Teams who deliver.
aistrategy.agency is staffed by subject matter experts who deliver against each client's specific requirements. More than 20 people work for the agency across data engineering, development, design, security and compliance, brought together around each engagement for the skills it needs. Team leads own every engagement and are answerable for everything that ships, and engagement-specific roles deliver the day-to-day work through tools like Vernier or Echelon, each within limits we publish openly.
Drew van Vuuren
Chief AI Strategist
Drew is a strategic advisor and consultant. His work is modernising how businesses operate through practical AI adoption, by working directly with executive and operational leadership to find what is stalling growth. Drew connects business strategy with practical delivery, by identifying where disconnected systems and poor data impact on the business's ability to operate optimally.
Partnering with business leadership to define priorities and turn them into a clear roadmap for AI adoption, workflow automation, data integration and building measurable outcomes, he remains engaged throughout the process whether it is the build, testing or handover, always taking ownership for expected customer deliverables.
Selected work by Drew as Chief AI Strategist. Sectors are named; clients stay private.
Quick-service restaurants
Chief AI Strategist to a 78-store QSR group. Designed and led its operations platform, Vernier's first production deployment: sales, stock, supply chain, labour, repairs, property and finance checked against each other, six years of the ledger rebuilt and checked, and a store app in production.
Retail
Assessed AI opportunities across stores, procurement and head office, built the business cases and agreed a phased delivery roadmap with executive leadership. The board approved it, with funded projects, accountable owners and agreed performance measures.
Financial services
Designed the AI governance framework, covering acceptable use, data access, supplier assessment and human oversight, with approval processes and training for leaders. It was adopted, and every existing AI tool was assessed and given a risk owner.
Hospitality
Set the strategy for AI-assisted guest enquiries and booking support, led supplier selection and oversaw deployment, training and evaluation. It launched across participating properties and cut routine enquiries handled manually by 35%.
Public sector
Led a programme to cut delays in processing public enquiries and applications, setting privacy and accessibility requirements and taking pilots through to handover. Two services are live, with shorter processing times and human review kept for consequential decisions.
Manufacturing
Built the investment case and delivery strategy for AI-based equipment monitoring, aligned engineering, technology and operations, and appointed delivery partners. It runs across three facilities and cut unplanned downtime by 12%.
Professional services
Designed and led AI adoption for research, drafting and knowledge retrieval: criteria for choosing tools, training for each role, quality checks and adoption measures. Five departments now use the approved tools, with documented review procedures.
Chief Security Architect
Our second founder is a chief security architect who has designed, built and run enterprise security services across government and the private sector: a 24x7 security operations centre, digital forensics and incident response, threat intelligence, vulnerability management and consultancy. The role has meant leading multidisciplinary technical teams, folding acquired capabilities into a single service, and building new offerings from scratch.
At aistrategy.agency the role is security architecture and assurance: the controls, monitoring and governance under every system we build. The work spans cloud and identity security, Zero Trust, operational technology and Secure by Design, with ISO 27001, ISO 42001, NIST CSF and NCSC CAF used as working standards rather than paperwork.
Selected security work by our Chief Security Architect, from before joining us. Sectors are named; clients stay private.
Managed security services
Consolidated several security operations teams into one 24x7 managed service, with incident response, forensics, penetration testing and threat intelligence under one roof.
Higher education and professional services
Designed managed detection services for hybrid and cloud estates, from architecture through to customer onboarding.
Retail and critical infrastructure
Assessed operational technology security across 16 operational sites and produced a prioritised improvement roadmap.
Central government
Secure by Design architecture for cloud transformation programmes, including security for AI adoption and sensitive data.
Financial services
Identity, Zero Trust and data protection controls across devices, cloud applications and privileged access.
Cross-sector
Built a digital forensics and incident response capability, with chain-of-custody evidence handling and readiness exercises.
Applied AI and automation strategy
End-to-end roadmaps that take a business from exploratory pilots to automation it uses every day.
Systems integration and modernisation
Connecting separate systems so information moves between them automatically, removing the manual handoffs and retyping that slow operations down.
Data governance and architecture
Clean, reliable, governed data pipelines: the basis for decisive leadership and for AI models that can be relied on.
Operational security and resilience
Risk management, compliance and governance built into a transformation from the start, without slowing the business down.
Outcome-driven transformation
Modern tooling tied directly to commercial KPIs: cost, efficiency, and growth that can be sustained.
- Certified
- CDPO and CIPM certifications support the work in AI Governance, data protection and information privacy management.
- Security standards
- Security work aligned to ISO 27001, ISO 42001, ISO 20000, NIST CSF, NCSC CAF, CREST and MITRE ATT&CK.
- Disciplines
- Spans digital transformation, AI strategy, cloud, cybersecurity and service management, with governance considered before anything is deployed.
Six of them.
Each with a line it does not cross.
The work runs through Echelon, one of our own products. Each role is defined by what it does, what it may touch, and what it never does. Every action is logged. Nothing is called finished by the one who made it, and nothing leaves without a founder's sign-off.
Marshal
OrchestratorTakes the task, breaks it down, hands the pieces to the right role and pulls the results back together.
- May
- Reads every log
- Never
- Does the front-line work itself
Herald
ResearchLooks things up, reads documents, gathers what the rest of the team needs to know.
- May
- Read only
- Never
- Builds, changes or decides anything
Minerva
AnalysisWorks with the numbers: aggregates, compares, spots the pattern, and says what it means.
- May
- Computes, never publishes
- Never
- Checks its own analysis
Mason
BuildWrites, edits and tests code and files. The one that actually makes things.
- May
- Builds and runs tests
- Never
- Deploys, publishes or touches production
Penn
DraftingWrites the documents, reports and messages. What Mason is for code, Penn is for words.
- May
- Drafts only
- Never
- Sends, posts or distributes anything
Sterling
VerificationChecks the others' work before it is called done, so nothing is finished by the one who built it.
- May
- Read only
- Never
- Fixes what it finds
Retained, not employed
More than 20 specialists in data engineering, development, design, security and compliance work for the agency, retained for the engagements that need them: a data engineer for a migration, a designer for a product people will use every day, a specialist for a POPIA or ISO question. Most have worked with us before, and each joins a team for the skills its client needs.
They are not named as employees, and we do not pretend otherwise. You will know who they are before they start: anyone who touches your work is named in the proposal, works under the same approval rule as everyone else, and shows up in the same log.
How we think
Clarity
We explain in plain language what a system does and what it cannot do. If you can't explain it to your board, we haven't finished.
Consequences need a person
Reading and drafting can be automatic. Sending, paying, deleting and sharing cannot. That line is built into everything we ship, and into the team that ships it.
You own it
Systems run in your cloud account, on your data, with documentation good enough for someone else to take over.
Measured outcomes
Where we can, we price against the saving or recovery. Where we can't, we say what we will measure before we start.
No lock-in
Model vendors change monthly. Our builds sit on a provider-neutral core so the model can be swapped without a rebuild.
We run on the rule we sell
Echelon proposes; a person approves anything that ships. Herald finds, Minerva works it out, Mason builds, Penn writes it up, Sterling checks, Marshal keeps the whole thing in view, and a founder signs. That is how a small practice delivers systems that used to need a much larger one, and it is why we can be honest about what these tools are good at and where they still fail. We have watched them fail, in our own log.