baseline
Start from your shadow AI review or red-team report.
Watch
Monthly checks of tools, settings, and vendor terms.
Retest
Quarterly retests of the AI systems in scope.
Report
A monthly report, and a call when something needs a decision.
What the agreement sets out
A schedule you can check.
Commitments in the monthly agreement.
- Monthly checks
- Run on schedule against the baseline.
- Quarterly retests
- For AI systems in scope.
- Monthly report
- Within five business days of month end.
Common concerns
What leaders ask before they sign.
- Not real-time
- A scheduled review, not 24/7 detection or incident response.
- Baseline first
- Starts after a shadow AI review or red-team assessment.
Who does what
Who authorizes, who tests, and who fixes.
Your team
- Keep access current
- Act on findings
- Tell us about major changes
Custos
- Run monthly checks
- Retest AI systems quarterly
- Report and advise
Afterward
Where clients go next.
Most take one of these routes. You choose, and nothing starts without your approval.
Re-baseline
After major change, a fresh review or assessment resets the baseline.
Before you start
What to have ready.
- Your baseline report
- Access for the agreed checks
- Your release calendar for AI systems
Related services
What the agreement sets out
Scope, checks, and reporting, in writing.
- The tools, staff, and AI systems in scope are listed in the agreement.
- Monthly checks and quarterly retests follow the agreed schedule.
- The monthly report arrives within five business days of month end.
- Monthly, with 30 days’ notice to end.
Ask about monitoring
Tell us what you want watched.
We reply with a quoted monthly scope, based on your baseline review or assessment.
- An engineer reads every request
- A reply by email within two business days of receipt
- No obligation until scope and price are agreed
Not ready to scope this? Ask a security engineer first: a free 20-minute call on where your AI risk is.
Where this fits
- Check Shadow AI check
- Review Shadow AI Review
- Control AI Policy & Controls
- Monitor AI Security Monitoring
Not ready yet? Shadow AI Review. After this: AI Red-Team Assessment.
Questions
Can we start with monitoring?
Monitoring needs a baseline, so it starts after a shadow AI review or a red-team assessment.
Is this a 24/7 security operations service?
No. It is a scheduled monthly review. Real-time detection and incident response are separate services.