Cybersecurity Services in Michigan
Michigan hospitals, counties, libraries and universities have all made the news for phishing and ransomware since 2022. NetSys gives Michigan businesses the controls that stop those attacks, including managed detection and response, stronger sign-in, filtered email, immutable backups and a written incident plan, run remotely by engineers in Brooklyn.
The short answer
NetSys provides cybersecurity services to Michigan organizations: ThreatDown managed detection and response with 24/7 monitoring, Microsoft Defender for Business, Entra ID Conditional Access and multifactor sign-in, Barracuda email protection, Rapid7 vulnerability scanning, KnowBe4 security awareness training, immutable Datto or Veeam backups and incident response. All of it is delivered remotely from Brooklyn, and NetSys does not send security staff on site in Michigan. Security comes inside managed IT agreements or as its own engagement priced after an assessment, and the one free offer is a remote external penetration test.
Service information by The NetSys Group. Our editorial standards.
How cybersecurity is delivered for Michigan organizations
Security is the part of IT best suited to remote delivery. ThreatDown agents on every endpoint send detections to a monitoring team that watches around the clock and can isolate a laptop from the network whether it sits in Kalamazoo or Bay City. Our engineers manage Conditional Access, Defender and Barracuda policies from their consoles, review Rapid7 scan results and push fixes through NinjaOne and Intune. NetSys does not send security staff to Michigan sites, so incident response is designed to work without anyone in the room: affected machines are isolated over the network, accounts are disabled in Entra ID and evidence is collected remotely before anything is wiped. Where a damaged firewall or server must be swapped, a replacement ships configured and your staff or contractor plugs it in while our engineer restores service. Monitoring runs 24/7 from Brooklyn, and so does emergency service. Our staffed help-desk hours are 4 a.m. to 11 p.m. Eastern time, seven days a week. The proposal states severe-incident escalation, authorized remediation and any other after-hours work.
The attacks Michigan organizations have already faced
Recent Michigan incidents show which methods work for attackers. In August 2022, four Michigan Medicine employees entered their passwords on a fake login page and then approved multifactor prompts they should have rejected, giving an attacker their mailboxes and exposing information on about 33,850 patients. In 2023 the MOVEit file-transfer flaw reached Corewell Health through a vendor, Welltok, affecting about one million patients. McLaren Health Care was hit by the ALPHV/BlackCat group in 2023, with about 2.2 million people's data involved, and again in July and August 2024, affecting 743,131. Public bodies followed. Grand Traverse County and Traverse City took their networks offline in June 2024 after ransomware officials believed came in through email, and an attack in October 2024 took Wayne County's websites down. Approved prompts, vendor software and opened attachments are the patterns to defend.
Controls that answer those attacks
Each of those incidents maps to a control we deploy. Push-notification fatigue is answered with number matching in Microsoft Authenticator, phishing-resistant methods such as passkeys for administrators, and Conditional Access rules that block sign-ins from unmanaged devices or unexpected countries. Vendor and file-transfer risk calls for an inventory of every third party that holds your data, prompt patching of internet-facing software and Rapid7 scans that flag exposed services before an attacker finds them. Malicious email meets Barracuda filtering, link protection and KnowBe4 simulations that teach staff what a fake login page looks like. Behind all of it, ThreatDown watches each endpoint for ransomware behavior, and Datto or Veeam keeps immutable backup copies that an intruder holding stolen administrator rights still cannot delete. Keeper replaces the shared password spreadsheet.
Security requirements Michigan industries face
Different Michigan sectors answer to different reviewers. Automotive suppliers receive security questionnaires and contract terms from their OEM customers. Defense suppliers around the Detroit Arsenal in Warren must still meet DFARS 252.204-7012 and NIST SP 800-171 Revision 2 and keep a current SPRS score and affirmation, even though the Department of War suspended CMMC Phase 2 third-party certification on July 13, 2026 while a reform task force reviews the program. Insurers and agencies licensed by DIFS need the written information security program described in Chapter 5A of the Insurance Code. Medical practices and their business associates follow the HIPAA Security Rule; the HHS update published as a proposal in January 2025 is not yet law. Lawyers have State Bar of Michigan opinion RI-381, which says they must take reasonable steps to implement cybersecurity measures and notify clients of a material breach.
The first 30 days of a security engagement in Michigan
Days one to ten are discovery: a read-only review of Microsoft 365 sign-in logs, admin roles and mail rules, an external scan of everything the company exposes to the internet and an inventory of endpoints and backups. Reviews often turn up the same few items, such as an old admin account without multifactor sign-in, a mailbox forwarding rule nobody remembers creating or a backup that has never been restored. Days ten to twenty deploy the baseline of ThreatDown on every endpoint, Conditional Access, Barracuda, Keeper and immutable backups. The last ten days cover a tabletop exercise built on a Michigan scenario, such as the vendor breach above, plus KnowBe4 enrollment and a written incident plan naming who calls the insurer, the lawyer and, where it makes sense, the Michigan State Police Cyber Command Center, which relays requests to the state's volunteer Michigan Cyber Civilian Corps.
