Cybersecurity · Chicago

Cybersecurity Services in Chicago, IL

Chicago has seen what one intrusion can cost: a children's hospital forced offline, and dealerships across North America back on paper after a Hoffman Estates software provider was attacked. NetSys protects Chicago businesses with managed detection and response, identity and email controls, scanning, training and backups that actually restore, all run remotely from Brooklyn.

The short answer

NetSys provides cybersecurity services to Chicago businesses: ThreatDown managed detection and response on every computer and server, Microsoft Defender for Business, multifactor sign-in with Entra ID Conditional Access, Barracuda email protection with DMARC, Rapid7 InsightVM vulnerability scanning, KnowBe4 security training, Keeper password management and immutable backups that we restore-test. Engineers act on alerts themselves, isolating a device or locking an account at any hour. The service is remote and cloud-based, with no engineers sent on site in Chicago, and ongoing protection is a per-user monthly fee on a month-to-month agreement.

Service information by The NetSys Group. Our editorial standards.

How cybersecurity is delivered for Chicago organizations

Protection is delivered through software agents and cloud consoles, which is why distance does not slow it down. ThreatDown runs on each endpoint and reports to analysts and to our engineers; when it sees ransomware behavior, the device is cut off from the network while the investigation starts. Sign-in policy lives in Entra ID, mail filtering in Barracuda and scanning in Rapid7, and every change is logged in IT Glue. NetSys does not send engineers on site in Chicago, so incident response is remote as well: from Brooklyn, an engineer can isolate a laptop, revoke a stolen session, delete a malicious forwarding rule and begin a restore well before anyone could cross the Loop at rush hour. Where a firewall must be replaced, it ships with its rules preloaded and is checked from the console once your contractor connects it. Monitoring runs 24/7 from Brooklyn, and so does emergency service. Our staffed help-desk hours are 4 a.m. to 11 p.m. Eastern time (3 a.m. to 10 p.m. Central), seven days a week. The proposal states severe-incident escalation, authorized remediation and any other after-hours work.

Chicago incidents and what they teach

The region's recent incidents work as a practical checklist. Intruders were inside the systems of Lurie Children's Hospital from January 26 to 31, 2024; the hospital took its network offline, did not pay a $3.4 million demand from the Rhysida group and later notified 791,784 people. On June 19, 2024, cyberattacks on CDK Global, the Hoffman Estates dealer-software company serving more than 15,000 retail locations, pushed dealerships across North America back to pen and paper. Chicago Public Schools learned in 2022 that a December 2021 ransomware attack on one of its vendors, Battelle for Kids, had exposed records of about 495,000 students and 56,000 employees. The lessons are specific: detect and contain early, keep backups attackers cannot delete, and treat every vendor that holds your data as part of your own attack surface.

The controls we put in place

Business email compromise and ransomware usually begin with a stolen sign-in or a malicious message, so identity and email come first. Every account gets app-based or phishing-resistant multifactor sign-in, and Conditional Access blocks sign-ins from unmanaged devices and from countries where you have no staff. Barracuda filters inbound mail, and we publish SPF, DKIM and DMARC records so criminals have a harder time sending as your domain. ThreatDown MDR and Defender cover endpoints; Rapid7 InsightVM scans for missing patches and exposed services every month; KnowBe4 runs short phishing exercises with results by department; Keeper replaces shared spreadsheets of passwords. Backups in Datto or Veeam are immutable and restore-tested each quarter. Admin accounts stay separate from daily accounts, and our own remote tools sit behind the same sign-in rules, because attackers target an IT provider's access too.

Wire fraud, vendor accounts and Chicago's payment flows

Chicago runs on payments: trading settlements, legal escrow, freight invoices, real estate closings and payroll for large hourly workforces. That makes business email compromise as dangerous as ransomware. A criminal who gets into one mailbox, often a vendor's, waits for an invoice and changes the bank details. Our controls for this are specific. We alert on new inbox rules that forward or hide mail, flag sign-ins from new countries, label external senders and block lookalike domains at the Barracuda gateway. We also help you write a payment rule no technology can replace: any change to bank instructions is confirmed by calling a known number, never one taken from the email. When a vendor tells you it has been breached, we search your tenant for its recent messages, reset any shared credentials and review recent payments with your finance team.

Illinois law, biometrics and breach notices

Illinois adds obligations most states do not. The Biometric Information Privacy Act, 740 ILCS 14, requires a public retention and destruction policy and written consent before a business collects fingerprints, face geometry or similar identifiers, and it lets individuals sue; since an amendment signed on August 2, 2024, repeated scans of the same person by the same method count as one violation. The Personal Information Protection Act requires reasonable security measures for residents' personal information and notice to affected people after a breach, plus notice to the Attorney General once more than 500 Illinois residents are involved. Advisers and broker-dealers also answer to the SEC's amended Regulation S-P, whose compliance dates have passed for firms of every size, and medical practices to HIPAA. We map those duties to controls and evidence. This is general information, not legal advice.

