Cybersecurity Services in Portland, OR
In 2022 a diverted payment, sent after an outsider got into a city email account, cost the City of Portland $1.4 million. Attacks on Portland businesses usually start the same way: an email, a stolen password or an unpatched tool. NetSys runs the controls that stop them, watches for what gets through and keeps the records Oregon law expects.
The short answer
NetSys provides cybersecurity services to Portland, Oregon organizations. The stack pairs Microsoft Defender for Business with ThreatDown's managed detection and response team, filters mail through Barracuda, enforces multifactor sign-in with Entra ID Conditional Access, scans for weaknesses with Rapid7, trains staff with KnowBe4 simulations, stores shared passwords in Keeper and keeps immutable backup copies. Everything is deployed and watched remotely from Brooklyn; we never send engineers on site in Portland. Threat monitoring and emergency response run 24/7, and controls are documented against Oregon's safeguards and breach-notice law. Most clients begin with our free external penetration test, a remote probe of your internet-facing systems inside a scope you agree.
Service information by The NetSys Group. Our editorial standards.
How cybersecurity is delivered to Portland organizations
Every control we run for a Portland client is installed and managed remotely. The ThreatDown agent reaches each laptop and server through NinjaOne, and its managed detection team can cut a machine off from the network as soon as a threat is confirmed, wherever that machine happens to be. Conditional Access policies in Entra ID decide which devices and locations may sign in at all. Barracuda filters mail before it reaches Outlook, and Rapid7 scans internal systems and internet-facing addresses on a schedule. No NetSys engineer comes to your office for any of this. If a firewall has to be replaced, it ships with its security policy already loaded, and your staff or cabling contractor connects it while our engineer confirms the rules are working. Monitoring runs 24/7 from Brooklyn, and so does emergency service. Our staffed help-desk hours are 4 a.m. to 11 p.m. Eastern time (1 a.m. to 8 p.m. Pacific), seven days a week. The proposal states severe-incident escalation, authorized remediation and any other after-hours work.
What Portland's own incidents teach
Three public cases sum up the threats. In April 2022, someone with access to a Portland Housing Bureau email account redirected a payment meant for a nonprofit housing developer, and the city lost $1.4 million; OPB later reported that the city's treasury had flagged the transfer before it went out. In June 2023, attackers exploited a flaw in the MOVEit Transfer file-sharing tool and reached Oregon DMV files covering about 3.5 million license and ID card holders. In April 2025, the Rhysida ransomware group claimed an attack on the Oregon Department of Environmental Quality that shut down its network, email and vehicle inspection stations for days. The lessons are practical: confirm any change to payment details by phone, patch file-transfer and remote-access software quickly, and assume ransomware will steal data as well as lock it.
Controls for apparel brands, chip suppliers and clinics
Security needs differ across Portland's industries. Footwear and outdoor brands hold design files and supplier pricing worth stealing, and their marketing and purchasing teams receive invoices and vendor requests that make good cover for phishing. Machine shops and electronics suppliers to the semiconductor industry answer customer security questionnaires and, where defense work is involved, NIST SP 800-171 and DFARS 252.204-7012; the July 2026 suspension of CMMC Phase 2 left self-assessments and a current SPRS score in force. Medical and dental offices fall under the HIPAA Security Rule, and its first demand is a written risk analysis covering electronic patient records. Law firms carry the duty in ABA Model Rule 1.6(c) to make reasonable efforts against unauthorized access to client information. We map each control we deploy to the rule that asks for it.
Oregon's breach clock and the evidence you will need
Under ORS 646A.604, a business that discovers a breach of Oregon residents' personal information must notify them in the most expeditious manner possible and no later than 45 days after discovery, and must tell the Attorney General when more than 250 consumers are involved. A vendor that suffers a breach has 10 days to alert the business it works for. ORS 646A.622 sketches what reasonable safeguards look like: someone coordinating the program, regular risk reviews, staff training, a patch management program, monitoring and response, and periodic reviews of user access. Our job is to make those things true and provable. ThreatDown and Microsoft logs are retained, access reviews are recorded in IT Glue, and an incident timeline can be produced quickly for your attorney and insurer. This is general information, not legal advice.
Cyber insurance, pricing and where to start
Cybersecurity is part of every NetSys managed IT agreement, and it can also be bought on its own by a business that keeps an internal IT person. The monthly cost depends on users and devices, servers and cloud workloads in scope, and the compliance documentation you need, and we quote it after an assessment. Cyber insurance renewals now ask pointed questions about multifactor sign-in, endpoint detection, offline or immutable backups and phishing training, and we help answer the questionnaire with evidence rather than guesses. The simplest starting point is the free external penetration test: our engineers probe your internet-facing systems remotely, within a scope you approve, and report what an attacker would find first and what to fix.
