Security posture
Identity, cloud configuration, secure development, incident history and the controls customers have been promised in contracts.
Security
Investors · Assurance
Cyber and AI governance due diligence for Gulf investors
An independent, deal-paced view of the security, data and AI risks inside the company you are about to back or buy, written for an investment committee by a firm that will never sell the target the fix.
The risk your financial and legal diligence does not reach
Gulf capital is flowing into AI companies faster than anyone can check them. Financial diligence tests the numbers and legal diligence tests the contracts. Neither tells you whether the company can keep its customers' data where the law says it must stay, whether it has the rights to the data its models were trained on, or whether its biggest customer contract depends on a security promise it cannot keep.
We give you an independent view of exactly that, written for an investment committee, on the deal timetable.
What we examine
Scoped to the deal. Mostly from the data room and management sessions; no access to customer personal data needed.
Data protection and residency
Which Gulf and international regimes apply, whether data sits where they require, and how cross-border support access is handled.
UAEKSADIFCADGMGDPR
AI governance and model risk
Model provenance, rights to training data, dependence on third-party model providers, evaluation, human oversight, and exposure under DIFC Regulation 10, sector AI rules and the EU AI Act.
AI
Regulatory and customer exposure
Licences, sector regulators and the security and AI commitments in key customer contracts that could become liabilities.
Exposure
People and dependency
Key-person risk in security and engineering, and how much of the company's assurance rests on one person or one supplier.
Key person
Value-relevant findings
Issues worth pricing, conditioning or putting into the 100-day plan, ranked by severity. Not a remediation proposal.
Red flags
What it costs
A fixed fee per deal, agreed before we start and paid in advance. Conflict check within one working day of your enquiry.
Red-flag review
Pre-term sheetFive working daysData room and one management session
A short, ranked list of the issues that could change the price or the decision, with a clear view of what we could not verify.
From AED 12,000≈ USD 3,268. Excludes VAT and other taxes.
Confirmatory due diligence
Two to three weeksManagement interviewsFull report
The full report across all six areas, with severity ratings, suggested conditions and a 100-day plan outline for the investment committee.
From AED 25,000≈ USD 6,807. Excludes VAT and other taxes.
Portfolio programme
An annual cyber and AI governance health check across your portfolio companies, with a consistent scoring method you can compare across the book.
Quoted per portfolioFixed before you commit.
Why independence matters more here than anywhere
We do not sell the fix to the company we diligence. A diligence report written by a firm hoping to win the remediation contract is a sales document. We also check for conflicts before every deal: we will not diligence a company we have advised, or for which we hold a CISO or DPO role, and we tell you if that is why we are declining.
What the report is not
Not a penetration test, a legal opinion or a certification, and not a guarantee that no incident will occur. Where a technical test is needed to resolve a finding, we say so and you choose who performs it.
Questions
Who is this for?
Venture capital funds, family offices, corporate venture arms and acquirers investing in or buying technology and AI companies in the Gulf, or Gulf investors buying abroad.
How do you handle confidentiality?
Under your NDA and the data room rules. We work from the data room and management sessions, keep no copies of personal data, and destroy deal material at the end of the engagement unless you instruct otherwise.
Can the target company see the report?
That is your decision. Many investors share a summary as part of the 100-day plan; the full report belongs to you.
Do you work in Arabic?
Yes. Management sessions and the report summary can be in Arabic or English.
Tell us the deal and the timetable
Company, sector, stage and when the investment committee meets. We confirm conflicts within one working day and send a fixed fee.