Every company that exists should run this workshop once. There are no excuses left — it is online, and it opens with a link.
For a year I have been writing the same sentence in different ways: security, and now agentic AI, is a property of decision systems, not code. The organisations that come through the next incident well are not the ones with the best scanners. They are the ones that knew, before the leak, who decides.
So I built the room where that gets decided. Four rooms, actually — one board, run as a five-day workshop with your board and your CIO:
🔎 Before you buy — twenty questions that force an AI vendor to show their hand.
🚦 Before the agents run — bound the space on Day One, before anything ships.
🛑 During the crisis — the questions worth asking when it breaks, and who signs.
🎯 When it must end — how to make the seat that kills a bad project rational.
By Friday, the board can answer — before the next incident — who decides, on what trigger, and who signs. You leave with a decision-rights charter, vendor verdicts, a Day-One gate spec, an incident playbook, and NIS2 management-body evidence.
And here is the part with no excuse attached: it is a Miro board. It is online. It opens for anyone with the link. You do not need a consultant, a licence, or a budget line to begin — you need a board, a CIO, and a week.
Run it once. Most companies never have.
