Services
Everything you need to pass enterprise reviews.
Everything a growing AI or SaaS company needs to pass enterprise security and AI reviews: AI assurance, security certifications, questionnaires and testing, delivered by Lead Auditors.
What we do
Pick what the buyer asked for
For companies selling AI to enterprise
We find where your AI touches customer data, close the gaps and get you to a clean result, so the AI section of a security review stops stalling deals. From a first inventory of the AI you use to testing it and the evidence buyers ask for.
ISO 42001AIUC-1EU AI ActNIST AI RMF
What is included
AI governance and compliance
- ISO 42001 (AI management system) readiness and audit coordination
- AIUC-1 readiness for AI agents
- EU AI Act obligations mapping (GPAI, transparency, high-risk)
- NIST AI RMF alignment
- AI inventory and shadow AI discovery: the models, vendors, agents and tools in use, including ones nobody approved
- AI policy review and development: acceptable use, data handling and ownership
- AI security program development: roles, processes and controls
Secure AI adoption
- AI readiness assessment: where AI is used today, which controls exist and what is missing before you scale
- AI vendor and model provider reviews
- AI sovereignty: where your data and models run, and who can reach them
- Executive advisory on AI risk and priorities
AI testing and red teaming
- AI threat testing and red teaming (prompt injection, data leakage)
- AI application assessments: AI-enabled products tested for weaknesses, data exposure and control gaps
- Agentic AI assessments: what agents can access, which tools and integrations they use, and where they could act without approval
Build it securely
- AI threat modeling during design
- Secure development guidance for AI features: security requirements and reviews
- AI supply chain review: the models, packages, plugins and tools your AI depends on
Training and expert support
- AI security training for your team: risks, responsible use and protecting sensitive data
- Ongoing access to AI security specialists for decisions as they come up
How an AI engagement runs
- 1
Discover
Take stock of the AI you use: models, vendors, agents, tools and the data they touch.
- 2
Assess
Find the gaps and rank them by risk, so the most important ones are fixed first.
- 3
Govern
Put policies, owners and controls in place that people can actually follow.
- 4
Test
Try to break it the way an attacker or a careful buyer would, then fix what turns up.
- 5
Keep current
Hand buyers and auditors current evidence, and keep it fresh with Meru.
The reports enterprise buyers ask for
Done-for-you readiness for the reports enterprise buyers ask for. The report itself comes from an independent auditor.
SOC 2ISO 27001HIPAAHITRUSTPCI DSSCSA STARFedRAMP
What is included
- Artificial Intelligence (ISO 42001)
- ISO Compliance (ISO 27001, 27017, 22301)
- Privacy (ISO 27018 and 27701)
- Business Continuity & Disaster Recovery (ISO 22301)
- Quality Management (ISO 9001)
- PCI Compliance (PCI DSS)
- HITRUST & HIPAA
- Cloud Security (CSA STAR Level 1 and Level 2)
- Government (FedRAMP, NIST)
- SOC Compliance (SOC 1, SOC 2, SOC 3)
- Consolidated Assessments (for example, multiple frameworks)
Answers for the buyer's security team
Answer the buyer's security team in days: security questionnaires (SIG, SIG Lite, CAIQ or their own), penetration tests and AI threat testing, with evidence they accept.
SIGSIG LiteCAIQPen test
What is included
- Security Questionnaires (SIG, SIG Lite, CAIQ)
- Artificial Intelligence Threat Testing
- Vulnerability Management
- Penetration Testing
- Cloud Penetration Testing
- Adversary Simulation
- Social Engineering
A security leader before you hire one
Risk assessments, vendor risk, business continuity and fractional CISO support for teams that need a security leader before they hire one.
What is included
- Business Continuity Planning and Testing
- Disaster Recovery Planning and Testing
- Business Impact Analysis
- Privacy Impact Analysis
- Artificial Intelligence Analysis
- Third-party and Vendor Risk Management
- Enterprise Risk Management
- Fractional CISO Services and Support
Resilience and Recovery Workshop
Our Resilience and Recovery Workshop provides key insights into defining recovery obligations and ensuring business continuity during incidents. We focus on impact analysis, continuity planning, disaster recovery, and third-party risk management.
What is included
- BCP and DRP program development
- BIA
- ISO 22301
- BCP and DRP Tabletop Testing
Why teams choose Kailash
You sign off. We do the work.
Lead Auditors do the work
Experienced auditors scope, design and prepare it. Your team signs off.
Fast, scoped engagements
A clear scope up front, so you know what is being done and by when.
Independent auditor reports
The report or certificate comes from an independent auditor, which is what buyers trust.
Meru keeps you ready
Our platform keeps controls and evidence current after the engagement ends.
Questions
Before you book a call
Do you issue the report or certificate?
No. An independent auditor or certification body issues it. We prepare you, coordinate the audit and keep the evidence ready.
How fast can we get SOC 2 ready?
A scoped SOC 2 readiness takes about 15 days. The exact timeline depends on your scope.
Who does the work?
Our Lead Auditors do the work and your team signs off.
Can you cover more than one framework?
Yes. We map one set of controls to several frameworks, so work done for one is reused for the next. Consolidated assessments are part of the offer.
Do I need Meru?
No. Use Meru on its own, or let the Kailash team do the work while Meru keeps it current.
What does it cost?
It depends on scope. Book a 20-minute call, tell us what the buyer asked for, and we will map the fastest path and what it involves.
Is a security review holding up a deal?
Book a free 20-minute call. Tell us what the buyer asked for and we will map the fastest path to a clean answer.