Your customers expect their money to be safe.
Regulators expect you to be able to prove it.
We do information security and AI governance for financial services firms — RIAs, broker-dealers, community banks, fintechs, family offices, insurance agencies — that need to satisfy SEC, FINRA, GLBA, 23 NYCRR 500, and the customer security questionnaire all at once. Without turning your team into compliance lawyers.
Three places we usually find people.
Financial services compliance is a moving target — examination priorities shift, AI guidance keeps evolving, customer questionnaires get longer. Most firms walk into our office because of one of these three triggers.
SEC just published the new examination priorities. AI is on the list.
Cybersecurity. Reg S-P. AI use in advice and operations. The exam letter hasn't arrived yet, but the priorities are public and the next pass through your size band is statistically due. You can guess what they'll ask. You'd rather have the answers ready than improvised.
An AI tool entered your practice. Your WSPs didn't get the memo.
An AI-powered research tool. A copilot that drafts client emails. A vendor's "AI-enhanced" suitability analysis. The work is faster — and the Reg BI obligations didn't change just because the tool did. Your written supervisory procedures still describe a process that no longer matches reality.
A customer questionnaire arrived. The answers don't exist yet.
An institutional client. A wholesaler. A fund-of-funds that's diligencing you. Forty pages of "logical access controls" and "incident response runbook" and "SOC 2 Type II report attached." Half of it you can answer. Half is somewhere between aspirational and made-up. The renewal won't wait.
Six concrete pieces of work. Done in plain language.
Compliance vendors love acronyms. Examiners want evidence. Customers want their money where they left it. We translate among all three.
Written Information Security Program (WISP).
The document GLBA, FTC Safeguards, and most state laws expect you to have. Most we see are five years old, written for a different firm, or downloaded from a template site. We write yours so it matches your environment, your vendors, and your size — and so it survives the questions auditors actually ask.
Written Supervisory Procedures (WSPs).
FINRA-required for broker-dealers, expected for many advisors. We update yours to match what your team actually does in 2026 — including AI tool usage, remote work, electronic communications supervision, and any tech that's slipped in since the last revision. The procedures should describe reality, not aspiration.
23 NYCRR 500 (NYDFS) compliance.
If you do business in New York or with New York-regulated firms, this applies. Annual certification, 72-hour incident reporting, MFA, asset inventory, third-party security policy. We map your current state to the requirements, close the gaps, and prepare the certification package the Superintendent expects to see.
Vendor risk & due diligence.
A real inventory of who's touching customer data, what contracts cover it, and what their controls actually look like. Including the AI vendors who showed up after your last vendor review. We get the agreements right, the diligence done annually, and the answers ready before an examiner asks.
Cyber + D&O insurance renewal support.
Answering the questionnaire so the answers earn the renewal — and the premium doesn't double. We've sat in calls with brokers and underwriters in financial services. We know which line items move premium, which create exclusions, and which require a phone call before you sign anything in writing.
Incident response & reportable event playbook.
When something happens, the SEC wants 4-day reporting on material cyber incidents. NYDFS wants 72 hours. State AGs each want their own thing. We've made these calls. We know who to notify in what order, what counts as "material," and how to keep the response from becoming the bigger problem.
Three things you won't get from a generalist IT shop.
We've defended controls in front of SEC and FINRA examiners.
We know which questions come up in a routine exam, which come up in a focused exam, and which signal that something has the staff's attention. We know what evidence holds up and what gets follow-up requests. Most IT vendors have read about regulatory exams. We've sat in the rooms.
We bid against the actual regulatory surface, not the brochure.
An RIA in California has a different surface than a broker-dealer in New York than a fintech with a national charter. State laws stack on federal rules. The work that's actually required varies. We size to your real exposure — not the universal "compliance program" template that everyone in the industry seems to be selling.
We work alongside your compliance officer, not over them.
Your CCO knows your business. We know the technical controls. The best programs come from those two roles working as one team — not from a vendor handing down "the right answer" or a CCO trying to teach themselves SIEM configuration in their spare time. We complement, we don't replace.
The questions financial services leaders actually ask us.
Bring better questions to the readiness call and we'll go further. These are the starters.
Does Reg S-P apply to AI tools we use?+
What's required under 23 NYCRR 500 for a small advisor?+
What's a WISP and why do regulators care?+
We're a small RIA — do we really need SOC 2?+
Our vendor says they're "compliant" — is that enough?+
What does this actually cost?+
Three ways in. Pick what fits.
No qualifying call before the qualifying call. Each path is real, each one's free or fixed-fee, each ends with you having a better answer than you walked in with.
Regulatory readiness call.
Bring your last exam letter, your current WISP, your AI vendor list, your insurance renewal. We'll tell you where the real gaps are between what you have and what an SEC or NYDFS examiner expects to see — and roughly what it'll cost to close them.
Schedule the call →Take the AI Readiness Scorecard.
Especially relevant for financial services right now — the SEC's AI focus is sharpening and the questions are about to start arriving in exam letters. Twelve questions, a real grade, no email gate. Useful to read your starting position before the regulators do.
Start the Scorecard →Read about the Exposure Report.
Same engagement style we'd run for a regulatory pre-assessment, applied to AI exposure. Worth a look if you want to see how we run paid diagnostics — and to gauge fit before the call.
See deliverables →