Call
Talk to an expert

Secure AI

Secure AI

Get the benefit of AI without losing track of your data. Rules first, then the tools, then the checks that keep both honest.

Discuss your secure AI needsSee secure AI services ↓
● Where a prompt goesPolicy first
  1. Prompt from your team“Summarise this client file…”
  2. AI policy checkApproved tool · sensitivity label · data loss rules
  3. Then one of:
    • Business AIIn your tenant, with your permissionsApproved
    • Private LLMOn your premises or Australian cloudApproved
    • Public AI toolClient data stopped at the gateBlocked
Illustration · not live dataGovernance first

01Secure AI services

Govern first, then build.

Each service starts with data protection and governance, then moves to the work itself.

Core service

AI Security & Governance

Policy, risk and testing so your team can use AI with less risk of leaking data.

  • NIST CSF
  • ISO 42001
  • ASD Essentials

Copilot Readiness

Fix oversharing and permissions before Copilot surfaces them for you.

  • NIST CSF
  • ASD Essentials
  • ISO 42001

AI Consulting & Strategy

Find where AI helps your business, and how to adopt it safely.

  • ISO 42001
  • NIST CSF
  • ASD Essentials

AI Automation & Agents

Automate routine work with AI agents that are secure by design.

  • NIST CSF
  • ASD Essentials
  • ISO 42001

Local AI & Private LLMs

Run AI where prompts and documents stay on systems you control.

  • NIST CSF
  • ASD Essentials
  • ISO 42001

02Where your data goes

Know where every prompt and document ends up.

Before an AI tool goes live, we trace where its data travels. That answer decides whether a cloud tool, a private deployment or no AI at all suits the task.

  • Needs a policy

    Public AI tools

    Free or personal accounts

    Processed
    On the vendor's servers, often overseas
    Who sees it
    Depends on the vendor's terms and the user's settings
    What we do
    Find the shadow AI already in use, then approve or block tools under a short policy
    AI security and governance
  • Governed

    Business AI in your tenant

    Such as Microsoft 365 Copilot

    Processed
    In the vendor's cloud, under your organisation's agreement
    Who sees it
    Anyone whose existing permissions reach the file, so oversharing surfaces fast
    What we do
    Permissions clean-up, sensitivity labels and data loss prevention before rollout
    Copilot readiness
  • Under your control

    Local AI and private LLMs

    Open-weight models

    Processed
    On your premises or in an Australian private cloud
    Who sees it
    Only the people and systems you allow
    What we do
    Deploy the model with private search over your own documents, then test and monitor it
    Local AI and private LLMs
Close-up of a server with rows of drive bays and green status lights, representing on-premises hardware for local AI

Secure AI

Testing AI the way an attacker would

We hide instructions in the emails and documents an AI reads, try to draw out data it shouldn't share and check that approval steps hold. Findings come with evidence and recommended fixes.

03Read the detail

Secure AI, explained

In short

Secure AI adoption means using AI tools in a way that protects your data, meets your legal obligations and stays under your control. Catharsis is a Sydney cyber security company certified to ISO/IEC 27001:2022. We build and secure AI for Australian organisations, starting with governance and data protection, then delivering the tools your team will actually use.

Which AI risks go beyond where your data is stored?

Knowing where your data goes is the first question. Most of the other AI risks are familiar security risks in a new form:

  • Agents with too much access. Automations holding broad credentials to email, finance or customer systems. Our AI automation builds give each workflow only the access its task needs.
  • Instructions hidden in content. Attackers hiding instructions in documents or emails that an AI later reads. We test chatbots, agents and document search against it under AI security and governance.
  • No one accountable. AI tools adopted team by team, with nobody owning the decision to use them. A short policy and one named owner address that.

Which frameworks and guidance apply to AI in Australia?

There is no single AI law for Australian businesses, but several frameworks give a clear structure. The current national guidance is the National AI Centre’s Guidance for AI Adoption (October 2025), which evolves its predecessor, Australia’s Voluntary AI Safety Standard.

We map your controls to it and to the NIST AI Risk Management Framework (AI RMF), ISO/IEC 42001:2023, the OWASP Top 10 for LLM Applications and the Privacy Act 1988 (Cth). Our AI security and governance page explains what each one covers. The Australian Signals Directorate’s ASD Essentials series also includes an “Executive artificial intelligence accountability” principle, covered on our ASD Essentials page.

Is AI safe for a small business to use?

Yes, when you put a few basic controls around it. It’s common for staff to start using AI tools before any policy exists, so the first step is finding out what is already in use. ASD’s Artificial intelligence for small business guidance is a good plain-English starting point.

For example, a small professional services firm might approve one business AI account for drafting and summarising, ban client names and financial details in any other tool, and review the approved list regularly.

From there, pick one or two use cases with a clear benefit and low data sensitivity, and do them properly. If you use Microsoft 365, Copilot readiness is often a practical first project, because it also fixes permission problems that exist with or without AI.

04FAQ

Secure AI, answered.

Can't see your question? Ask a specialist and get a straight answer.

Ask a specialist
What is secure AI adoption?

Secure AI adoption is bringing AI tools into your business with the same care you apply to any system that handles sensitive data. It means knowing which tools staff use, controlling what data goes into them, checking vendors, testing anything you build, and assigning someone accountable for AI decisions. The goal is to get the benefit of AI without creating a new route for data to leak.

Why use a cyber security company for AI instead of an AI agency?

Much of AI risk is security risk: data leaving your control, tools with too much access, and attackers manipulating AI through its inputs. A cyber security company looks at those issues first, before any AI tool goes live.

Is it safe for staff to use ChatGPT or Microsoft 365 Copilot at work?

It can be, with the right settings and rules in place. Business versions of these tools offer stronger data protections than free consumer accounts, but they still need an acceptable use policy, approved accounts and controls on sensitive data. Copilot also needs your Microsoft 365 permissions tidied up first, because it can surface any file a user already has access to.

Do small businesses need AI governance?

Yes, scaled to your size. A 20-person business does not need a large program, but it does need a short AI policy, a list of approved tools, a rule about what data must never be entered, and one person accountable for AI use. Those four steps close common gaps and give you a sound answer when a customer or insurer asks.

Can we use AI without our data leaving Australia?

Yes. Some business AI services offer Australian data residency, and open-weight models can run entirely on your own hardware or in an Australian private cloud. Our local AI service designs and hardens these private deployments, including search over your own documents, so prompts and files stay on systems you control.

Secure AI

Planning an AI rollout? Start with where the data goes.

No obligation. You talk to the people who do the work. Enquiries usually get a reply within 3 business days.

Offered at our discretion. Offer terms.