Cybersecurity Services in Illinois
Illinois has seen ransomware help close a hospital, take a children's hospital's systems offline for weeks and knock out a school district's phones and student records. NetSys gives Illinois businesses the controls that stop those attacks early: managed detection and response, multifactor sign-in, email filtering, immutable backups and the evidence state privacy laws expect, all delivered remotely from Brooklyn.
The short answer
NetSys provides cybersecurity services to Illinois organizations: ThreatDown managed detection and response with Microsoft Defender for Business on every endpoint, multifactor authentication enforced by Entra ID Conditional Access, Barracuda email protection, Rapid7 InsightVM vulnerability scanning, KnowBe4 phishing training, Keeper password management and immutable Datto or Veeam backups. Engineers deliver it remotely and through the cloud; there is no on-site service anywhere in Illinois. Monitoring and emergency response run 24/7, the help desk answers from 3 a.m. to 10 p.m. Central seven days a week, and pricing is per user per month after an assessment.
Service information by The NetSys Group. Our editorial standards.
How cybersecurity is delivered to Illinois organizations
Every control is deployed and operated from Brooklyn. ThreatDown agents and Defender policies go out through Intune, Conditional Access is set in Entra ID, Barracuda sits in front of Microsoft 365 mail, and Rapid7 scans run against your endpoints and your external addresses. When ThreatDown flags ransomware behavior, an engineer can cut the machine off from the network remotely, stop the process and begin the investigation without anyone at the office touching it. Accounts with risky sign-ins are blocked and reset the same way. Recovery is remote as well: clean builds go out through Windows Autopilot and data comes back from immutable backups. NetSys does not send engineers into Illinois offices, so the rare physical step, such as unplugging a device, is done by your staff while our engineer stays on the call. Monitoring runs 24/7 from Brooklyn, and so does emergency service. Our staffed help-desk hours are 4 a.m. to 11 p.m. Eastern time (3 a.m. to 10 p.m. Central), seven days a week. The proposal states severe-incident escalation, authorized remediation and any other after-hours work.
Illinois attacks that set the priorities
Three Illinois incidents explain what we put first. St. Margaret's Health in Spring Valley was hit by ransomware in early 2021, could not submit claims to insurers, Medicare and Medicaid for months, and when its hospital closed on June 16, 2023 the system named the attack as one of the reasons. At Lurie Children's Hospital in Chicago, intruders were inside the network from January 26 to 31, 2024; the hospital took systems offline and later notified 791,784 people. On September 6, 2019, ransomware took down internet, phones and the student information system at Rockford Public Schools, and teachers took attendance by hand. The lessons are concrete: backups the attacker cannot reach, detection that stops an intruder before data leaves, segmentation so one infected machine cannot reach everything, and a written plan for working through an outage.
Email fraud and stolen sign-ins in Illinois
Most losses here start in an inbox rather than a server room. In the FBI's 2025 Internet Crime Report, Illinois ranked fifth in the country for complaints, with just under 33,000, and eighth for losses, which rose to $535 million from $479 million in 2024. Business email compromise follows a familiar pattern: a stolen Microsoft 365 password, a quiet inbox rule that hides replies, then an invoice or payroll change sent from a real account. Our controls target each step. Conditional Access requires multifactor sign-in and blocks legacy protocols, sign-ins from unusual countries are flagged, new forwarding and inbox rules raise an alert, and Barracuda screens impersonation attempts. We publish DMARC records to reduce spoofing of your domain, help you adopt a callback rule for any change to payment instructions, and run KnowBe4 phishing exercises for every employee.
Biometric data, customer records and Illinois security duties
Illinois writes security duties into its privacy laws, and they translate into controls. Section 45 of the Personal Information Protection Act (815 ILCS 530) requires reasonable security measures for records holding residents' personal information, a category that includes medical and health insurance information, biometric data and a username or email address paired with its password, and contracts that share those records must require the recipient to protect them as well. Section 15 of the Biometric Information Privacy Act (740 ILCS 14) requires biometric identifiers to be stored, transmitted and protected with the industry's reasonable standard of care and at least as carefully as other confidential information, under a public policy that destroys them once their purpose is met or within three years of the person's last interaction. We find where timeclock and door-reader templates live, encrypt and restrict them, and keep the retention evidence. This is general information, not legal advice.
Plant floors, defense suppliers and the CMMC pause
Manufacturing is where a security incident stops shipments. In Rockford's aerospace cluster, the Peoria and Decatur supply chains and the industrial parks along I-88 and I-90, plant networks often still carry machine controllers and engineering workstations that cannot be patched on the office schedule. We separate them: the shop floor gets its own firewall segment, vendor remote access is granted per session and logged, and Rapid7 tracks what can and cannot be updated. Suppliers to defense programs face one more question. The Department of War suspended CMMC Phase 2 on July 13, 2026, the third-party Level 2 certification planned to start November 10, 2026, while a reform task force reviews the program. Level 1 and Level 2 self-assessments, a current SPRS score and affirmation, DFARS 252.204-7012 and NIST SP 800-171 Revision 2 all still apply, and we keep that evidence current.
