About Mayhem Shield

Buyer-side assurance for enterprise AI: documented findings, evidence requests, and gate-level conditions, without reselling or implementing the product under review.

Mayhem Shield is an independent, buyer-side assurance practice for enterprise AI deployments, based in Dallas-Fort Worth, Texas. We review Microsoft 365 Copilot, RAG systems, AI agents, and AI-enabled SaaS on behalf of the organization deploying them, and we report to the approval forum, not to the vendor or the implementation team.

We do not sell, implement, or operate the products we review. We issue adverse findings when the evidence supports them, and every engagement ends with a go, conditional go, or no-go position and the conditions attached to each gate. All work is performed by the three-person practice, with no subcontractors.

What Mayhem Shield does

Assess whether controls hold for your deployment: data paths, identities, integrations, workflows, and go-live conditions, documented for approvers.

Architecture-led review, not vendor marketing checklist exercises
Evidence-based control findings and remediation priorities
One assurance model across AI deployment categories
Buyer-side independence with explicit approval criteria

Independence policy

We are paid only by the buyer. Never by the vendor.

If independence is in doubt, the assessment has no value. We do not sell, implement, resell, or operate the products we review, and we take no fees, commissions, or referral payments from vendors.

In practice: a review often requires information from the vendor, such as architecture detail, configuration options, or answers to specific control questions. We request that material on the buyer's behalf and report the findings to the buyer. The vendor is a source of evidence, never a client and never a payer.

How we handle client information →

Leadership team

Tich Kadandara

Founder / Technical Lead

More than twenty years in enterprise security architecture and engineering, with emphasis on cloud, identity, and AI-related governance. Co-chairs GenAI architectural review boards in large enterprise settings and routinely reviews AI solution designs from vendors, internal teams, and integrators. That enterprise review cadence informed how Mayhem Shield defines scoping, control outcomes, and evidence for client engagements. Background spans Zero Trust and identity architecture, cloud security, and AI security governance across regulated industries. Credentials: CISM, ISACA AAIA and AAISM, CASP+, AWS Certified Solutions Architect and Machine Learning Specialty, Microsoft AZ-500, Google Professional Cloud Security Engineer and Professional Cloud Architect.

Gerald Munetsi

Business and Operations Manager

Cambridge MPhil candidate in health data science and Mastercard Foundation Scholar, building on First Class Honours in applied mathematics and economics from the University of Zimbabwe. Former assistant program manager at ZIMCARE Trust and further-education mathematics lecturer in South Africa; AWS Certified Cloud Practitioner and UNSSC SDGs Premier Certificate. At Mayhem Shield he coordinates proposals, delivery timelines, and client engagement logistics, supporting the technical leads.

Danny Hondo

Technical Lead

More than twenty years in cybersecurity operations, vulnerability management, and cloud security, including public-sector environments: SIEM operations, incident response support, risk assessment, and control validation. On engagements he contributes technical delivery: architecture review, stakeholder interviews, control-gap analysis, and evidence review, with emphasis on how controls behave in live operation, not only as written.

Proof points

Why the model is grounded in enterprise work

Review experience: The framework reflects structured assurance work in large enterprise environments, not a paper-only exercise.
Architecture depth: Technical leads have assessed AI solution designs from vendors, internal teams, and integrators in live governance contexts.
Structured coverage: 84 structured review areas spanning identity through integration security, informed by NIST AI RMF, NIST CSF 2.0, ISO 42001, and OWASP LLM/GenAI guidance; applicability depends on deployment pattern.
Inspectable methodology: Mayhem Shield Framework for independent review.

Deliverables

What a review produces

Documented, defensible material for approvers, scope-dependent:

Architecture and data-flow views with trust boundaries
Findings tracker: current vs. required state, severity, evidence per review area
Remediation roadmap with owners and dates
Written go/no-go with conditions at POC, pilot, production

Ready to start?

Discovery calls take twenty minutes.

We confirm deployment fit, outline review scope, and match you to the right packaged offer. No engagement starts until you decide to proceed.

Book a discovery call →