Cybersecurity Services in Albuquerque, NM
Albuquerque has learned about ransomware from its own institutions: the county jail's cameras and doors went dark in January 2022, and the school district lost its student records system the same month. NetSys gives Albuquerque businesses the controls that stop common attacks, from ThreatDown detection and multifactor sign-in to filtered email and backups that cannot be deleted, run remotely by engineers in Brooklyn.
The short answer
NetSys provides cybersecurity services to Albuquerque organizations: ThreatDown managed detection and response with Microsoft Defender for Business, Entra ID Conditional Access and multifactor authentication, Barracuda email protection, Rapid7 InsightVM vulnerability scanning, KnowBe4 phishing training, Keeper password management and immutable backups. Firms that work for Sandia, Kirtland or the defense primes can add NIST SP 800-171 and CMMC readiness work. Everything is delivered remotely, with no on-site engagements in Albuquerque. Alerts are watched 24/7, the help desk takes calls from 2 a.m. to 9 p.m. Mountain, and security is billed per user each month at a rate an assessment sets.
Service information by The NetSys Group. Our editorial standards.
How cybersecurity is delivered in Albuquerque
Security is the part of IT that works best from a console. ThreatDown agents report every suspicious process to analysts and to our engineers, who can isolate a laptop in Rio Rancho or a server in a Journal Center office from Brooklyn within minutes. Conditional Access policies, Intune compliance rules and Barracuda filtering are set in cloud consoles, and Rapid7 scans your external addresses and internal devices on a schedule. None of this requires an engineer in your building. When an incident calls for a physical step, such as unplugging a network cable, an engineer walks your staff through it by phone while the containment runs. Changes that could interrupt work are scheduled in Mountain time and announced to staff first. Monitoring runs 24/7 from Brooklyn, and so does emergency service. Our staffed help-desk hours are 4 a.m. to 11 p.m. Eastern time (2 a.m. to 9 p.m. Mountain), seven days a week. The proposal states severe-incident escalation, authorized remediation and any other after-hours work.
What Albuquerque's 2022 attacks show about common threats
On January 5, 2022, ransomware hit Bernalillo County's network. Security cameras and automatic doors at the Metropolitan Detention Center stopped working, detainees were confined to their cells, and county services such as marriage licenses, voter registration and real estate transactions were limited for days. A week later, ransomware locked Albuquerque Public Schools out of its student information system, and classes for about 75,000 students were canceled on January 13 and 14. In April 2024 New Mexico Highlands University canceled classes at all its campuses, including Albuquerque and Rio Rancho, after its own ransomware attack. Whatever the entry point in those cases, a business of 10 to 100 people is most exposed through a stolen password without multifactor protection, an unpatched internet-facing device or a remote-access tool left open, and those are what we close first.
Defense, laboratory and research suppliers
Kirtland Air Force Base put its economic impact at $7.5 billion in its fiscal 2024 statement, and Sandia National Laboratories spent $463 million with New Mexico small businesses in 2025. The Sandia Science and Technology Park beside the base held 47 companies at the end of 2025. Subcontractors in that chain handle controlled unclassified information, which DFARS 252.204-7012 requires them to protect with NIST SP 800-171 Revision 2. The Department of War suspended CMMC Phase 2, the third-party Level 2 certification that was to begin November 10, 2026, on July 13, 2026, yet the 800-171 controls, Level 1 and Level 2 self-assessments, and an up-to-date SPRS score with its affirmation remain required. We scope the CUI boundary, build it, write the system security plan and keep the evidence current.
Healthcare, film and professional offices
Outside the defense economy, Albuquerque's security needs follow its other big sectors. Physician groups, imaging centers and therapy practices around the UNM, Presbyterian and Lovelace systems carry the HIPAA Security Rule, which expects a written risk analysis, controls on who can open records, audit logging and a contingency plan. Production companies drawn by the Netflix-owned studio campus at Mesa del Sol move unreleased footage between editors and vendors, so shared links, guest accounts and storage permissions need tight rules. Engineering, accounting and law offices Downtown and in Uptown are prime targets for business email compromise, where a spoofed or hijacked mailbox redirects a wire. For each, we set DMARC to reduce spoofing, require multifactor sign-in, restrict external sharing, train staff with KnowBe4 simulations and keep logs long enough to reconstruct what happened.
An Albuquerque security checklist for the first 30 days
Week one: ThreatDown and Defender go onto every endpoint, Rapid7 scans your external addresses and internal network, and we pull your Microsoft 365 secure score. Week two: multifactor sign-in for every account under Conditional Access, legacy authentication blocked, admin roles cut to the people who need them, and Keeper rolled out for shared credentials. Week three: Barracuda filtering, DMARC moved toward enforcement, and the first KnowBe4 phishing test, with results by department. Week four: backups made immutable and a restore tested, a written incident response plan with phone numbers, and a findings report ranked by risk with a remediation schedule. If you want an outside view before deciding, start with a free external penetration test within an agreed scope.
