AI Governance, Security & Compliance Program
Know what AI can reach in your business, keep it locked down, and be ready for every insurance renewal.
A read-only program for Microsoft 365 that scores AI exposure, identity, data sharing and email security, gives you a fix plan and an insurance readiness summary, then re-scans every month so gaps stay closed.
Your team is already using AI. Some of it is approved. A lot of it isn't: free chatbots on personal accounts, meeting note-takers, browser extensions and apps that someone clicked "Allow" on and nobody reviewed. Each one is a place your client files, contracts and email can end up.
At the same time, cyber insurers ask harder questions every renewal: MFA everywhere, backups you can restore, admin accounts locked down, and more and more often, how you control AI. A wrong answer on that form can cost you the claim you bought the policy for.
And settings drift. A new hire, a new app or a quick fix on a Friday afternoon, and something that was right last quarter isn't right now. A one-time report can't catch that. A monthly re-scan does.
Built for
- Businesses of 10 to 999 people on Microsoft 365
- Teams rolling out, or thinking about, Copilot or Gemini
- Firms that handle client data: professional services, healthcare, finance
- Anyone with a cyber insurance renewal coming up
What it looks like before and after
Typical situations we see in growing businesses. Illustrations, not client stories.
Turning on Copilot
Before
Leadership buys Copilot licenses. A week later someone asks it about bonuses and gets last year's payroll file through an old sharing link.
After
The scan finds overshared sites and anyone-with-the-link files first. You close them before licenses go live, and the monthly re-scan catches new ones.
The insurance renewal form
Before
The form asks whether every admin account uses MFA. Someone ticks yes. Two admin accounts don't.
After
Your insurance readiness summary shows what's actually configured, with the scan date, so the answers you give match your settings.
AI apps nobody approved
Before
Staff connect a free meeting note-taker and a browser extension that can read mailboxes. Nobody reviews either one.
After
Every AI and third-party app with access to mail and files is listed with what it can read, so you approve it or remove it.
Concrete deliverables, not a slide deck
One clear score
A single score across identity, AI and app governance, data exposure and email security, with Microsoft Secure Score shown beside it, never blended in.
AI exposure findings
Every AI and third-party app connected to your mail and files, what it can read, and the overshared files and sites an AI assistant would surface.
Security baseline checks
Identity, admin and email configuration checked against the CISA SCuBA secure configuration baselines, mapped to the NIST Cybersecurity Framework and the NIST AI Risk Management Framework.
Insurance readiness summary
A PDF that lines your scanned settings up against the questions underwriters ask, with the scan date on every answer, refreshed before each renewal. It's a summary for you, not a filled-in application.
Fix plan, tracked to done
Plain-English findings ranked by risk and effort, each with an owner and a status, so you and your IT team or MSP work from the same list.
Monthly re-scan and dashboard
Your score tracked over time, anything that drifted called out, and a monthly check-in on what to fix next.
Recognized standards, checked automatically every month
Every scan reads your settings through a read-only connection and checks them against published standards. No spreadsheets, no guesswork, nothing installed. Mapped to these frameworks, never a claim that you “comply” with them.
CISA SCuBA secure configuration baselines
The US Cybersecurity and Infrastructure Security Agency's baselines for Microsoft 365 and Google Workspace: MFA, Conditional Access, legacy sign-in, admin roles, guest access, app consent and more. Every scan checks your settings against them.
NIST Cybersecurity Framework (CSF) 2.0
Every finding is mapped to the NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover), so you see your posture in the language auditors, insurers and larger clients use.
NIST AI Risk Management Framework (AI RMF)
AI findings are mapped to the NIST AI RMF functions (Govern, Map, Measure, Manage), NIST's framework for managing AI risk.
Microsoft Secure Score
Microsoft's own posture score and its per-control results, pulled straight from your tenant and shown beside our score, never blended into it.
Email authentication: SPF, DKIM and DMARC
Checked against your public DNS records every scan, because spoofed email is one of the most common ways invoice fraud starts.
