Cybersecurity Services in Syracuse, NY
Syracuse watched ransomware shut down a school district's systems and a county library network within days of each other. NetSys gives Central New York businesses the controls that blunt those attacks: managed detection and response, multifactor sign-in, filtered email, staff training and backups an attacker cannot delete, all run remotely by engineers in Brooklyn.
The short answer
NetSys provides cybersecurity services to Syracuse organizations: ThreatDown managed detection and response with Microsoft Defender for Business on every device, multifactor authentication and Conditional Access across Microsoft 365, Barracuda email protection, Rapid7 vulnerability scanning, KnowBe4 training and immutable backups with tested restores. Monitoring runs 24/7, and an engineer acts on each alert. All of it is delivered remotely from our Brooklyn office; NetSys does not send engineers on site in Central New York. Pricing is per user or per device per month, and the free external penetration test, run remotely within an agreed scope, is a common starting point.
Service information by The NetSys Group. Our editorial standards.
How cybersecurity is delivered for Syracuse organizations
Security work is remote by nature, which is why distance changes little here. The ThreatDown agent on each computer reports to monitoring around the clock, and when it isolates a machine, the isolation is applied over the network, not by someone at the desk. Sign-in policies, email filtering and disk encryption are set in cloud consoles. NetSys does not send engineers on site in Syracuse, so the plan covers the cases where something physical has to happen: a compromised laptop is shut down by the user on our instruction and replaced with a pre-enrolled one we ship, and a firewall that needs replacing arrives configured for your staff or contractor to connect. Incident response starts on the phone and inside your Microsoft 365 tenant, which is where most of the evidence lives. Monitoring runs 24/7 from Brooklyn, and so does emergency service. Our staffed help-desk hours are 4 a.m. to 11 p.m. Eastern time, seven days a week. The proposal states severe-incident escalation, authorized remediation and any other after-hours work.
What the 2019 Ryuk attacks on Syracuse schools and libraries showed
In July 2019 Ryuk ransomware disabled the Syracuse City School District's systems, and days later the same strain took down the Onondaga County Public Library network, cutting Wi-Fi, public computers, phones and the countywide catalog while branches stayed open. The district brought HR, payroll and student management back first. Both were public bodies with IT staff, and both still lost days of normal operation. For a private business the lessons are practical. Ryuk is typically the last stage of an intrusion that began with a phishing email or a remote desktop left open to the internet, so the controls that matter come earlier: multifactor sign-in on every account, no exposed remote desktop, endpoint detection that flags credential theft, and backups kept where a stolen admin password cannot reach them.
Defense suppliers around Salina and the CMMC pause
Central New York has a defense electronics base, anchored by Lockheed Martin's plant on Electronics Parkway in Salina, with machine shops, engineering firms and distributors around it that hold Department of Defense subcontracts. For them, the rules shifted in 2026. On July 13 the Department of War suspended CMMC Phase 2, which would have made third-party Level 2 certification a condition of award starting November 10, 2026, and a reform task force is reviewing the program. What has not changed is the obligation already in the contract: DFARS 252.204-7012, the 110 requirements of NIST SP 800-171 Revision 2, a current SPRS score with an affirmation, and Level 1 or Level 2 self-assessments. We help suppliers keep that evidence current: the system security plan, the plan of action, multifactor coverage reports and scan results.
Micron's megafab in Clay and the questionnaires coming to suppliers
Micron broke ground on January 16, 2026 at White Pine Commerce Park in Clay, the start of a campus planned for up to four memory fabs and as much as $100 billion over roughly two decades, and foundation work began that July. Construction firms, equipment suppliers, staffing agencies and service companies across Onondaga County will compete for that work, and large manufacturers send security questionnaires to suppliers before granting access to a portal, a drawing set or a site network. The questions are predictable. Is multifactor authentication enforced? Are laptops encrypted and managed? How quickly are critical patches applied? Who reviews alerts, and when was a backup last restored? Answering yes with evidence takes weeks to set up and minutes to prove once it is running.
The first 30 days of a security engagement
We start from the outside. The free external penetration test, run remotely within a scope we agree, shows what the internet can see: open ports, old VPN appliances, an exposed remote desktop, mail settings that make spoofing easy. Inside, the first week puts ThreatDown and NinjaOne on every covered device and turns on sign-in logging. The second week enforces multifactor authentication and Conditional Access, starting with administrators and email, and puts Barracuda in front of the mailboxes. Week three runs a Rapid7 InsightVM scan and patches what it finds, and Keeper replaces the spreadsheet of shared passwords. By week four the backups have an immutable copy, a restore has been timed, and staff have taken their first KnowBe4 training. You receive a written report of what was fixed and what remains, ranked by risk.
