A scoped consultancy engagement
External Exposure Assessment
Understand an AI system’s external exposure and decide what to address first.
EnquireIllustrative example
An AI-enabled portal is about to reach more customers.
A constructed scenario, not a client engagement or a promised result.
A business is extending access to a customer portal that uses an AI service. The decision owner needs a current view of its agreed public hosts and the exposures that need further validation.
- The decision
- What needs verification or action before wider access, and which questions require a deeper assessment?
- How the advice helps
- Review the authorised targets and methods, validate material observations and connect each priority to dated evidence, a responsible owner and a next verification.
- The business benefit to test
- Direct attention towards observed issues and unresolved questions, rather than treating every automated alert as an established weakness.
- What the example does not establish
- A publicly reachable service is not automatically vulnerable. This bounded review cannot establish that the system is secure or verify its internal controls.
What happens after the review
Risk reduction depends on the actions your organisation takes and the evidence used to verify them. The review records coverage, confidence and unanswered questions. Your technical team or chosen provider carries out remediation.
The decision
Which observed exposures require action, what remains unverified and who should act?
Who it is for
Business leaders and technology owners reviewing an AI system and its publicly reachable dependencies.
When it helps
An AI investment, rollout or change needs evidence about external exposure before approval.
What the scope covers
A bounded review within AI Risk & Impact Assessment: one legal entity, one primary domain and up to five agreed public hosts supporting a defined AI system. Authorised Domain Name System (DNS), email, Transport Layer Security (TLS), ports 80/443 and bounded public-page checks only.
What we need from you
- Written authority from the appropriate asset owner for the exact targets and methods
- Agreed asset inventory, exclusions, collection window and stop conditions
- Business context and a named technical contact
What needs a separate scope
Exploitation, a full penetration test, authenticated or internal-system testing, assurance of internal controls, certification and proof that a system is secure. The Institute does not carry out remediation.
Agree the work before it begins.
We confirm the fee, VAT treatment, delivery window, reviewer, client responsibilities and acceptance criteria in writing. Small assessments are paid upfront. Larger engagements use agreed payment stages.
Commencement depends on the agreed payment or credit arrangement, required inputs, permissions and confirmed capacity. Where existing research is relevant, we verify and tailor it to your engagement.
A sensible next step
A prioritised brief for your team or chosen remediation partner, with independent advice on the evidence needed to close the findings.
Enquire