Cybersecurity in Illinois: what NetSys delivers
Detection and response
- ThreatDown managed detection and response with EDR agents on every workstation, laptop and server, monitored 24/7
- Microsoft Defender for Business and Rapid7 InsightIDR telemetry from identities, email and endpoints, with a person acting on alerts
Identity and email
- Entra ID Conditional Access and multifactor authentication across Microsoft 365, with legacy authentication switched off
- Privileged access and privileged identity management so admin rights are granted just in time and removed afterwards
Exposure and recovery
- Rapid7 InsightVM vulnerability scanning on a schedule, with findings fixed rather than filed
- Cisco Meraki or Fortinet firewall management, segmentation and DNS filtering on office and remote devices
Law office: layered security on Microsoft 365 with cloud-to-cloud backup
A 25-attorney firm needed client confidences protected better than a closet server could manage. Alongside a Microsoft 365 migration, NetSys layered anti-phishing and email threat protection, DNS filtering, multifactor authentication on every account and endpoint protection across attorney devices in the office and remote, and established independent cloud-to-cloud backup of the entire tenant because the recycle bin is not a backup strategy for privileged material. The firm reported 82% fewer IT support incidents per month within two quarters.
Cybersecurity work for other clients
- Insurance
Regional title insurance company
Barracuda email protection for 85 users, phishing simulations, employee security training, and MFA deployment.
Security Awareness & Phishing TrainingIT for Insurance Agencies and Brokers
Client names are withheld. These examples were chosen for the work involved, not for where the client is, so none is presented as a Illinois client.
What cybersecurity costs in Illinois
Cybersecurity is priced per user per month when it runs as an ongoing service, and per project for an assessment or a remediation. What moves the number: how many devices and identities are in scope, how much incident remediation and recovery is needed beyond the monitoring and authorized MDR actions in scope, which compliance standard the evidence has to satisfy, and whether the Microsoft 365 tenant is already on Business Premium or the security tooling comes from us. The free external penetration test costs nothing and runs remotely before any of that. Our managed IT pricing page explains how the fee is built.
Who this fits, and who it does not
Best fit: businesses with enough people, money movement or regulated data that a breach would hurt, and no security team of their own: professional practices, healthcare groups, importers, financial firms, nonprofits and agencies holding client credentials. Companies with an internal IT person fit as a co-managed arrangement.
Read next
Industry pages: IT for Manufacturing · IT for Logistics & Transportation
Terms used on this page: Managed Detection and Response (MDR) · Endpoint Detection and Response (EDR) · Conditional Access
Guides: MDR versus antivirus for a small business · the Conditional Access policies to turn on first
Related pages
Read the full Cyber Security service page. See all locations and service areas.
Also in Illinois: Managed IT Services
Cybersecurity elsewhere: Chicago · Cincinnati · Columbus · Detroit · Indiana · Indianapolis
Related services: Penetration Testing · Cyber Insurance Readiness · Security Assessments · Managed Detection & Response (MDR)
Cybersecurity in Illinois: FAQs
How does cybersecurity work for Illinois organizations?
We deploy the tools remotely, monitor them around the clock and respond from Brooklyn. ThreatDown and Defender alerts go to engineers who can isolate an endpoint, disable an account or block a sender as soon as a threat is confirmed, and critical issues carry a ten-minute phone response and a thirty-minute remote response. The help desk handles everyday security questions from 3 a.m. to 10 p.m. Central, every day. We do not send engineers on site in Illinois; your staff handle any physical step with our engineer on the line, and the agreement runs month to month.
How much do cybersecurity services cost in Illinois?
Cybersecurity is included in every NetSys managed IT agreement, priced per user per month after an assessment, and it can also be scoped on its own for a company that keeps its current IT support. We do not publish a rate. The figure depends on the number of users and endpoints, servers and cloud workloads, how many sites and firewalls are in scope, whether you need documentation for HIPAA, the FTC Safeguards Rule or Regulation S-P, and how much remediation the first scan turns up. Projects such as a firewall replacement are quoted separately.
Which cybersecurity requirements apply to businesses in Illinois?
Any business holding residents' personal information falls under the Personal Information Protection Act, which pairs a reasonable-security duty with breach notice to residents and, above 500 affected residents, to the Attorney General. A private company collecting fingerprints, face geometry or other biometrics must also follow the Biometric Information Privacy Act. Industry rules sit on top: the HIPAA Security Rule for medical practices, the FTC Safeguards Rule and IRS Publication 4557 for tax preparers, Regulation S-P for SEC-registered advisers and broker-dealers, and NIST SP 800-171 for defense suppliers. We map which apply during discovery and document the controls for each.
Can you support our Illinois office remotely, and what does onboarding look like?
Yes, onboarding is remote from start to finish. In the first week we install NinjaOne and ThreatDown on every endpoint, run a Rapid7 scan and review Microsoft 365 sign-in logs and mailbox rules, which sometimes turn up an old compromise. In weeks two and three we switch on Conditional Access with multifactor sign-in, connect Barracuda, publish DMARC in monitoring mode, move shared passwords into Keeper and start KnowBe4 training. By week four the backups are immutable and a test restore has been recorded. Staff see new sign-in prompts and short training modules, and nobody has to be in the office for any of it.
What should we do in the first hour of a ransomware attack?
Call us before you touch anything. Severe incidents go straight to your dedicated engineer, who isolates affected machines through ThreatDown, disables compromised accounts and preserves logs for your insurer and counsel. Do not wipe or reboot servers, and do not contact the attackers. NetSys has handled more than 30 ransomware incidents in the last three years and every one was fully recovered; clients with a disaster recovery plan in place were back within 24 hours. That record depends on backups the attacker cannot reach, which is why every managed agreement includes immutable copies and quarterly restore tests.
See what an attacker sees before they do.
The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Internal reviews and ongoing security management are scoped separately.