This is a one-time, fixed-scope engagement. No ongoing contract, no upsell required. You get a clear written picture of where you stand and what to fix first.

Request a quote

Who it's for

  • Leadership teams that want an outside, plain-English view of their risk before a board meeting, audit, insurance renewal or funding round.
  • Organizations whose staff already use ChatGPT, Copilot or other AI tools, with no written policy yet.
  • Companies about to renew, switch or sign IT and software contracts and want to know what they're agreeing to.
  • Businesses with an internal IT person or current provider who want an independent second opinion.

What we review

1. Security posture

  • Microsoft 365: tenant settings, sharing, admin roles, audit logging.
  • Identity: MFA coverage, conditional access, stale and privileged accounts.
  • Endpoints: device protection, patching, encryption, local admin rights.
  • Backups: what's backed up, how often, and whether restores have been tested.
  • Email security: filtering, SPF/DKIM/DMARC, impersonation and phishing protection.

2. Vendor and IT contract review

  • SLAs: what response and resolution times are actually promised, and what happens if they're missed.
  • Auto-renewals: renewal dates, notice windows and price-increase terms.
  • Data ownership: who owns your data, and how you get it back if you leave.
  • Security obligations: what your vendors are required to protect, report and notify you about.

3. AI governance

  • AI usage inventory: which AI tools are in use, by whom, and for what.
  • Acceptable-use policy: a clear policy your team can follow, drafted or reviewed.
  • Data exposure in Copilot and ChatGPT: what company data these tools can reach or receive.
  • Vendor AI terms: whether your software vendors use your data to train AI, and what you've agreed to.

What you get

  • Written findings: what we checked, what we found, and why it matters, in plain language.
  • Prioritized roadmap: fixes ranked by risk and effort, so you know what to do first.
  • Readout meeting: we walk your team through the results and answer questions.

You can act on the roadmap yourself, with your current provider, or with us. Your choice.

How it works

  1. Short call. We learn about your business, tools and concerns, then send a fixed-scope quote.
  2. Review. We gather access and documents, interview key people, and do the assessment.
  3. Readout. You get written findings and a prioritized roadmap, and we walk you through them.

Why CyberLynx

  • Cybersecurity-first. Security drives how we look at every system, contract and tool.
  • Techs you know. You work with the same people from kickoff to readout.
  • No lock-in. This assessment stands alone. Our managed services are month-to-month too.
  • Local and accountable. Headquartered in Bethesda, MD. Service-Disabled Veteran-Owned Small Business (SDVOSB).

Want a quick look first? We run a free M365 Security Grade for your Microsoft 365 tenant.

Hear how security leaders handle AI and vendor risk on The Cyber Business Podcast

FAQs

Is this a one-time engagement?

Yes. It's a fixed-scope, one-time assessment with no ongoing contract.

How much does it cost?

Every organization is different, so we give a fixed-scope quote after a short call. You'll know the price before we start.

Do we have to be a CyberLynx client?

No. Many organizations use this as an independent review alongside their current IT provider or internal team.

Can you review just one area, like AI governance?

Yes. We can scope the assessment to one or two of the three areas.

What do you need from us?

Admin or read-only access to key systems, copies of relevant IT and software contracts, and short conversations with a few people on your team. We'll send a checklist after the call.

Will you write our AI acceptable-use policy?

We can draft one or review yours as part of the AI governance scope, and include it in your findings.

Request a quote

Tell us a little about your organization and we'll set up a short call. Or call (301) 798-9170, Mon–Fri 9–5.