AI Governance & Security
An AI use policy written for advisers, approved tools configured so client data stays protected, and a record of who reviews AI-assisted client communications.
What we hear from financial firms
- An exam is coming and the written security program hasn't been updated since it was written.
- An allocator's due diligence questionnaire asked about AI use and cybersecurity.
- Advisers are using ChatGPT to draft client emails and summarize meeting notes.
- Someone received a convincing wire instruction change from a "client."
- You're launching a new fund or entity and want the controls set up right from the start.
What's different for financial firms
Client data in a financial firm is regulated, valuable, and a target. The questions from examiners, allocators, and insurers have moved from "do you have a policy" to "show us it works": incident response plans, vendor oversight, access reviews, and now how AI tools touch client information.
The SEC and the New York State Department of Financial Services (NYDFS) both expect regulated firms to protect client information and be ready to respond when something goes wrong. Our approach is built on best practices developed over more than two decades of supporting financial firms, and cross-checked against industry best practices and what examiners and allocators ask for. We build a program that holds up to that scrutiny and still fits how you work, and we coordinate with your compliance counsel when you have one.
Four ways to work with us
Each program starts with a defined first step, sized to your firm.
Cybersecurity & Governance
A WISP and incident response plan aligned to what examiners and allocators ask for, a tabletop exercise on wire fraud and account takeover, and vendor oversight that holds up.
AI Solutions
Small tools that remove manual reporting and data gathering, with human review before anything reaches a client.
Principal-Led Advisory
A principal at the leadership table for technology, vendor, and budget decisions, and quarterly reviews that keep security on the agenda.
Client work
What the work looks like
What each client needed, and what we did about it.
Cybersecurity & Governance
A complete written security program
The need: a security program leadership could show to the people it answers to, and that staff could actually follow.
We delivered a written information security program, business continuity and disaster recovery plans, and an incident response plan, matched to how the organization actually operates.
Cybersecurity
When an employee clicked a phishing link
The need: know quickly whether one click had become a breach, and handle the next one better.
The same day, we coordinated a threat hunt with our security operations partner, followed up on the findings, and reviewed the firm's response protocol with leadership.
Advisory
Security on the agenda every quarter
The need: keep security a leadership decision, not an IT task that only comes up after something goes wrong.
Our managed clients get a quarterly strategic business review that covers security risks and actions alongside projects and roadmap, so security is a standing leadership topic, not an annual scramble.
Common questions
Do investment advisers need a written information security program?
For SEC-registered advisers, and firms supervised by NYDFS, written security policies and an incident response plan are an expected part of the program. Exactly what applies depends on your registration and business, so we start by understanding both, and then build on practices developed over years of experience and cross-checked against industry best practices.
Can our advisers use ChatGPT with client information?
Only with the right tool, settings, and rules in place. Consumer accounts are a poor fit for client data. A business plan with data controls, a clear policy, and review of client-facing output is the usual answer.
Do you work with our compliance consultant?
Yes. Many of our financial clients have outside compliance support. We coordinate with them so the security program and compliance manual say the same thing.
Do you replace our IT provider?
No. Your IT team or provider keeps day-to-day support. We add the program, plans, and senior oversight they usually aren't set up to provide.
Also serving
Family offices & private clients
A family office holds a family's finances, privacy, and reputation in one place, often with a small team and no examiner asking the hard questions. We help make sure someone is.
Law firms & professional services
Client confidentiality is the practice. As AI arrives in drafting, research, and billing, firms need clear rules, secure tools, and time capture that respects every timekeeper.
Real estate & manufacturing
Deal sourcing, finance, and reporting workflows that are ready to automate, with the controls to rely on them, and a security program that protects every wire and every closing.
How does your firm score on AI governance?
The AI Governance Checklist for Firm Leaders: eight questions we ask in the first week of every review. Three minutes to your score and the gaps worth closing first. We'll email you the link.
Also free: cybersecurity and compliance assessments →
Talk through where AI and security fit in your firm.
Thirty minutes with a principal, not a sales pitch. We'll map the opportunity and the guardrails together, and tell you honestly what a sensible first step looks like.
Book a 30-Minute DiscussionPrefer email? info@kjtechnology.com