Axiomeer is a boutique advisory, and intends to remain one. The work is led personally, the engagements are limited deliberately, and the standard is the one we would want applied to us.
I spent a decade building and running the security platforms that large organisations — and their customers — depend on. Detection and response at enterprise scale. Managed security serving dozens of enterprise clients across two continents. Most recently, the governance and engineering of AI inside security operations themselves.
Axiomeer exists because that experience is difficult to buy at mid-market scale. The firms who have it are structured to sell six-figure programmes; the firms who will take a smaller engagement usually staff it junior, or are managed service providers with something to sell you at the end of the assessment.
My advantage is not a framework — frameworks are public. It is having operated the systems I now assess. I know what a cyber-insurer's security questionnaire is really testing, because I helped build the platform behind one. I know where AI deployments break in practice, because I have built agentic systems and then had to govern them.
CISSP — (ISC)²
ISC2 — Securing AI: Cybersecurity Strategy
NIST AI Risk Management Framework
OWASP LLM Top 10 · MITRE ATLAS · MITRE ATT&CK
SOC 2 · HIPAA · ISO/IEC 42001 (referenced)
The person on your first call is the person conducting the interviews, writing the findings, and standing in front of your board. Nothing is delegated downward, because there is no downward.
No third-party licences, no reseller margins, no referral fees. When we recommend a control or a vendor, there is no revenue on the other side of the recommendation. Our own monitoring service is the single thing we offer — priced openly and cancellable at will.
A small number of concurrent engagements is not a constraint we apologise for — it is the reason the work is good. If we are full, we will say so and suggest when to return.
Headquartered in Dallas–Fort Worth, with on-site availability across the New York and Connecticut corridor, and remote nationwide where the work suits it. There is no office network — clients engage a boutique precisely because the senior person is the one who shows up.
The home market, and where on-site work is routine: health-tech, fintech, logistics, and the aerospace and defence supply chain across Dallas, Fort Worth, Plano, Frisco, and Irving.
Venture-backed technology firms and mid-market financial services meeting enterprise procurement, regulatory expectation, and institutional questions about AI governance. On site for kickoffs and readouts.
Hartford, New Haven, and Fairfield County: insurance, asset management, health systems, and defence suppliers working against regulatory timelines already in motion. On site for kickoffs and readouts.
Thirty minutes, a candid read, and a recommendation — including the recommendation to speak to somebody else, when that is the honest answer.