Ask, Map, Move, pointed at risk.
For AI risk in a small security program, we use the Of One method in three steps: name the risk, trace where data and access flow, then ship the smallest control that reduces it. You can read the whole method at of1.ai.
Ask: name the risk
Before buying a tool or writing a policy, we answer eight questions: who owns the risk, what outcome counts, what is true now, which limits are fixed, what levers are available, how the change would land, what proof would show success, and when the decision is due.
Map: trace data and access
The map shows which AI tools touch which data, which agents can act and with whose credentials, and which vendors sit in the path. The gaps usually show up here.
Move: one control, tested
Then we build the smallest control that closes the worst gap, test it the way an attacker would, and keep it only if the test holds.
How it shows up
A Consult block walks one risk from naming to first control. A Build engagement runs the whole program on it. Either way, you learn the method and keep using it.
Start with one conversation.
Begin →