Axiomeer is a boutique advisory, and intends to remain one. The work is led personally, the engagements are limited deliberately, and the standard is the one we would want applied to us.
I spent a decade building and running the security platforms that large organisations — and their customers — depend on. Detection and response at enterprise scale. Managed security serving dozens of enterprise clients across two continents. Most recently, the governance and engineering of AI inside security operations themselves.
Axiomeer exists because that experience is difficult to buy at mid-market scale. The firms who have it are structured to sell six-figure programmes; the firms who will take a smaller engagement usually staff it junior, or are managed service providers with something to sell you at the end of the assessment.
My advantage is not a framework — frameworks are public. It is having operated the systems I now assess. I know what a cyber-insurer's security questionnaire is really testing, because I helped build the platform behind one. I know where AI deployments break in practice, because I have built agentic systems and then had to govern them.
CISSP — (ISC)²
ISC2 — Securing AI: Cybersecurity Strategy
NIST AI Risk Management Framework
OWASP LLM Top 10 · MITRE ATLAS · MITRE ATT&CK
SOC 2 · HIPAA · ISO/IEC 42001 (referenced)
NIST SP 800-171 · CMMC Level 2 readiness
The person on your first call is the person conducting the interviews, writing the findings, and standing in front of your board. Nothing is delegated downward, because there is no downward.
No third-party licences, no reseller margins, no referral fees. When we recommend a control or a vendor, there is no revenue on the other side of the recommendation. Our own monitoring service is the single thing we offer — priced openly and cancellable at will.
We take on a small number of engagements at a time so each receives genuine attention. If the timing does not work, we will say so and suggest when to come back.
Headquartered in Dallas–Fort Worth, where on-site work is routine, and delivered remotely everywhere else — across the United States and internationally. There is no office network, and that is the point: clients engage a boutique precisely because the senior person is the one who shows up.
The home market, and where on-site work is routine: kickoffs, workshops, and board readouts across Dallas, Fort Worth, Plano, Frisco, and Irving — health-tech, fintech, logistics, and the aerospace and defence supply chain.
Coast to coast, in your time zone. Tenant reviews, stakeholder interviews, and executive readouts are delivered over video without loss of rigour — and most clients prefer it to hosting a consultant for three weeks.
Organisations outside the United States facing the EU AI Act, ISO/IEC 42001, or cross-border questions about AI governance engage us remotely. Scheduling accommodates your working hours, not ours.
Thirty minutes, a candid read, and a recommendation — including the recommendation to speak to somebody else, when that is the honest answer.