Cybersecurity Services in Raleigh, NC
Ransomware has already shut down city and county systems next door in Durham, and North Carolina's Attorney General logged a record number of breach reports in 2025. NetSys protects Raleigh businesses with managed detection and response, locked-down sign-ins, filtered email, trained staff and backups that survive an attack, all run remotely from Brooklyn.
The short answer
NetSys provides cybersecurity services to Raleigh, NC businesses: ThreatDown managed detection and response with Microsoft Defender for Business on every endpoint, multifactor sign-in enforced through Entra ID Conditional Access, Barracuda email protection, KnowBe4 phishing training, Keeper password management, Rapid7 vulnerability scanning and immutable backups. The service is remote and cloud-based, with no engineers sent to Raleigh; detection, isolation and recovery all happen over the network. Monitoring and emergency service run 24/7; the help desk is staffed seven days a week from 4 a.m. to 11 p.m. Eastern time. Ongoing security is priced per user per month.
Service information by The NetSys Group. Our editorial standards.
How cybersecurity is delivered in Raleigh
Security for a Raleigh client runs on agents and cloud services, and none of it needs a NetSys engineer on site. ThreatDown's MDR analysts watch endpoint telemetry around the clock and can cut an infected laptop off from the network wherever it is. Our engineers then investigate, remove the threat and restore what was touched. Rapid7 InsightVM scans for missing patches and risky configurations, and NinjaOne pushes the fixes on a schedule your office manager approves. Conditional Access policies, mailbox rules and audit logs in Microsoft 365 are reviewed from Brooklyn, and every alert, action and exception is recorded in IT Glue. The first step for many companies is our free external penetration test, a remote test of your internet-facing systems within a written scope. Monitoring runs 24/7 from Brooklyn, and so does emergency service. Our staffed help-desk hours are 4 a.m. to 11 p.m. Eastern time, seven days a week. The proposal states severe-incident escalation, authorized remediation and any other after-hours work.
What Triangle ransomware cases show
In March 2020, Ryuk ransomware forced the City of Durham to shut down its network after phishing emails opened the door, and about 80 servers were taken offline while Durham County's services were disrupted too. Months later, in October 2020, Chatham County was hit by an attack the FBI later tied to the DoppelPaymer gang. Mecklenburg County refused to pay a ransom in December 2017 and rebuilt from backups. Since 2021, G.S. 143-800 has barred North Carolina state agencies, cities, counties, school systems and community colleges from paying a ransom or even communicating with the attacker; they must consult the Department of Information Technology instead. The law does not bind private companies, but the lesson applies to them: a business that cannot restore its own systems from clean backups has no good options left, so recovery has to be tested before it is needed.
What North Carolina's breach reports say
Organizations reported a record 2,349 data breaches to the North Carolina Department of Justice in 2025, affecting 9,275,938 North Carolinians, and many residents appeared in more than one. Hacking caused 77 percent of those breaches, and phishing 16 percent. The report also describes the December 2024 attack on PowerSchool, a school software vendor, which exposed records of about 4 million North Carolinians; the company paid a ransom, and the attacker still tried to extort the state's school districts afterward. Two lessons follow for a Raleigh company. First, stolen sign-ins and phishing remain the main way in, so identity controls come before anything else. Second, your data is only as safe as the vendors holding it, so the software and service providers with access to client or employee records belong on a reviewed list with their own security terms.
The controls we put in place
Every engagement starts with identity. Entra ID Conditional Access enforces multifactor sign-in, blocks legacy protocols that skip it and limits admin roles to separate accounts used only for administration. ThreatDown and Defender for Business cover every laptop and server, with MDR analysts able to act on alerts at night. Barracuda filters inbound mail for phishing and impersonation, and DMARC, SPF and DKIM on your domain reduce spoofing of your own address. KnowBe4 runs training and simulated phishing on a schedule, with results by department. Keeper replaces shared spreadsheets of passwords. Datto SIRIS or Veeam keeps backups on immutable storage that ransomware cannot rewrite, and restores are tested. Rapid7 scans monthly, and a written incident response plan names who calls the insurer, counsel and the bank in the first hour.
Security requirements for Triangle industries
The rules depend on what the business does. Medical practices that refer into WakeMed, UNC Rex or Duke Raleigh Hospital fall under the HIPAA Security Rule; HHS published a proposed update on January 6, 2025, but it is a proposal, not current law. Defense suppliers around RTP still need NIST SP 800-171 Revision 2, DFARS 252.204-7012 and a current SPRS score, even though CMMC Phase 2 has been on hold since the Department of War suspended it on July 13, 2026, pending a task force review. Accounting and tax firms are covered by the FTC Safeguards Rule and IRS Publication 4557. Software companies selling to large employers are often asked for SOC 2 reports. Our service is built to produce the evidence each regime asks for: sign-in reports, endpoint coverage, scan results and restore records. This is general information, not legal advice.
