Independent risk institute / Victoria, BC
We tell leaders what’s really going on.
Cyber risk, AI, and the pressure coming at your business from outside. We find out where you stand and write down what to do about it.
Who it's for
Boards, executives and governments who have to decide before events decide for them.
What we do
Three things: risk advisory, AI safety, and research. Judgement in writing, not a slide deck.
What we don't
Build. We work where the decisions get made. Our sister company, Graphite & Moss, does the engineering.
Tell us what’s keeping you up. We’ll reply in writing with what we’d look at first.
Our practice
Three things we do.
Every engagement ends the same way: a short written account of where you stand, what it could cost, and what to do next, in the order to do it. We don’t build. We tell you what to build, and we watch that it gets built.
- 01
Risk advisory
For boards, executives and governments
Where you really stand, what it could cost, and what to do next. Written for the people who decide.
Read about Risk advisory - 02
AI safety
For organizations adopting or building AI
Before AI is everywhere in your business, we test it. You find out what it does under pressure, not what the vendor promised.
Read about AI safety - 03
Research
Behind both practices
We watch the ground under the other two: what's moving, who's moving it, and what it means for you. Most of it isn't published. Some is.
Read about Research
Who calls us
Three stories we hear a lot.
Different jobs, same shape: someone at the top who can’t see the whole picture, and a decision that won’t wait until they can.
- 01
The executive with five regulators
- The situation
- You run a company in five countries. Each one has its own rules on data, AI and security, and they change every quarter.
- The problem
- Nobody in the building can draw the whole picture. Each team sees its corner. The board asks “are we fine?” and gets five different answers.
- What we do
- We draw the picture. One map of where you stand against every rule that applies to you, what it costs to be wrong, and a roadmap in the order it should happen.
- 02
The service that isn’t only used by people
- The situation
- Your product has millions of users. A growing share of them aren’t people. Fake accounts, bot farms, coordinated campaigns, and now AI doing the pushing.
- The problem
- Your trust and safety team is winning every battle. You can’t tell the board whether you’re winning the war, because nobody knows what’s really behind it.
- What we do
- We find out. What’s hitting you, from where, how it’s organized and what it wants. Then what to do about it that you can afford to keep doing.
- 03
The board member who wants the truth
- The situation
- You sit on the audit committee, or you’ve just written a cheque. The security report is green. It has been green for three years.
- The problem
- You have no way to tell whether green means safe or means nobody looked. Asking the people who wrote the report doesn’t help.
- What we do
- We look. An independent read of the real state of security, in plain words, with the evidence, and what we’d do first. You’ll know whether green is true.
How we work
We work at the top of the pyramid.
Every organization runs on three levels. Most consultancies sell all three and are honest about none. We do the top, help with the middle, and name who does the rest.
- 01
Decide
Where we work
Where are we, and where should we go? State analysis, risk surfaces, roadmaps. The judgement a board or a minister needs before committing money and people.
Us
- 02
Deliver
Where we help
How do we get there predictably? Program and project oversight, the order of operations, and an honest read on whether the plan is working.
Us, with your team
- 03
Build
Where we don’t
Engineers, developers and creatives making the fixes real. We don’t do it, and we don’t pretend to. Our sister company, Graphite & Moss, does.
Graphite & Moss
Track record
Our team has worked on projects like these.
Most of our team comes from Microsoft, and we’ve kept big, busy systems safe. That’s how we know which risks are real, which fixes actually work, and what holds up when an attacker or an auditor comes knocking.
- 01
Microsoft
Where most of our team comes from: keeping Microsoft's products and its customers' data secure
- 02
Major events
Owning cybersecurity for ticketing, hospitality and logistics at the Paris 2024 Olympic & Paralympic Games
- 03
Mobile
Helping launch the iPhone at AT&T
- 04
Internet services
Owning cybersecurity for very large internet services — dating, sports and more
- 05
Critical systems
Voting systems, the internet backbone and cloud security
Before you ask
What leaders tell us before they call.
- “We already have a CISO.”
- Good. We’re not replacing them. We give the board an independent read, and most CISOs welcome it: it usually gets them the budget they’ve been asking for.
- “We’ve done a risk assessment.”
- Then you have a list. We give you the picture: what the risks do to each other, what they cost, and which three moves change the most.
- “We don’t know what this would cost.”
- You get a written plan and a quote before any work starts. If you don’t need us, we’ll say so.
Research
What we’re watching.
Most of our research stays with the clients it was done for. This is the part we publish.
- Governance & risk
WordPress Survival Time
How long does an unattended WordPress site last on the modern web? Minutes to be found, months to be noticed — and survival is a property of operations, not software.
- Governance & risk
Canvas LMS Breach: What Educational Institutions Should Do Now
The May 2026 Canvas breach exposed 275 million users across 8,800+ institutions. Here's what happened, immediate steps to take, and how to build long-term resilience.
- Governance & risk
Why Your AI Needs Governance Before It Needs Features
Most organizations rush to deploy AI capabilities without governance frameworks. Here's why that's a costly mistake and how ISO 42001 provides a structured path forward.
Start here
Not sure where you stand? Let's find out.
Tell us what the board is asking, what the regulator wants, or what's hitting your service. Or just the feeling that the green dashboard isn't telling you everything. We'll tell you plainly what we'd look at first.
We’ll reply in writing: what we’d look at first, and a quote.
