Armorstack operates as a service-area provider in Lexington and dispatches engineers to Fayette County and the surrounding Bluegrass counties for scheduled and emergency on-site work, with target response of 4 hours during business hours and 8 hours overnight. Our 24/7 SOC monitoring and vCISO/vCIO engagements are delivered with no geographic gap. Call 877-890-5508 to start scoping.

For an active incident with a service retainer in place, our incident response team is engaged within 30 minutes via SOC and on-site within 4-8 hours depending on time of day. We coordinate directly with the FBI Louisville Field Office (which covers all of Kentucky), the Kentucky State Police Electronic Crime Branch, and — for healthcare incidents — the Kentucky Cabinet for Health and Family Services Office of Inspector General when the incident meets federal or state thresholds.

We do not represent those institutions, but our team has extensive HIPAA, Epic, and Cerner / Oracle Health experience and works with their suppliers, specialty vendors, and adjacent providers. Our healthcare practice is built around the workflows and compliance frameworks the Tier-1 Lexington academic medical center and community hospital systems impose on partners and downstream covered entities — including NIH and FDA research-data flows that typical cybersecurity programs miss.

Yes. Our automotive-supplier engagements are scoped around IATF 16949, NIST 800-82 ICS for plant-floor OT systems, CMMC 2.0 for defense-adjacent component lines, ITAR/EAR for export-controlled subsystems, and OT/IT convergence monitoring. We work with the Tier-1, Tier-2, and Tier-3 supplier base across Scott County and the broader Bluegrass automotive corridor, and we structure our work around shift schedules at TMMK rather than against them.

Yes. We support university research environments, federally funded labs, and the academic-medical-center research enterprise with FERPA, NIH grants policy compliance, DFARS 252.204-7012 controlled-unclassified-information (CUI) handling, Common Rule (45 CFR 46) human-subjects-research data protection, and emerging AI-governance work for research models. Our practice is structured around higher-ed governance cycles, IRB cadences, and grant-reporting calendars.

Armorstack delivers CMMC Level 1 and Level 2 implementation and assessor coordination for Defense Industrial Base contractors, including the supplier base around Lexington’s automotive, technology, and university-research-adjacent firms with DoD scope. Our VERITY portfolio includes a credentialed CMMC practice that has prepared clients for first-attempt Level 2 certification. We coordinate with C3PAOs to deliver assessment-ready environments.

Managed IT engagements for 100-500 employee Lexington firms typically run $9,000-$35,000 per month depending on scope. vCISO and VERITY Compass retainers add $3,500-$12,000 per month. SOC monitoring is priced per asset. Most clients start with a fixed-fee assessment under $20,000 to establish scope before committing to ongoing services. Call 877-890-5508 for sizing on your specific environment.

Yes. Our CITADEL portfolio integrates access control, video surveillance, fire alarm monitoring, and low-voltage infrastructure with cybersecurity monitoring across hospital campuses, manufacturing plants, university buildings, and equine facilities. We work with NDAA Section 889-compliant equipment for federal-adjacent and defense-supplier engagements. Site surveys are scheduled within 5 business days of engagement.

Lexington’s academic medicine, automotive, higher-ed research, and technology sectors are deploying AI tools faster than most security programs can govern them. Armorstack’s SENTRY portfolio detects shadow AI, monitors prompt-injection patterns, and integrates AI risk reporting into your existing NIST CSF or NIST AI RMF program. A Shadow AI Discovery typically completes within 5-10 business days.

We work with engagements subject to the Kentucky Department of Insurance, the Kentucky Cabinet for Health and Family Services (Office of Inspector General), the Kentucky Department of Financial Institutions, the Kentucky Council on Postsecondary Education, the Kentucky Horse Racing Commission, the Kentucky Attorney General’s Office of Consumer Protection (KRS 365.732 breach notification), and the Commonwealth Office of Technology. Federal frameworks (NIST, CMMC, HIPAA, GLBA, SOX, NIH, FDA) are our primary focus; Kentucky-specific rules are layered on top.

Yes. We support thoroughbred breeders, stables, racing operations, and adjacent equine businesses across the Bluegrass with cybersecurity programs that account for Kentucky Horse Racing Commission record-keeping rules, federal HISA (Horseracing Integrity and Safety Act) data and reporting obligations, betting-platform PCI-DSS, and the international data flows that follow yearling sales and global breeding operations. The equine industry is a serious cybersecurity exposure surface; we treat it that way.

Schedule a 30-minute discovery call at armorstack.ai/contact/ or call 877-890-5508. The call is candid scoping — no pitch deck. If we agree there is a fit, the typical first engagement is a fixed-fee assessment with a defined deliverable in 4-6 weeks before any monthly retainer commitment. Many Lexington firms start with our 90-day no-contract assessment.