Community Entra ID security tests
Identity tests drawn from the open-source Maester project and the EIDSCA configuration checks, rebuilt in our own code so nothing is installed in your tenant.
The AI checks standard security tools don't run
Every AI app that can reach your data
We list each AI and third-party app connected to your mail, files and calendar, how many people use it and exactly what it can read, matched against our catalog of AI apps.
What Copilot would surface
Anyone-with-the-link files, sites shared with everyone and external sharing: the oversharing an AI assistant turns into instant answers for the wrong person.
Who can let new apps in
Whether any employee can grant an app access to company data on their own, and whether an admin approval process exists.
What your licenses can't check
If your Microsoft 365 plan doesn't include a security feature a check needs, we tell you, instead of quietly skipping it.
One score across every source
Baselines, Secure Score, email records and AI checks rolled into one plain-English score, with critical gaps capping the score so a single missing control can't hide.
Proof your IT team can verify
Each finding has a technical detail view with the setting we read and the baseline item it mirrors, so your IT team or MSP can confirm it.
Four steps, no surprises
Scope call
20 minutes on your size, platform and renewal date. You see the exact price before you sign.
Approve read-only access
Your Microsoft 365 admin approves a read-only connection with one click. We can't change, send or delete anything.
First assessment
The full scan, report, insurance readiness summary and 30/60/90-day fix plan, walked through live.
Every month after
Automated re-scans, drift alerts, your dashboard and a monthly check-in, so the gaps stay closed.
Pricing
| Company size | Monthly |
|---|---|
| 1 to 50 users | $299/mo |
| 51 to 150 users | $399/mo |
| 151 to 300 users | $499/mo |
| 301 to 999 users | $599/mo |
- 3-month minimum, then month to month. Cancel any time after that.
- The $500 setup fee covers connecting your tenant, your first full assessment and the walkthrough call.
- Founding clients: setup fee waived for our first 5 clients in exchange for a case study.
- 1,000+ users: tell us your size and we'll quote it.
Why not just…
Do nothing
Gaps stay invisible until an incident, a client questionnaire or a claim exposes them.
Leave it to your MSP
Good at keeping things running, but rarely independent, and few track AI apps and oversharing every month.
One-time audit
A few thousand dollars for a report that's out of date the next time someone changes a setting.
Wolf Intelligence
Independent, read-only and re-checked every month, at a published monthly price.
Not ready for a call?
25 questions, about 10 minutes. See your risk score and top 5 gaps before you talk to anyone.
Questions
Can we just buy a one-time report?
No. A report is out of date the day a setting changes. The program keeps your score, your fix list and your insurance summary current, which is what an underwriter or a client actually cares about.
Can you change anything in our tenant?
No. The connection is read-only. We report what we find; your IT team or MSP makes the changes, and the next scan confirms them.
Do you look at the contents of our files and email?
No. The scan reads settings, permissions and sharing information, not the contents of documents or messages.
Will this make us compliant with HIPAA, SOC 2 or anything else?
No assessment can promise that, and we don't use the word. You get a clear picture of gaps against recognized frameworks and a plan to close them.
What about Google Workspace?
Microsoft 365 comes first. Google Workspace scanning is on the roadmap; if that's your platform, tell us and we'll let you know when it opens.
We already have an MSP. Does this replace them?
No. It gives you and your MSP an independent view and a shared fix list. We don't resell licenses, so we have no reason to find work for ourselves.
Related services
AI Readiness Assessment
A fixed-fee engagement that maps where AI can save time or make money in your business, checks whether your data and Microsoft 365 setup are ready for Copilot or Gemini, and hands you a prioritized roadmap.
$2,500 fixed fee, credited forward
AI Consulting & Automation Services
Fixed-fee projects that put AI to work safely: an AI policy your staff follow, a Copilot or Gemini rollout done right, workflow automations built on the tools you already own, and an on-call fractional AI lead.
Fixed-fee projects from $1,500