35 years in security, from U.S. Army intelligence to GRC at HSBC, Deutsche Bank and Commerzbank, and CISO through a nine-figure private-equity exit. Now I help European teams choose, build and secure AI systems, with the controls designed in from the first sketch.
Tim CrouchFounder and CTO, Global Software AI. CISSP. Based in Riga, working across Europe.
A shared document contains hidden instructions. The assistant reads it as context and follows them, for example forwarding data by email.
Treat retrieved text as untrusted data, keep it apart from instructions, and limit what the model can trigger after reading it.
OWASP LLM01:2025 Prompt Injection. CISSP domain 8, Software Development Security.
Prompts carry customer names, contracts or account data to a third-party model, outside your data processing agreements.
Classify what may be sent, redact before the call, use an EU-hosted endpoint under a DPA, and log what crossed.
OWASP LLM02:2025 Sensitive Information Disclosure. GDPR Article 28. CISSP domain 2, Asset Security.
The assistant holds a token that can send email and edit records for the whole company, so one bad instruction has a wide blast radius.
Scope tokens to the user, make outbound actions draft-only, and require a person to approve anything that leaves the company.
OWASP LLM06:2025 Excessive Agency. CISSP domain 5, Identity and Access Management.
The search index was built with an admin account, so anyone can ask the assistant about HR files or board papers they could never open.
Enforce the source system's access rights at query time, per user, and test it with accounts that should be refused.
OWASP LLM08:2025 Vector and Embedding Weaknesses. CISSP domain 5.
When something goes wrong there is no record of the prompt, the retrieved sources or the tool calls, so you cannot investigate or prove compliance.
Log prompts, sources and actions with retention rules that match your obligations, and alert on unusual tool use.
NIST AI RMF, Measure and Manage functions. CISSP domain 7, Security Operations.
Each engagement starts with one clear problem. We agree the scope, fee and deliverables before any paid work, and you decide afterwards whether to go further.
Most requested
For teams adopting AI tools or preparing an AI feature for wider use.
Discuss a reviewFor teams that know AI could help, but need to choose where to start.
For founders and teams with a specific product or integration to deliver.
Two days, in person, for leadership teams of up to 20. Online modules and a certificate included.
Also available: security and compliance consulting (ISO 27001, GDPR, cloud security) and custom software for regulated environments.
Founder and CTO, Global Software AIAI security consulting and CompylotAI, from Riga
CTO and advisor, licensed German investment management firmFinTech and TaxTech businesses, and a post-acquisition integration
Cybersecurity and GRC consultantHSBC Trinkaus, Deutsche Bank, Commerzbank
Co-founder, CISO and CTO, Education AdvancedSaaS company carried through a nine-figure private-equity exit
U.S. Army intelligence interrogatorTop Secret clearance, working in Russian and German
Articles and videos on securing AI. Most summarise a primary source, such as NIST, OWASP or the EU AI Act, and map it to the CISSP domains a security team would use.
One security and one AI development each week, with what it means for teams that build and run software.
Software that grew out of client work, built in Riga and used in production.
Pre-submission review of draft communications for compliance teams at EU and German financial institutions. The AI prepares the review. Your reviewers keep the final say.
Explore CompylotAIAn always-on assistant on dedicated, EU-hosted infrastructure, managed from Telegram. You hold the credentials, and any support access is logged.
Meet the AI EmployeesExperiments such as NectarForge, Salon Rota, AImpressions and the threat-model games live in the lab.
Describe the workflow, risk or product in a few sentences. Budget and timing are optional.
I reply by email, usually within one business day.
If there's a fit, we talk for 30 minutes at no cost.
You receive a written scope and fixed fee before any paid work starts.
