Trebuchet Security Crest
TrebSec is an independent AI advisory practice.

Clear Judgment on
AI Governance and Vendor Risk.

Companies are buying AI tools fast and figuring out the rules later. I sit on your side of the table to help you vet AI vendors, set clear governance rules, and adopt AI while keeping control of your company data.

60 minutes, $300 - AI Risk & Governance, Vendor Evaluation, AI Adoption Planning.

Book the 60-Minute Session ($300) Request Custom Advisory
Reference Frameworks: NIST AI Risk Management Framework | NIST Cybersecurity Framework 2.0 | MITRE ATT&CK

What I Do

The TrebSec Distinction

The technology market is full of conflicts of interest. Vendors push products to hit sales quotas. TrebSec operates exclusively as a buyer's advocate. I sit on your side of the table. I do not resell software, hardware, or cloud licenses. My job is to cut through vendor hype, check how AI tools actually handle your data, and make sure your AI decisions match your business goals.

Explore my capabilities

AI Governance Rules

Setting clear, practical boundaries for how your people and vendors use artificial intelligence.

Independent Vendor Vetting

Checking the data privacy, model training rules, and real business value of AI tools before you sign.

Core Capabilities

AI Governance & Vendor Advisory

Focused support for AI decisions, vendor choices, and adoption planning.

01

AI Governance Before Deployment

Your people are already using AI tools, whether you approved them or not. I help leadership set clear, workable rules for what AI tools are allowed, what company data must stay out of them, whether typed in, uploaded, or pulled in through a connected app, and who approves a new tool before it goes live.

02

Independent AI Vendor Evaluation

Vendors often describe their new AI features as safe. I review the vendor materials before you sign, looking at how they handle your data, whether they train their models on your inputs, and what happens to your information if you cancel.

03

AI Risk in Business Terms

Not every AI tool carries the same risk. I use FAIR to put a dollar figure on what could go wrong, and the structured likelihood and impact approach from NIST SP 800-30 where a dollar figure is not the right tool. Either way, you end up with a clear basis for which tools to approve and which ones to walk away from.

04

Practical AI Adoption Roadmaps

Buying AI licenses just to keep up with competitors wastes money. I help you pick high-value use cases, run a small pilot with a named group and approved data only, and expand in steps your team can manage.

Advisory Offers

60-Minute AI & Cyber Strategy Session - $300

AI Risk & Governance, Vendor Evaluation, AI Adoption Planning.

Book on EveryExpert ($300)

AI Governance Program Advisory - Scoped by engagement

Request a Consultation

AI Vendor and Tool Evaluation - Scoped by engagement

Request a Consultation

AI Adoption Roadmap - Scoped by engagement

Request a Consultation

Other AI advisory topics can be discussed on an introductory call.

How It Works

Start With One Conversation

01

Step 1: Book the 60-Minute Session ($300)

Pick a time on my EveryExpert calendar. Before we meet, you can send over any AI vendor contract you are free to share, or just the parts that cover data, privacy, and renewal, plus any tool list or governance question you want me to review.

02

Step 2: One Hour of Direct Answers

We spend 60 minutes on your actual situation. No sales pitch and no generic slide decks. I will point out the main risks, the questions to ask the vendor, and the first rules to set.

03

Step 3: Decide Your Next Move

After the session, you decide the next move. Many leaders have what they need to make the call. If you want ongoing help building an AI governance program, vetting a stack of vendors, or mapping out an adoption plan, we can scope that out after we talk.

Governing Standards

Reference Frameworks

I use established frameworks as reference points when the work calls for them. They are not services for sale.

NIST AI RMF

The AI Risk Management Framework is NIST's structure for governing AI risk, built on four functions: Govern, Map, Measure, and Manage. I use it to organize the questions that matter when a company buys AI: what data goes in, how long the vendor keeps it, whether the vendor trains on it, and who inside the company owns the decision.

Read the full framework: NIST AI 100-1 (PDF)

NIST CSF 2.0

The National Institute of Standards and Technology Cybersecurity Framework provides a common taxonomy (Govern, Identify, Protect, Detect, Respond, Recover) that I reference when aligning AI governance with broader executive oversight.

Read the full framework: NIST CSWP 29 (PDF)

MITRE ATT&CK

A public knowledge base of real-world adversary tactics and techniques. I use it as a reference point for how attackers go after the accounts, systems, and third-party software suppliers that an AI deployment depends on.

Open the full ATT&CK knowledge base

About James

Meet the Principal

James Roberts

James Roberts, Principal

I'm James Roberts. I have spent years in enterprise information security and systems engineering, working mostly with regulated companies where a bad technology decision carries real weight.

TrebSec is my own independent advisory practice, and I keep it small on purpose. If you hire TrebSec, you work with me directly. You will not be passed to another consultant, and I do not take kickbacks from software vendors.

Most of my work here is focused on AI. Companies are buying AI tools fast and sorting out the rules after the fact. I help them do it the other way around. We get the governance set first, check each vendor carefully, and pass on the tools that bring more risk than they are worth.

Certifications earned include CISSP, CISM, and CCMC-RP.

EveryExpert Profile LinkedIn Profile james@trebsec.com

FAQ

Frequently Asked Questions

Our employees are already pasting work into ChatGPT and Claude. Where do we even start?

Start by finding out which AI tools your team is using and what company information is going into them. Then write down three things: which tools are approved, what company data must never be entered, and who approves a new tool before anyone uses it. A total ban usually backfires. People move to personal phones and personal accounts, where you have no visibility. In the 60-minute session, we can sort out your first rules and the first checks to run. The session gives you a starting point, not a finished company standard.

Can you review an AI vendor's security paperwork before we sign a contract?

Yes. Bring the vendor's terms, privacy documentation, or architecture sheet to our session. I look at how long the vendor keeps your data, whether they train their models on it, and whether that promise is in the contract or only in a settings page. I also check the sub-processors, who at the vendor can access your data, and whether your data is deleted when the contract ends.

Do you sell AI software or take money from AI vendors?

No. I do not resell software, hardware, or cloud licenses, and no AI vendor pays me to recommend its tools. My advice is not tied to a vendor commission.

What happens after the $300 strategy session?

You leave with clear next steps you can hand to your team. If you need deeper work, like full AI governance program advisory, multi-vendor evaluations, or an AI adoption roadmap, we scope that separately based on what you actually need.

Request a Consultation

Submit your requirements below. All inquiries are treated as confidential and reviewed personally by James Roberts.

Prefer a fixed-price intro session?

Book a 60-Minute AI & Cyber Strategy Session for $300. AI Risk & Governance, Vendor Evaluation, AI Adoption Planning.

Book on EveryExpert ($300)
Do not send passwords, access keys, or highly sensitive information through this form.

The information on this site is provided for general information only, does not constitute legal advice, and is not a guarantee of protection from any security incident.