Mycelium is an AI security, governance and agents practice for regulated industries. Diagnostic-led. Evidence-graded. Built to defend.
Sara Shakib founded Mycelium to make AI governable for Australian boards and regulated industries. Thirty years across government, critical infrastructure, financial services and enterprise technology — building the diagnostic-led practice that turns AI risk into evidence boards can table, regulators can audit, and operators can use.
She authored the Mycelium 14-Dimension AI Security Framework™ — the operating model behind every Health Check, every agent build, and every board briefing.
Diagnostic-led. Evidence-graded. Built to defend.
Every engagement begins with a diagnostic. No engagement proceeds without one. If the diagnostic does not support further work, we say so before a proposal is written.
Every finding maps to a control, a standard and a piece of evidence. Board-ready. Auditor-defensible. Regulator-ready. No abstractions, no slideware.
Whether it’s a Health Check, a Framework or an Agent build, the output is designed to hold up in front of the people who matter most — your board, your regulator, your auditor.
Sectors where AI governance and board accountability are formally regulated — or about to be.
Every Mycelium deliverable maps explicitly to the standards your board, auditor and regulator are reading.
In force. Names AI as material technology requiring board oversight and risk management.
In force. Establishes board accountability for information security capabilities, including AI systems.
Now an Australian standard. Defines management-system requirements for organisations using AI.
Five major publications. Directly ties director duties of care and diligence to AI literacy and governance.
Expands obligations around automated decision-making, model transparency and consumer rights.
Thirty minutes. No pitch. No proposal until it makes sense.
Book a diagnostic