What is included

Cybersecurity in Chicago: what NetSys delivers

Detection and response

ThreatDown managed detection and response with EDR agents on every workstation, laptop and server, monitored 24/7
Microsoft Defender for Business and Rapid7 InsightIDR telemetry from identities, email and endpoints, with a person acting on alerts

Identity and email

Entra ID Conditional Access and multifactor authentication across Microsoft 365, with legacy authentication switched off
Privileged access and privileged identity management so admin rights are granted just in time and removed afterwards

Exposure and recovery

Rapid7 InsightVM vulnerability scanning on a schedule, with findings fixed rather than filed
Cisco Meraki or Fortinet firewall management, segmentation and DNS filtering on office and remote devices

Published case study

Firewall, antivirus and maintenance for a five-person office

A five-person office needed the basics done properly rather than an enterprise stack. NetSys replaced the internet provider's router with a business-grade firewall configured with sensible rules, secure remote access and logging, deployed managed antivirus on every machine with updates and alerts handled centrally, and put patching, backup checks and health reviews on a schedule. The agreement covers what the office needs and nothing it does not, month to month. No outcome figures were measured for publication.

Read the full case study (5-person office)

From our client work

Cybersecurity work for other clients

Insurance
Regional title insurance company
Barracuda email protection for 85 users, phishing simulations, employee security training, and MFA deployment.
Security Awareness & Phishing Training IT for Insurance Agencies and Brokers

Client names are withheld. These examples were chosen for the work involved, not for where the client is, so none is presented as a Chicago client.

What cybersecurity costs in Chicago

Cybersecurity is priced per user per month when it runs as an ongoing service, and per project for an assessment or a remediation. What moves the number: how many devices and identities are in scope, how much incident remediation and recovery is needed beyond the monitoring and authorized MDR actions in scope, which compliance standard the evidence has to satisfy, and whether the Microsoft 365 tenant is already on Business Premium or the security tooling comes from us. The free external penetration test costs nothing and runs remotely before any of that. Our managed IT pricing page explains how the fee is built.

How the monthly fee is built

Who this fits, and who it does not

Best fit: businesses with enough people, money movement or regulated data that a breach would hurt, and no security team of their own: professional practices, healthcare groups, importers, financial firms, nonprofits and agencies holding client credentials. Companies with an internal IT person fit as a co-managed arrangement.

Cybersecurity in Chicago: FAQs

How does cybersecurity work for Chicago organizations?

It runs remotely, around the clock, from the agents on your devices and the policies in your Microsoft 365 tenant. ThreatDown MDR watches every endpoint 24/7, and an engineer acts on serious alerts by isolating the device and locking affected accounts, then works the cleanup with your team. Routine work such as patch scanning, sign-in policy changes and phishing tests is scheduled in advance. Your staff report suspicious messages or problems to the help desk from 3 a.m. to 10 p.m. Central. NetSys does not send engineers to Chicago; everything, including incident response, is handled from Brooklyn.

What does the free external penetration test include?

It is a remote test of what your business exposes to the internet, run within a written scope we agree with you first: typically your firewall and VPN, email and sign-in pages, public websites and any remote-access portals. We report what an outside attacker could find or exploit, how serious each finding is and what we would fix first, with the scope and its limits stated plainly. It does not cover your internal network, Microsoft 365 settings, devices or backups; reviewing those is a separate, paid engagement. It is the only free service NetSys offers.

Will this help with our cyber insurance renewal?

Usually, yes. Carrier applications ask about the same few controls: multifactor sign-in on email, remote access and admin accounts; endpoint detection and response; backups kept offline or immutable and tested; phishing training; and a patching process. The service puts each of those in place and produces the evidence an underwriter asks for, such as MFA coverage reports, the EDR console's device list and restore-test records. We can also help you answer the questionnaire accurately, which matters, because an inaccurate answer can complicate a claim. Our cyber insurance readiness page lists what carriers are asking for this year.

What should a Chicago business do in the first hour of a ransomware attack?

Disconnect affected computers from the network but leave them powered on, so evidence survives. Do not pay or contact the attackers. Call your IT provider's emergency line and your cyber insurer's breach hotline, because many policies require their approved responders. Then preserve logs, change passwords from a clean device and decide with counsel whether Illinois notice rules apply. For NetSys clients, ransomware goes directly to a dedicated engineer, who isolates devices through ThreatDown and starts restores from immutable backups. Over the last three years we have handled more than 30 ransomware incidents and recovered every one.

Is biometric timeclock data a cybersecurity issue?

Yes, and in Illinois it is also a legal one. Fingerprint and face templates stored by a timeclock or door system are biometric identifiers under BIPA, so a breach of that system is worse than a lost password: nobody can reissue a fingerprint. We find where templates are stored, whether on the device, a local server or the vendor's cloud, put those systems on their own network segment, patch them, restrict who can export data and check that deletion happens on the schedule your written policy promises. We also read the vendor contract for its security commitments.

Start with the free test

See what an attacker sees before they do.

The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Internal reviews and ongoing security management are scoped separately.

Explore Cybersecurity Scope 845-203-3914