Cybersecurity in Albuquerque: what NetSys delivers
Detection and response
- ThreatDown managed detection and response with EDR agents on every workstation, laptop and server, monitored 24/7
- Microsoft Defender for Business and Rapid7 InsightIDR telemetry from identities, email and endpoints, with a person acting on alerts
Identity and email
- Entra ID Conditional Access and multifactor authentication across Microsoft 365, with legacy authentication switched off
- Privileged access and privileged identity management so admin rights are granted just in time and removed afterwards
Exposure and recovery
- Rapid7 InsightVM vulnerability scanning on a schedule, with findings fixed rather than filed
- Cisco Meraki or Fortinet firewall management, segmentation and DNS filtering on office and remote devices
Firewall, antivirus and maintenance for a five-person office
A five-person office needed the basics done properly rather than an enterprise stack. NetSys replaced the internet provider's router with a business-grade firewall configured with sensible rules, secure remote access and logging, deployed managed antivirus on every machine with updates and alerts handled centrally, and put patching, backup checks and health reviews on a schedule. The agreement covers what the office needs and nothing it does not, month to month. No outcome figures were measured for publication.
Cybersecurity work for other clients
- Insurance
Regional title insurance company
Barracuda email protection for 85 users, phishing simulations, employee security training, and MFA deployment.
Security Awareness & Phishing TrainingIT for Insurance Agencies and Brokers
Client names are withheld. These examples were chosen for the work involved, not for where the client is, so none is presented as a Albuquerque client.
What cybersecurity costs in Albuquerque
Cybersecurity is priced per user per month when it runs as an ongoing service, and per project for an assessment or a remediation. What moves the number: how many devices and identities are in scope, how much incident remediation and recovery is needed beyond the monitoring and authorized MDR actions in scope, which compliance standard the evidence has to satisfy, and whether the Microsoft 365 tenant is already on Business Premium or the security tooling comes from us. The free external penetration test costs nothing and runs remotely before any of that. Our managed IT pricing page explains how the fee is built.
Who this fits, and who it does not
Best fit: businesses with enough people, money movement or regulated data that a breach would hurt, and no security team of their own: professional practices, healthcare groups, importers, financial firms, nonprofits and agencies holding client credentials. Companies with an internal IT person fit as a co-managed arrangement.
Read next
Industry pages: IT for Government Contractors · IT for Healthcare
Terms used on this page: Managed Detection and Response (MDR) · Endpoint Detection and Response (EDR) · Conditional Access
Guides: MDR versus antivirus for a small business · the Conditional Access policies to turn on first
Related pages
Read the full Cyber Security service page. See all locations and service areas.
Also in Albuquerque: IT Consulting · Managed IT Services · IT Support
Cybersecurity elsewhere: Denver · Bellevue, Washington · Colorado · Colorado Springs · Hawaii · Las Vegas
Related services: Penetration Testing · Cyber Insurance Readiness · Security Assessments · Managed Detection & Response (MDR)
Cybersecurity in Albuquerque: FAQs
How does cybersecurity work for Albuquerque organizations?
Our Brooklyn engineers run it with agents on each device and the admin portals for your tenant. ThreatDown and Defender watch every endpoint around the clock, a compromised machine can be cut off remotely, and Conditional Access, email filtering and backups are managed centrally. Staff can forward a suspicious message to us any time from 2 a.m. to 9 p.m. Mountain, and a confirmed incident reaches your assigned engineer at any hour. We do not put engineers in Albuquerque offices, and nothing in the service depends on someone being there.
How much do cybersecurity services cost in Albuquerque?
Security comes inside every NetSys managed IT agreement, at a per-user monthly rate that follows an assessment. Bought on its own, the price depends on the number of users and devices, how many servers and cloud tenants we monitor, whether you need NIST SP 800-171 documentation or a HIPAA risk analysis, and how much remediation the first scan uncovers. Projects such as building a CUI enclave get their own quote. NetSys publishes no price list, and no long-term contract is required.
Which cybersecurity requirements apply to businesses in Albuquerque?
Most businesses holding New Mexicans' personal information fall under the Data Breach Notification Act, which requires reasonable security, security duties written into service-provider contracts, and notice within 45 days of discovering a breach, with Attorney General notice above 1,000 affected residents. Organizations covered by HIPAA or Gramm-Leach-Bliley are exempt from the Act and follow those federal rules instead. Tax preparers add the FTC Safeguards Rule and IRS Publication 4557, and defense subcontractors DFARS 252.204-7012 with NIST SP 800-171. This is general information, not legal advice.
Can you help us prepare for CMMC while Phase 2 is suspended?
Yes, and the suspension does not pause the work that matters. DFARS 252.204-7012 still requires NIST SP 800-171 Revision 2 controls for covered defense information, and your SPRS score and affirmation must stay current. We start with a gap assessment against the 110 requirements, then define the CUI boundary, often a separate enclave so the whole company does not have to meet every control. Next come the written security plan and a dated list of open items, with the logging, access reviews and training records an assessor would ask for, so you are ready when certification resumes.
Is there a free security test for Albuquerque businesses?
Yes, one. NetSys offers a free external penetration test, run remotely within a scope you approve. It examines what your business exposes to the internet: open remote-desktop or VPN ports, an out-of-date firewall, forgotten test servers and weak email authentication records. The report lists each finding, how serious it is and what the test could not see, since an external test says nothing about the inside of your network. It is a useful first step whether or not you hire us afterward.
See what an attacker sees before they do.
The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Internal reviews and ongoing security management are scoped separately.