Cybersecurity in Portland: what NetSys delivers
Detection and response
- ThreatDown managed detection and response with EDR agents on every workstation, laptop and server, monitored 24/7
- Microsoft Defender for Business and Rapid7 InsightIDR telemetry from identities, email and endpoints, with a person acting on alerts
Identity and email
- Entra ID Conditional Access and multifactor authentication across Microsoft 365, with legacy authentication switched off
- Privileged access and privileged identity management so admin rights are granted just in time and removed afterwards
Exposure and recovery
- Rapid7 InsightVM vulnerability scanning on a schedule, with findings fixed rather than filed
- Cisco Meraki or Fortinet firewall management, segmentation and DNS filtering on office and remote devices
Law office: layered security on Microsoft 365 with cloud-to-cloud backup
A 25-attorney firm needed client confidences protected better than a closet server could manage. Alongside a Microsoft 365 migration, NetSys layered anti-phishing and email threat protection, DNS filtering, multifactor authentication on every account and endpoint protection across attorney devices in the office and remote, and established independent cloud-to-cloud backup of the entire tenant because the recycle bin is not a backup strategy for privileged material. The firm reported 82% fewer IT support incidents per month within two quarters.
Cybersecurity work for other clients
- Insurance
Regional title insurance company
Barracuda email protection for 85 users, phishing simulations, employee security training, and MFA deployment.
Security Awareness & Phishing TrainingIT for Insurance Agencies and Brokers
Client names are withheld. These examples were chosen for the work involved, not for where the client is, so none is presented as a Portland client.
What cybersecurity costs in Portland
Cybersecurity is priced per user per month when it runs as an ongoing service, and per project for an assessment or a remediation. What moves the number: how many devices and identities are in scope, how much incident remediation and recovery is needed beyond the monitoring and authorized MDR actions in scope, which compliance standard the evidence has to satisfy, and whether the Microsoft 365 tenant is already on Business Premium or the security tooling comes from us. The free external penetration test costs nothing and runs remotely before any of that. Our managed IT pricing page explains how the fee is built.
Who this fits, and who it does not
Best fit: businesses with enough people, money movement or regulated data that a breach would hurt, and no security team of their own: professional practices, healthcare groups, importers, financial firms, nonprofits and agencies holding client credentials. Companies with an internal IT person fit as a co-managed arrangement.
Read next
Industry pages: IT for Manufacturing · IT for Importers & Distributors
Terms used on this page: Managed Detection and Response (MDR) · Endpoint Detection and Response (EDR) · Conditional Access
Guides: MDR versus antivirus for a small business · the Conditional Access policies to turn on first
Related pages
Read the full Cyber Security service page. See everything NetSys delivers in Portland, OR.
Also in Portland: IT Support · IT Consulting · Managed IT Services
Cybersecurity elsewhere: Denver · Albuquerque · Bellevue, Washington · Colorado · Colorado Springs · Hawaii
Related services: Penetration Testing · Cyber Insurance Readiness · Security Assessments · Managed Detection & Response (MDR)
Cybersecurity in Portland: FAQs
How does cybersecurity work for Portland organizations?
We install and run the controls remotely, then watch them. ThreatDown's managed detection team monitors every endpoint around the clock and can isolate an infected computer, while our engineers handle patching, email filtering, sign-in policies and backups. Alerts that need a decision reach your dedicated engineer, and a suspected ransomware event goes to them at once. NetSys does not send staff on site in Portland; replacement hardware arrives configured, and recovery runs from cloud backups and laptops. Routine security questions go to the help desk, which engineers staff 1 a.m. to 8 p.m. Pacific.
How much do cybersecurity services cost in Portland?
We quote a monthly fee after an assessment rather than publishing a rate. The number depends on how many users, computers and servers need protection, whether cloud workloads are included, the volume of email being filtered and the compliance paperwork involved, such as a HIPAA risk analysis or a customer's security questionnaire. Inside a managed IT agreement, the core security stack is already part of the per-user fee. Incident response, forensic work and remediation projects are scoped separately if they are ever needed.
Does the Oregon Consumer Privacy Act require specific security controls?
It points back to Oregon's existing safeguards law. ORS 646A.578 requires a covered controller to maintain for personal data the same safeguards that ORS 646A.622 requires for personal information, scaled to the volume and nature of the data. In practice that means administrative, technical and physical controls such as access reviews, patching, monitoring and secure disposal. The privacy act itself reaches organizations handling personal data about at least 100,000 consumers a year, or 25,000 or more with substantial data sales. Your counsel confirms coverage; we document the controls.
What should we do if an employee clicks a phishing link?
Report it to the help desk at once, even when nothing looks wrong yet. We check the account's recent sign-ins, reset the password and revoke active sessions, look for new mail rules that forward or delete messages, and scan the computer with ThreatDown. If the person typed credentials into a fake Microsoft page, we review what the attacker could have reached and whether any client or vendor received mail from the account. Quick reporting turns most of these into a short cleanup, and KnowBe4 training with simulated phishing makes reporting a habit instead of an embarrassment.
Can you help if we have already been hit by ransomware?
Yes. Call the main line, 845-203-3914, and say it is an emergency; emergency service runs 24/7. We cut infected machines off the network, keep the evidence your insurer and investigators will want, establish what was encrypted or copied, and rebuild from backup copies out of the attacker's reach. Over the past three years NetSys has taken on more than 30 ransomware cases and brought every one to a full recovery; where a disaster recovery plan already existed, the client was running again within 24 hours. Oregon's 45-day notice clock may already be running, so bring in your attorney early.
See what an attacker sees before they do.
The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Internal reviews and ongoing security management are scoped separately.