Cybersecurity Services in San Antonio, TX
By the state's own count, San Antonio holds the second-largest concentration of cyber expertise in the country, yet most of it works for federal programs and large enterprises, not for a 25-person firm whose mailbox gets phished on a Tuesday. NetSys gives those firms managed detection and response, locked-down Microsoft 365 sign-ins, filtered email, vulnerability scanning and proven backups, monitored remotely.
The short answer
NetSys provides cybersecurity services to San Antonio businesses: ThreatDown managed detection and response on every endpoint, Microsoft Defender for Business, multifactor authentication and Entra ID Conditional Access, Barracuda email protection, Rapid7 InsightVM vulnerability scanning, KnowBe4 training, Keeper password management and Datto or Veeam backups with test restores. Monitoring and response run 24/7 and remotely, so an engineer can isolate a compromised laptop or lock an account from Brooklyn without anyone traveling. NetSys does not perform on-site security work in San Antonio. The service is priced per user per month.
Service information by The NetSys Group. Our editorial standards.
How cybersecurity is delivered for San Antonio companies
Protection runs on software we manage from Brooklyn. ThreatDown agents on every laptop and server report suspicious behavior to an engineer, who can cut a device off the network, kill a process or roll back a change, wherever the device is. Entra ID sign-in logs show impossible travel and repeated multifactor prompts, and the engineer can revoke sessions and reset credentials on the spot. Rapid7 scans run on a schedule, and the findings become patching tickets with dates. Because no NetSys engineer works in San Antonio, the physical steps are written down ahead of time: which cable your office manager unplugs if we ask, where the spare laptop is kept, who can authorize shutting down a server. During an incident you get one engineer on the phone who directs the response and keeps the evidence. Monitoring runs 24/7 from Brooklyn, and so does emergency service. Our staffed help-desk hours are 4 a.m. to 11 p.m. Eastern time (3 a.m. to 10 p.m. Central), seven days a week. The proposal states severe-incident escalation, authorized remediation and any other after-hours work.
A cyber city, and the ordinary attacks that still land
San Antonio's security credentials are real. The Sixteenth Air Force, the Air Force's cyber and intelligence command, is headquartered at Joint Base San Antonio-Lackland, the NSA's Texas Cryptologic Center sits at the Medina Annex, and on June 2, 2025 the governor signed HB 150 at UTSA creating the Texas Cyber Command, headquartered in San Antonio, to defend state and local government systems. None of that protects a private law firm, clinic or subcontractor. The attacks that hurt those businesses are plain: a phished Microsoft 365 password used to read mail and redirect a payment, a reused password tried against a VPN, a laptop that missed months of patches. The controls that stop them are equally plain, and the work is making sure every one of them is switched on, enforced and checked every month.
The 2019 Texas attack that came through outsourced IT
On the morning of August 16, 2019, more than 20 Texas local governments reported ransomware at once. The Department of Information Resources said the evidence pointed to a single threat actor, and the mayor of Keene told NPR the attackers got in through the outsourced company that ran the town's IT systems, which also served other victims. The lesson for any San Antonio business is that your IT provider's remote tools reach every one of your computers, which makes them a target. Ask any provider, including us, how its remote-management platform is protected: whether every technician signs in with multifactor authentication, whether accounts are named rather than shared, how fast a departing technician loses access, and whether you can see a log of who connected to your machines and when.
What the Rackspace outage taught about hosted email
In December 2022, Rackspace, the hosting company based in San Antonio, lost its Hosted Exchange service to a ransomware attack that the FBI and CrowdStrike attributed to the Play group. The attackers used a previously unknown exploit chain in Microsoft Exchange, and Rackspace chose not to rebuild the platform, moving its roughly 30,000 Hosted Exchange customers toward Microsoft 365. Businesses whose only copy of their mail lived on that platform had to wait while Rackspace recovered mailboxes. Our response is part of every engagement: mail runs in Microsoft 365 with Conditional Access, mailboxes are backed up separately from Microsoft, domain and DNS ownership is documented in your company's name, and any server still exposed to the internet is patched promptly after a critical release or taken offline.
Texas breach law and the evidence you will need
Section 521.052 of the Business and Commerce Code requires a business to implement and maintain reasonable procedures to protect sensitive personal information and to destroy records it no longer keeps by shredding, erasing or making the data unreadable. If a breach happens, section 521.053 requires notice to affected individuals within 60 days of determining it occurred, and to the Attorney General through the office's online form within 30 days when at least 250 Texans are involved. Under section 521.151 the Attorney General can seek $2,000 to $50,000 per violation, plus up to $100 per individual per day for failing to notify, capped at $250,000 per breach. Our monitoring keeps the logs, device inventory and timeline your attorney needs to make those calls quickly. This is general information, not legal advice.
