Cybersecurity Services in Utah
Utah has seen ransomware hit its flagship university, a vendor breach reach school districts from Logan to St. George, and a county's stolen files posted online. Each case maps to a control a smaller business can have too, and NetSys installs and runs them remotely: detection and response on every computer, sign-ins a stolen password cannot open, filtered mail and backups out of an attacker's reach.
The short answer
NetSys runs cybersecurity for Utah businesses as a remote service. Every computer gets ThreatDown managed detection and response alongside Microsoft Defender, sign-ins are restricted to multifactor and trusted devices through Entra ID Conditional Access, mail passes through Barracuda before it reaches Microsoft 365, and backups sit where ransomware cannot delete them. Rapid7 scans, KnowBe4 phishing tests and Keeper complete the stack. No NetSys engineer travels to Utah; alerts are watched 24/7 and the help desk answers from 2 a.m. to 9 p.m. Mountain. We also document the program against the frameworks Utah's affirmative-defense statute names.
Service information by The NetSys Group. Our editorial standards.
How cybersecurity is delivered to Utah businesses
Nothing in the security stack needs a technician in the room. The NinjaOne agent installs ThreatDown and Defender on each computer and server, Conditional Access policies live in your Entra ID tenant, and Barracuda filtering is a mail-routing change made in DNS. When ThreatDown confirms malicious activity on a laptop in Ogden or a front-desk PC in Cedar City, an engineer isolates that machine from the network, kills the user's active sessions and forces a new password before the intruder can reach a second system. No NetSys engineer is sent on site in Utah, so hardware work, such as replacing a firewall, falls to your staff or cabling contractor, with the new unit arriving preconfigured and our engineer guiding the swap. Alert history, sign-in logs and an incident timeline are pulled remotely and preserved for your insurer and attorney. Monitoring runs 24/7 from Brooklyn, and so does emergency service. Our staffed help-desk hours are 4 a.m. to 11 p.m. Eastern time (2 a.m. to 9 p.m. Mountain), seven days a week. The proposal states severe-incident escalation, authorized remediation and any other after-hours work.
Three Utah incidents and the control each one calls for
In July 2020 ransomware encrypted servers in the University of Utah's College of Social and Behavioral Science. The university restored operations from backups but still paid $457,059 through its cyber insurance policy, because student data had been copied out before the encryption. Backups no longer settle a ransomware case, so we add alerts on large outbound transfers and keep sensitive files off servers nobody watches. In June 2021 a phishing email harvested a Revere Health employee's password and opened a mailbox holding records on roughly 12,000 cardiology patients in St. George; Revere's team cut the access within about 45 minutes. Phishing-resistant sign-in and mailbox alerting are the answer there. In August 2025 Box Elder County disclosed a cybersecurity incident, and the Interlock ransomware group later posted more than 2 million of its files. Crews now steal first and encrypt second, which is why outbound traffic gets the same scrutiny as malware.
Vendor access: PowerSchool, MOVEit and the outsiders in your systems
Two incidents that have reached Utah since 2023 began at a vendor rather than at the victim. Attackers broke into PowerSchool, a student-information vendor, and took records that the Salt Lake City, Cache, Iron and Washington County school districts and the Utah Schools for the Deaf and the Blind disclosed in January 2025. In 2023 a flaw in MOVEit file-transfer software let attackers download files from TMG Health, a vendor to University of Utah Health Plans, exposing data on about 3,900 members. A small business carries the same exposure through its payroll provider, its hosted EHR or tax software and the remote-access tool a former IT company left behind. We inventory every outside account and remote agent, remove the ones nobody can explain, require multifactor sign-in for the rest and ask each vendor in writing how it protects your data.