Cybersecurity in Syracuse: what NetSys delivers
Watch and respond
- ThreatDown MDR and EDR on every device, with a 24/7 team that isolates and investigates rather than emails
- Rapid7 InsightIDR or Microsoft Sentinel collecting identity, email, endpoint and firewall logs so an intrusion is visible in one place
Harden the tenant and the people
- Microsoft Defender for Business, Entra ID Conditional Access and phishing-resistant sign-in for finance staff
- Legacy authentication off, dormant accounts closed, forwarding rules and consent grants reviewed monthly
Measure and recover
- Rapid7 InsightVM scans of the internal and external footprint, with a monthly fix list
- Managed firewall with intrusion prevention, segmentation and vendor access that is logged and switched off when the work ends
Firewall, antivirus and maintenance for a five-person office
A five-person office needed the basics done properly rather than an enterprise stack. NetSys replaced the internet provider's router with a business-grade firewall configured with sensible rules, secure remote access and logging, deployed managed antivirus on every machine with updates and alerts handled centrally, and put patching, backup checks and health reviews on a schedule. The agreement covers what the office needs and nothing it does not, month to month. No outcome figures were measured for publication.
Cybersecurity work for other clients
- Insurance
Regional title insurance company
Barracuda email protection for 85 users, phishing simulations, employee security training, and MFA deployment.
Security Awareness & Phishing TrainingIT for Insurance Agencies and Brokers
Client names are withheld. These examples were chosen for the work involved, not for where the client is, so none is presented as a Syracuse client.
What cybersecurity costs in Syracuse
Cybersecurity is priced per user per month when it runs as an ongoing service, and per project for an assessment or a remediation. What moves the number: how many devices and identities are in scope, how much incident remediation and recovery is needed beyond the monitoring and authorized MDR actions in scope, which compliance standard the evidence has to satisfy, and whether the Microsoft 365 tenant is already on Business Premium or the security tooling comes from us. The free external penetration test costs nothing and runs remotely before any of that. Our managed IT pricing page explains how the fee is built.
Who this fits, and who it does not
Best fit: businesses with enough people, money movement or regulated data that a breach would hurt, and no security team of their own: professional practices, healthcare groups, importers, financial firms, nonprofits and agencies holding client credentials. Companies with an internal IT person fit as a co-managed arrangement.
Read next
Industry pages: IT for Healthcare · IT for Manufacturing
Terms used on this page: Managed Detection and Response (MDR) · Endpoint Detection and Response (EDR) · Conditional Access
Guides: MDR versus antivirus for a small business · the Conditional Access policies to turn on first
Related pages
Read the full Cyber Security service page. See all locations and service areas.
Also in Syracuse: Managed IT Services · IT Support
Cybersecurity elsewhere: New York City · Brooklyn, NY · Nassau County, NY · Suffolk County, NY · Westchester County, NY · Stamford, CT
Related services: Penetration Testing · Cyber Insurance Readiness · Security Assessments · Managed Detection & Response (MDR)
Cybersecurity in Syracuse: FAQs
How does cybersecurity work for Syracuse organizations?
Remotely and continuously. Agents on each device and logs from Microsoft 365 feed monitoring that runs 24/7, and an engineer investigates alerts rather than forwarding them. Severe events such as ransomware go straight to your dedicated engineer, and the help desk takes everyday security questions. NetSys does not send engineers on site in Syracuse; containment happens over the network, and replacement hardware ships pre-enrolled. NetSys has handled more than 30 ransomware incidents in three years, every one fully recovered, and clients with a disaster recovery plan in place were back within 24 hours.
How much do cybersecurity services cost in Syracuse, NY?
Security is priced per user or per device per month, quoted after we look at your environment, and NetSys does not publish a rate card. The number depends on how many devices and mailboxes need protection, whether servers are still in the office, how much evidence a regulator or customer expects, such as a CMMC self-assessment or a HIPAA risk analysis, and whether you want security alone or as part of managed IT. Projects such as a firewall replacement or a remediation sprint after a scan are quoted separately. The external penetration test that often starts the conversation is free.
Which cybersecurity requirements apply to businesses in Syracuse, NY?
Every business holding New Yorkers' private information falls under the SHIELD Act. Its safeguards duty, General Business Law section 899-bb, lets a small business, meaning one with fewer than 50 employees, under $3 million in revenue in each of the last three fiscal years or under $5 million in year-end assets, scale its program to its size. Section 899-aa requires notice to affected residents within 30 days of discovering a breach. Practices that work with Upstate, St. Joseph's or Crouse add HIPAA, DFS-licensed agencies add 23 NYCRR Part 500, and defense suppliers add DFARS 7012. This is general information, not legal advice.
What does the free penetration test cover?
It is external. From the internet, within a scope we agree in writing, we look at what your public IP addresses, websites, VPN and email systems reveal and whether known weaknesses can be exploited. You receive the findings and a ranked list of fixes whether or not you hire us. It does not test the inside of your network, your Wi-Fi or a web application in depth; those are separate, scoped projects. For a Syracuse supplier answering a customer questionnaire, the external report is often the first piece of evidence they can attach.
Do we need managed detection and response if we already have antivirus?
Usually, yes. Antivirus blocks known malicious files. Ransomware crews such as the operators behind Ryuk spend days inside a network first, using stolen passwords and legitimate admin tools that antivirus does not flag. Managed detection and response watches for that behavior, such as a new administrator account created at 3 a.m. or a backup agent being switched off, and a person decides whether to isolate the machine. ThreatDown runs alongside Microsoft Defender for Business, and its alerts land with engineers who already know your environment.
See what an attacker sees before they do.
The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Internal reviews and ongoing security management are scoped separately.