Your AI is ready to ship,
but you're blocked at security sign-off.

Where you're blocked

Here are a few of the situations this practice is built for. If one sounds like yours, keep reading.

• A customer's security questionnaire is holding a deal that is otherwise done, and the questions about their data — whether your AI trains on it, how long you keep it, who can see it — don't have clean answers yet.

• A pentest of your AI application came back with findings you hadn't considered, prompt injection and sensitive information disclosure among them. The release date is now at risk.

• The SOC 2 report your customers are waiting for is on hold until you can answer the exceptions from the AI platform's audit. The auditor flagged model output logging and access reviews.

• A prospect is asking for ISO 42001 certification, and the certification audit turned up nonconformities in your AI management system: impact assessments and human oversight.

• Your security lead wants to know what the AI agent can do on its own, which tools it can call, what it can change, and who checks its output before it goes live. You aren't sure how to answer.

• Production data is off limits to the AI system until it's authorized, but the authorization package isn't written.

Why you're blocked

In scenarios like these, the deal, the release, or the certificate is waiting on an approver outside your team to say yes. That yes is the security sign-off you're blocked at, and the approver can only give it to a case written in their terms: each finding or gap turned into a decision to fix it, reduce it, accept the risk, or show it doesn't apply, with an owner and the evidence behind it.

Building that case is a job of its own. Someone has to read the findings and gaps and work out which need an afternoon of evidence, an architecture change, or a new control. Then they have to justify each one in the approver's language. And all of that before the fixes can even be implemented. Usually, this work lands on your best engineer, who has to stop building or leading to figure it out.

Ultimately, the security sign-off gets resolved with ordinary work — some engineering, some evidence, some documentation — which means the core of the blocker is the translation from findings to a case that justifies and bounds that work.

Left alone, that translation work either waits until the security review's deadline forces someone to do it in a hurry, or an engineer does it on the side, where it competes with engineering work week after week. I take the translation off your hands: I build the case and turn it into a plan your engineers can execute like any other engineering work. That leaves your engineers focused on what they do best. What I don't do is write the code for you, or run the security review itself.

How you Get Unblocked

Get Unblocked is the track that takes you from the review on your desk to your approver's yes, in four stages. Three things hold throughout: I don't need access to your systems, since I work from your review, your architecture, and working sessions where your engineers drive; the channel stays open, so a question between sessions costs nothing; and every stage after the First Look has its own fixed price.

1. Start here

   First Look

   Spend an hour with me on whatever's blocking you: a security review, a questionnaire, an audit report. Bring the whole thing if you have it. On the call we go through the finding that worries you most, and I get a read on the size of the rest. Within one business day, I send a write-up with my initial thoughts on what we covered. The write-up is yours to keep, free. Mutual NDA on request.

2. The case

   Security Sign-off Plan

   I go through every finding and gap to make decisions the approver can agree to: whether to fix it, reduce it, accept the risk, or show it doesn't apply, and whether it blocks the release or can be deferred. A decision to fix or reduce comes with an approach describing how to make the change in your system and the evidence that will show it was made. I then turn those decisions into the end-to-end Security Sign-off Plan, which is the case the approver accepts and the work your engineers execute. If the approver turns a decision down, I revise it until they accept the plan. The plan is yours to keep and run as you wish, either through Guided Remediation with me, on your own, or through someone else.

3. The blocking fixes

   Guided Remediation

   I guide your engineers as they execute the plan, focused only on the fixes that actually block the release. Each week we check on progress and prioritize the work in the order that reaches sign-off soonest. Between checks, your engineers get working sessions with me at a pace you choose. My guidance covers architecture, design, and implementation, and it continues until the approver signs off on the system.

4. The deferred fixes

   Deferred Remediation

   I keep guiding as your engineers work through the rest of the plan at your own speed, addressing the fixes deferred at plan acceptance. This way, your system doesn't just pass sign-off but keeps shedding the security debt the review turned up.

Get Unblocked delivers your approver's yes in writing, the release out the door, the risks handled, and your engineers still on the roadmap. Your operations, unblocked.

Get Unblocked, step by step →

What I guarantee

• Independent. The plan stands on its own. Run it with me, on your own, or with anyone else.
• Accepted. If the approver turns a decision down, I revise it until they accept it in writing.
• Done right. If a decision doesn't work in practice, I rewrite it and carry it back through the approver at no charge.
• On time. Each dated deliverable puts forty percent of its price at risk on its date.

Guarantee details →

How you Stay Unblocked

The Get Unblocked track is what happens at a security sign-off. The Stay Unblocked track is what happens between sign-offs, so the next one is a smaller blocker. It consists of two services:

• Register Upkeep

  I keep your register current between sign-offs, so the next one starts from a known position.

• A Shift-Left Plan

  I write the plan for the controls that belong upstream, so the next review starts with fewer findings.

If you're interested in the Stay Unblocked track, on its own or as a continuation of the Get Unblocked track, let me know when you book your First Look.

Stay Unblocked, in detail →

About me

I've been on the other side of the security sign-off more than once. Over fifteen years of software engineering experience across data, AI, cloud, and security gives me the judgment to recommend fixes and mitigations that fit your system and get you through sign-off without a detour.

As the lead engineer on a FedRAMP High data and AI platform serving thousands of users, I triaged the findings, wrote the dispositions the reviewers accepted, answered the questionnaires, and designed and implemented the fixes while guiding my team through them. On an enterprise AI platform, I worked with the chief architect and the CISO to turn their security requirements into something the engineers could build, and it passed review. Translating findings into a case the approver accepts is the job this practice does for you.

More about Clayton →