Cybersecurity in Michigan: what NetSys delivers
Detection and response
- ThreatDown managed detection and response with EDR agents on every workstation, laptop and server, monitored 24/7
- Microsoft Defender for Business and Rapid7 InsightIDR telemetry from identities, email and endpoints, with a person acting on alerts
Identity and email
- Entra ID Conditional Access and multifactor authentication across Microsoft 365, with legacy authentication switched off
- Privileged access and privileged identity management so admin rights are granted just in time and removed afterwards
Exposure and recovery
- Rapid7 InsightVM vulnerability scanning on a schedule, with findings fixed rather than filed
- Cisco Meraki or Fortinet firewall management, segmentation and DNS filtering on office and remote devices
Law office: layered security on Microsoft 365 with cloud-to-cloud backup
A 25-attorney firm needed client confidences protected better than a closet server could manage. Alongside a Microsoft 365 migration, NetSys layered anti-phishing and email threat protection, DNS filtering, multifactor authentication on every account and endpoint protection across attorney devices in the office and remote, and established independent cloud-to-cloud backup of the entire tenant because the recycle bin is not a backup strategy for privileged material. The firm reported 82% fewer IT support incidents per month within two quarters.
Cybersecurity work for other clients
- Insurance
Regional title insurance company
Barracuda email protection for 85 users, phishing simulations, employee security training, and MFA deployment.
Security Awareness & Phishing TrainingIT for Insurance Agencies and Brokers
Client names are withheld. These examples were chosen for the work involved, not for where the client is, so none is presented as a Michigan client.
What cybersecurity costs in Michigan
Cybersecurity is priced per user per month when it runs as an ongoing service, and per project for an assessment or a remediation. What moves the number: how many devices and identities are in scope, how much incident remediation and recovery is needed beyond the monitoring and authorized MDR actions in scope, which compliance standard the evidence has to satisfy, and whether the Microsoft 365 tenant is already on Business Premium or the security tooling comes from us. The free external penetration test costs nothing and runs remotely before any of that. Our managed IT pricing page explains how the fee is built.
Who this fits, and who it does not
Best fit: businesses with enough people, money movement or regulated data that a breach would hurt, and no security team of their own: professional practices, healthcare groups, importers, financial firms, nonprofits and agencies holding client credentials. Companies with an internal IT person fit as a co-managed arrangement.
Read next
Industry pages: IT for Manufacturing · IT for Healthcare
Terms used on this page: Managed Detection and Response (MDR) · Endpoint Detection and Response (EDR) · Conditional Access
Guides: MDR versus antivirus for a small business · the Conditional Access policies to turn on first
Related pages
Read the full Cyber Security service page. See everything NetSys delivers in Michigan.
Also in Michigan: Managed IT Services
Cybersecurity elsewhere: Chicago · Cincinnati · Columbus · Detroit · Illinois · Indiana
Related services: Penetration Testing · Cyber Insurance Readiness · Security Assessments · Managed Detection & Response (MDR)
Cybersecurity in Michigan: FAQs
How does cybersecurity work for Michigan organizations?
Monitoring, detection and response all run remotely. The ThreatDown monitoring team watches endpoints 24/7, our engineers manage identity, email and backup protections, and severe incidents go straight to your dedicated engineer at any hour. NetSys does not send responders on site in Michigan, so containment happens over the network by isolating devices, disabling accounts and blocking malicious senders. When hardware must be replaced, it ships configured. The arrangement works across the state, from Upper Peninsula offices on Central time to Detroit-area suppliers, because the controls live in the cloud and on the endpoints themselves.
How much do cybersecurity services cost in Michigan?
Security inside a managed IT agreement is part of the per-user monthly fee. As a standalone engagement, cost depends on the number of users and endpoints, the servers and cloud tenants in scope, the framework you must document against (HIPAA, NIST SP 800-171 or the Insurance Code program), whether you want recurring vulnerability scanning and penetration testing, and how much remediation discovery uncovers. We quote after an assessment and do not publish prices. The external penetration test, run remotely within an agreed scope, is free and is often the quickest way to see what to fix first.
Which cybersecurity requirements apply to businesses in Michigan?
Every business holding Michigan residents' personal information is covered by the Identity Theft Protection Act, MCL 445.72: notice without unreasonable delay after a qualifying breach, consumer reporting agency notice when more than 1,000 residents are notified and fines of up to $250 per knowing failure, capped at $750,000 per breach. DIFS licensees must report a cybersecurity event to the director no later than 10 business days after determining it occurred (MCL 500.559). HIPAA covers healthcare, and DoD contracts carry DFARS 252.204-7012. This is general information, not legal advice.
What should a Michigan business do in the first hour of a ransomware attack?
Pull affected computers off the network but leave them powered on, so the evidence survives, and reach your IT provider's emergency line before anyone wipes or restores a machine. Then phone your cyber insurer, because many policies require approved responders, and your attorney, who decides notice duties under MCL 445.72 or HIPAA. Do not contact or pay the attackers until backups have been checked. Michigan organizations can also request help from the Michigan State Police Cyber Command Center, which can bring in the Michigan Cyber Civilian Corps. NetSys clients reach their dedicated engineer immediately.
Is managed detection and response different from antivirus?
Yes. Traditional antivirus compares files against a list of known threats. Managed detection and response, which NetSys delivers with ThreatDown, watches behavior on each endpoint, such as a process encrypting hundreds of files or a new administrator account appearing at 3 a.m., and a monitoring team investigates and acts on alerts at any hour. That human layer matters because several of the Michigan incidents above began with legitimate credentials or trusted vendor software, which signature checks do not flag. MDR also keeps a timeline of what happened, which your insurer and lawyer will ask for.
See what an attacker sees before they do.
The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Internal reviews and ongoing security management are scoped separately.