Cybersecurity in San Antonio: what NetSys delivers
Detection and response
- ThreatDown managed detection and response with EDR agents on every workstation, laptop and server, monitored 24/7
- Microsoft Defender for Business and Rapid7 InsightIDR telemetry from identities, email and endpoints, with a person acting on alerts
Identity and email
- Entra ID Conditional Access and multifactor authentication across Microsoft 365, with legacy authentication switched off
- Privileged access and privileged identity management so admin rights are granted just in time and removed afterwards
Exposure and recovery
- Rapid7 InsightVM vulnerability scanning on a schedule, with findings fixed rather than filed
- Cisco Meraki or Fortinet firewall management, segmentation and DNS filtering on office and remote devices
Firewall, antivirus and maintenance for a five-person office
A five-person office needed the basics done properly rather than an enterprise stack. NetSys replaced the internet provider's router with a business-grade firewall configured with sensible rules, secure remote access and logging, deployed managed antivirus on every machine with updates and alerts handled centrally, and put patching, backup checks and health reviews on a schedule. The agreement covers what the office needs and nothing it does not, month to month. No outcome figures were measured for publication.
Cybersecurity work for other clients
- Insurance
Regional title insurance company
Barracuda email protection for 85 users, phishing simulations, employee security training, and MFA deployment.
Security Awareness & Phishing TrainingIT for Insurance Agencies and Brokers
Client names are withheld. These examples were chosen for the work involved, not for where the client is, so none is presented as a San Antonio client.
What cybersecurity costs in San Antonio
Cybersecurity is priced per user per month when it runs as an ongoing service, and per project for an assessment or a remediation. What moves the number: how many devices and identities are in scope, how much incident remediation and recovery is needed beyond the monitoring and authorized MDR actions in scope, which compliance standard the evidence has to satisfy, and whether the Microsoft 365 tenant is already on Business Premium or the security tooling comes from us. The free external penetration test costs nothing and runs remotely before any of that. Our managed IT pricing page explains how the fee is built.
Who this fits, and who it does not
Best fit: businesses with enough people, money movement or regulated data that a breach would hurt, and no security team of their own: professional practices, healthcare groups, importers, financial firms, nonprofits and agencies holding client credentials. Companies with an internal IT person fit as a co-managed arrangement.
Read next
Industry pages: IT for Government Contractors · IT for Healthcare
Terms used on this page: Managed Detection and Response (MDR) · Endpoint Detection and Response (EDR) · Conditional Access
Guides: MDR versus antivirus for a small business · the Conditional Access policies to turn on first
Related pages
Read the full Cyber Security service page. See everything NetSys delivers in Texas.
Also in San Antonio: Managed IT Services · IT Consulting · IT Support
Industry pages for San Antonio: IT Support for Professional Services in San Antonio, TX
Cybersecurity elsewhere: Houston · Dallas · Austin · El Paso · Fort Worth · Plano
Related services: Penetration Testing · Cyber Insurance Readiness · Security Assessments · Managed Detection & Response (MDR)
Cybersecurity in San Antonio: FAQs
How does cybersecurity work for San Antonio organizations?
It is a remote, monitored service. ThreatDown, Defender and Entra ID send alerts around the clock to engineers who can isolate devices, lock accounts and start recovery from Brooklyn. The help desk is staffed from 3 a.m. to 10 p.m. Central every day for questions, suspicious-email reports and access changes, and severe incidents go straight to your dedicated engineer at any hour. NetSys has one office, in Brooklyn, and does not send engineers on site in San Antonio. Agreements run month to month.
What do cybersecurity services in San Antonio cost?
The ongoing service is priced per user per month, and assessments or remediation projects are quoted separately. The number of devices and identities, the compliance evidence you need, and whether your Microsoft 365 licenses already include Business Premium features such as Conditional Access and Intune set most of the figure. A firm that must document NIST SP 800-171 for a prime contractor needs more reporting than a small office that wants protection and training. We do not publish a price; you get a written quote after scoping.
What does the free external penetration test include?
It is a remote test of what your business exposes to the internet, run within an external scope we agree with you in writing: your public IP addresses, firewall, VPN, email and remote-access services, and any web applications you list. The report shows what an outsider can see and reach, ranks the findings and states the limits of the test. It does not review your Microsoft 365 settings, internal network, devices or backups; those need a separately scoped assessment. It is the one service NetSys offers free.
Will this help with a cyber insurance application?
Yes. Carriers' questionnaires keep asking about the same controls: multifactor authentication on email and remote access, endpoint detection and response, backups kept offline or immutable and tested, privileged account management and security awareness training. The service puts each of those in place and produces evidence, such as enrollment reports, training completion records and restore test results, that you can attach to the application or show an underwriter. Answering truthfully matters, because a claim can be disputed if a control marked yes was not actually running.
Do defense subcontractors near Port San Antonio need more than this?
Usually, yes. The managed security service covers the baseline, but a company holding controlled unclassified information also has to meet DFARS 252.204-7012 and the 110 requirements of NIST SP 800-171 Revision 2, keep a current SPRS score and affirmation, and document all of it in a system security plan. CMMC Phase 2 certification was suspended in July 2026, but the self-assessments remain in force. Our CMMC readiness service handles that documentation and the technical gaps it uncovers.
See what an attacker sees before they do.
The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Internal reviews and ongoing security management are scoped separately.