Security and compliance for teams building with AI.

PinSecurity is Sara Wolpin’s cybersecurity consulting business. Sara helps companies find and fix security gaps and get ready for audits and regulators. The services are risk assessments and pen testing, AI security and governance, security reviews of AI-built apps, cloud and Microsoft 365 / Google Workspace hardening, gamified awareness training, vCISO and GRC, ISO 27001, compliance readiness (SOC 2, HIPAA, NYDFS), and incident response and forensics.

A vCISO (also called a fractional or virtual Chief Information Security Officer) is a senior security leader who works with you part-time, for a fraction of the cost of a full-time CISO. GRC means governance, risk and compliance. In practice that’s the security roadmap, policies, risk register, vendor risk and control reviews, and keeping your evidence up to date month after month. At PinSecurity, vCISO and GRC are one service.

Businesses that want practical security help without hiring a full-time security person. For example, teams using ChatGPT, Claude or Copilot at work, founders shipping apps built with Lovable, Cursor or Bolt, SaaS and service companies getting ready for SOC 2, healthcare teams that need HIPAA security, and companies that need ISO 27001 to win bigger clients or enter new markets.

Not by default. These tools build working apps fast, but they can leave a database open to the public, API keys in the front-end code or weak login rules. An AI-built app security review checks logins, database rules, exposed keys and prompt-injection risks before real users and data arrive.

Start with a written AI use policy that says which AI tools are approved and what data can go into them. Then use business plans and settings that keep your data out of model training, and turn on data-loss controls in Microsoft 365 or Google Workspace. Sara sets this up as part of AI security and governance.

ISO 27001 certification means an independent certification body has audited your information security management system (ISMS) against the ISO/IEC 27001 standard. First you build the ISMS: you set its scope, run a risk assessment, choose controls to treat the risks, check them against the list in the standard’s Annex A, and record your choices in a Statement of Applicability. Before the audit, you run a full internal audit and a management review. The certification audit has two stages: Stage 1 checks that your ISMS is designed and ready, and Stage 2 checks that it works in practice. A certificate from an accredited certification body is valid for three years, with surveillance audits in between and a recertification audit at the end.

Sara helps companies get ready for SOC 2, HIPAA and ISO 27001. For ISO 27001 she helps build an information security management system (ISMS) and prepare for the certification audit. Readiness work starts with a gap analysis, then the controls, policies and evidence you’re missing. She also helps DFS-licensed firms with the NYDFS cybersecurity regulation (23 NYCRR 500).

PinForge is Sara Wolpin’s secure custom software and AI automation business. It builds web apps, portals and internal tools, AI assistants that work from your own data, and automations that connect the tools you already use. Every build gets threat modeling, secure code review and testing before launch.

Yes. PinSecurity writes incident response plans, runs tabletop exercises and gives hands-on help when something goes wrong. Sara’s digital-forensics training (the EC-Council CHFI course) helps her trace what happened and close the gap.

Yes. Sara works with clients worldwide.

Book a free 10-minute call with the button on this page, send a message through the contact form, or message Sara on WhatsApp. She replies to messages within one business day. After the call, she sends a clear plan and a quote.