AI adoption has outpaced AI governance in most organisations. The accountability landscape has shifted — boards are now formally responsible for AI under APRA CPS 230, CPS 234, AS ISO/IEC 42001 and AICD director-duty guidance.
The Mycelium AI Security Health Check is a four-week diagnostic across 14 dimensions and four pillars — built to give boards and executives a defensible picture of where their AI risk actually sits under the new accountability landscape.
pillars across which AI governance and security are scored — Govern, Protect, Operate, Enable
The Mycelium 14-Dimension AI Security Framework
dimensions assessed Red, Amber or Green — each mapped to specific regulatory expectations
Mapped to CPS 230, CPS 234, AS ISO/IEC 42001, AICD
board-ready scorecard — defensible to the regulator, the auditor, and the board
Delivered in four weeks
Shadow AI is the fastest-growing category of unmanaged enterprise risk. Most incident response plans were written before generative AI existed. Most privacy policies don't yet disclose AI use. Most organisations have no formal AI Acceptable Use Policy at all.
The new accountability landscape is regulatory and structural. APRA CPS 230 and CPS 234 place AI-related operational risk and information security obligations directly on boards. AS ISO/IEC 42001 has been adopted as an Australian standard. AICD director-duty guidance has explicitly extended director accountability to AI literacy, AI oversight, and the board's own use of AI tools.
The first step is not more tools. It is a defensible picture of where the organisation currently sits across every control area regulators, auditors, and boards will ask about.
You cannot govern what you cannot see. The Health Check makes the exposure visible.
The Mycelium AI Security Health Check assesses your AI security and governance posture across 14 structured dimensions, grouped into four strategic pillars: Govern, Protect, Operate, Enable.
Each dimension is independently scored Red / Amber / Green, with the aggregate producing an overall AI Security Posture Score — defensible to a board, an auditor, or a regulator.
Accountability, policy, compliance & use-case governance
Access controls, data handling, technical security & threat defence
Incident response, vendor risk & model lifecycle management
Transparency, disclosure & AI literacy
RAG Scorecard → Governance → Enablement → Agents
Aligned to the Australian Government's six Essential AI Practices — plus eight additional control areas regulators are likely to formalise next.
A four-week structured assessment producing two client-facing documents and a board-level debrief. One bounded engagement. Fixed price. Board-ready output.
One page. Board presentation ready.
10–15 pages. Full forensic detail.
The AI Security Health Check is a self-contained engagement. It stands alone — with defined deliverables, a written report, and a board-level debrief, regardless of whether further work follows.
Where findings reveal material gaps, follow-on work is offered only where it makes sense: AI Governance Framework, AI Enablement & Literacy, or Intelligent Agent Deployment. If we are not the right firm for your situation, we will say so in the first conversation.
The first conversation is diagnostic. No pitch. No proposal until it makes sense.
Organisations engage with AI Security from different starting points. The diagnostic conversation is the same regardless of entry point — it determines where you sit, what the priority is, and the right path forward.
APP entities must publicly disclose AI-driven decisions that materially affect individuals. The Health Check produces the AI inventory, disclosure mapping, and remediation roadmap required to meet the obligation defensibly.
Recommended entry: Health Check
Boards, risk committees, and internal audit increasingly require a defensible answer on AI exposure. The Executive Scorecard is designed precisely for that conversation — a single page, ready to table.
Recommended entry: Health Check
A confirmed incident is the strongest possible mandate to assess the rest of the surface area. The Health Check identifies the dimensions that allowed the incident and the dimensions still exposed.
Recommended entry: Health Check
Before committing further AI tooling, licences, or vendor contracts, the Health Check confirms whether the governance and security posture can absorb the spend — or whether remediation is required first.
Recommended entry: Health Check
Aligned to the Australian Government's six Essential AI Practices — plus eight additional control areas regulators are likely to formalise next.
Mycelium's 14-dimension framework is the operational extension of the National AI Centre's guidance. It is designed to be defensible in front of the regulator, the auditor, and the board — today and after 10 December 2026.
Every Mycelium engagement begins with a diagnostic. Where the findings support further work, governance, enablement, and operation follow — in that order.
Sixty minutes. We assess the presenting problem, determine whether the Health Check is the right move for your situation, and tell you if it is not.
No pitch. No proposal until it makes sense.
Request a Diagnostic Conversationadmin@themyceliumgroup.com.au · +61 401 844 836 · Melbourne, Australia