Cybersecurity in Raleigh: what NetSys delivers
Detection and response
- ThreatDown managed detection and response with EDR agents on every workstation, laptop and server, monitored 24/7
- Microsoft Defender for Business and Rapid7 InsightIDR telemetry from identities, email and endpoints, with a person acting on alerts
Identity and email
- Entra ID Conditional Access and multifactor authentication across Microsoft 365, with legacy authentication switched off
- Privileged access and privileged identity management so admin rights are granted just in time and removed afterwards
Exposure and recovery
- Rapid7 InsightVM vulnerability scanning on a schedule, with findings fixed rather than filed
- Cisco Meraki or Fortinet firewall management, segmentation and DNS filtering on office and remote devices
Firewall, antivirus and maintenance for a five-person office
A five-person office needed the basics done properly rather than an enterprise stack. NetSys replaced the internet provider's router with a business-grade firewall configured with sensible rules, secure remote access and logging, deployed managed antivirus on every machine with updates and alerts handled centrally, and put patching, backup checks and health reviews on a schedule. The agreement covers what the office needs and nothing it does not, month to month. No outcome figures were measured for publication.
Cybersecurity work for other clients
- Insurance
Regional title insurance company
Barracuda email protection for 85 users, phishing simulations, employee security training, and MFA deployment.
Security Awareness & Phishing TrainingIT for Insurance Agencies and Brokers
Client names are withheld. These examples were chosen for the work involved, not for where the client is, so none is presented as a Raleigh client.
What cybersecurity costs in Raleigh
Cybersecurity is priced per user per month when it runs as an ongoing service, and per project for an assessment or a remediation. What moves the number: how many devices and identities are in scope, how much incident remediation and recovery is needed beyond the monitoring and authorized MDR actions in scope, which compliance standard the evidence has to satisfy, and whether the Microsoft 365 tenant is already on Business Premium or the security tooling comes from us. The free external penetration test costs nothing and runs remotely before any of that. Our managed IT pricing page explains how the fee is built.
Who this fits, and who it does not
Best fit: businesses with enough people, money movement or regulated data that a breach would hurt, and no security team of their own: professional practices, healthcare groups, importers, financial firms, nonprofits and agencies holding client credentials. Companies with an internal IT person fit as a co-managed arrangement.
Read next
Industry pages: IT for Life Sciences & Biotech · IT for Professional Services & Consulting
Terms used on this page: Managed Detection and Response (MDR) · Endpoint Detection and Response (EDR) · Conditional Access
Guides: MDR versus antivirus for a small business · the Conditional Access policies to turn on first
Related pages
Read the full Cyber Security service page. See all locations and service areas.
Also in Raleigh: Managed IT Services · IT Consulting · IT Support
Industry pages for Raleigh: IT Support for Professional Services in Raleigh, NC
Cybersecurity elsewhere: Atlanta · Charlotte · Georgia · Knoxville · Lafayette · Louisville
Related services: Penetration Testing · Cyber Insurance Readiness · Security Assessments · Managed Detection & Response (MDR)
Cybersecurity in Raleigh: FAQs
How does cybersecurity work for Raleigh organizations?
Through agents, cloud consoles and a 24/7 detection team; NetSys has no field staff in Raleigh, and the service is built so none are needed. ThreatDown MDR analysts monitor endpoints at all hours and isolate a compromised device remotely; our engineers investigate and restore. Monitoring and emergency service run 24/7; the help desk is staffed seven days a week from 4 a.m. to 11 p.m. Eastern time. Severe incidents go straight to your dedicated engineer, with phone contact inside ten minutes and an engineer connected inside thirty for anything critical. You receive a monthly report of what was blocked, patched and changed.
How much do cybersecurity services cost in Raleigh, NC?
Ongoing cybersecurity is priced per user per month, and a one-time assessment or remediation project is quoted after scoping. We do not publish a price. What moves the figure is the number of devices and identities in scope, whether your Microsoft 365 licenses already include the security features or we supply them, the compliance evidence you need, such as HIPAA, NIST SP 800-171 or a client's SOC 2 request, and how much remediation the first scan turns up. The free external penetration test costs nothing and is often the first step.
Which cybersecurity requirements apply to businesses in Raleigh, NC?
Every business holding North Carolina residents' personal information falls under the state's breach law. Under G.S. 75-65, a business whose personal data is breached must tell affected residents without unreasonable delay and report the breach to the state Attorney General; if it sends notices to over 1,000 people at once, the consumer reporting agencies that keep files nationwide must be told as well. The Attorney General's office reviews every notice and may investigate whether reasonable safeguards were in place. Industry rules apply on top: HIPAA for health care, the FTC Safeguards Rule for tax preparers and nonbank lenders, and DFARS and NIST SP 800-171 for defense work.
What does the free external penetration test include?
It is a remote test of the systems your business exposes to the internet, run within a scope we agree in writing first: typically the firewall and VPN, mail services, remote access portals and public web applications. We look for what an outside attacker would find, such as open services, weak or reused credentials on login pages, unpatched devices and misconfigured certificates. You get a written report ranking each finding with a recommended fix. There is no charge and no obligation to buy anything afterward, and nothing has to be installed inside your network.
What happens if a Raleigh business is hit by ransomware?
The MDR team isolates affected devices, an engineer confirms the scope, and your incident response plan starts: insurer, counsel and leadership are called in the order it sets. We have handled more than 30 ransomware incidents in the past three years, and every one was fully recovered; clients with a disaster recovery plan already in place were back within 24 hours. Recovery comes from immutable backups, not from the attacker. You receive a written timeline of what happened and what was changed, suitable for your insurer and, if notice is required, for the Attorney General's office.
See what an attacker sees before they do.
The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Internal reviews and ongoing security management are scoped separately.