Building a program that fits Utah's affirmative-defense law
Utah's Cybersecurity Affirmative Defense Act, Utah Code 78B-4-701 to 706, passed as HB 80 in the 2021 general session and unchanged since, gives a business a defense to claims brought under Utah law or in Utah courts that weak security caused a breach, provided it kept and reasonably followed a written cybersecurity program at the time. The program must reasonably conform to a recognized framework: NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP security assessment framework, the CIS Critical Security Controls or the ISO/IEC 27000 family, or to the rule already governing the data, such as the HIPAA Security Rule, Gramm-Leach-Bliley or PCI DSS. Separate defenses cover how you responded and notified, but only if the program held protocols for both and you followed them. The NIST Cybersecurity Framework is not on the list, so a program built on it should be mapped to one that is. This is general information, not legal advice.
Defense suppliers along the Wasatch Front and the CMMC pause
Hill Air Force Base and Northrop Grumman both rank among Utah's ten largest employers in the state's 2024 count, and Northrop broke ground in July 2026 on another building at its Roy Innovation Center for the Sentinel program. Machine shops, composites makers, software firms and engineering consultancies from Ogden to Salt Lake City handle Controlled Unclassified Information for them. In July 2026 the Department of War paused the program's next step: on July 13 it suspended CMMC Phase 2, under which third-party Level 2 certification would have become a condition of award starting November 10, 2026, and it put Phases 3 and 4 on hold pending a reform task force's review. The obligations underneath did not pause. DFARS 252.204-7012 still applies, as do the Revision 2 requirements of NIST SP 800-171, Level 1 and Level 2 self-assessments and a current SPRS score. We fence CUI into a defined set of accounts, devices and storage, enforce encryption and Conditional Access there, and keep the evidence a prime contractor will request.
Cybersecurity in Utah: what NetSys delivers
Detection and response
- ThreatDown managed detection and response with EDR agents on every workstation, laptop and server, monitored 24/7
- Microsoft Defender for Business and Rapid7 InsightIDR telemetry from identities, email and endpoints, with a person acting on alerts
Identity and email
- Entra ID Conditional Access and multifactor authentication across Microsoft 365, with legacy authentication switched off
- Privileged access and privileged identity management so admin rights are granted just in time and removed afterwards
Exposure and recovery
- Rapid7 InsightVM vulnerability scanning on a schedule, with findings fixed rather than filed
- Cisco Meraki or Fortinet firewall management, segmentation and DNS filtering on office and remote devices
Firewall, antivirus and maintenance for a five-person office
A five-person office needed the basics done properly rather than an enterprise stack. NetSys replaced the internet provider's router with a business-grade firewall configured with sensible rules, secure remote access and logging, deployed managed antivirus on every machine with updates and alerts handled centrally, and put patching, backup checks and health reviews on a schedule. The agreement covers what the office needs and nothing it does not, month to month. No outcome figures were measured for publication.
Cybersecurity work for other clients
- Insurance
Regional title insurance company
Barracuda email protection for 85 users, phishing simulations, employee security training, and MFA deployment.
Security Awareness & Phishing TrainingIT for Insurance Agencies and Brokers
Client names are withheld. These examples were chosen for the work involved, not for where the client is, so none is presented as a Utah client.
What cybersecurity costs in Utah
Cybersecurity is priced per user per month when it runs as an ongoing service, and per project for an assessment or a remediation. What moves the number: how many devices and identities are in scope, how much incident remediation and recovery is needed beyond the monitoring and authorized MDR actions in scope, which compliance standard the evidence has to satisfy, and whether the Microsoft 365 tenant is already on Business Premium or the security tooling comes from us. The free external penetration test costs nothing and runs remotely before any of that. Our managed IT pricing page explains how the fee is built.
Who this fits, and who it does not
Best fit: businesses with enough people, money movement or regulated data that a breach would hurt, and no security team of their own: professional practices, healthcare groups, importers, financial firms, nonprofits and agencies holding client credentials. Companies with an internal IT person fit as a co-managed arrangement.
Read next
Industry pages: IT for Financial Services · IT for Healthcare
Terms used on this page: Managed Detection and Response (MDR) · Endpoint Detection and Response (EDR) · Conditional Access
Guides: MDR versus antivirus for a small business · the Conditional Access policies to turn on first
Related pages
Read the full Cyber Security service page. See everything NetSys delivers in Utah.
Also in Utah: Managed IT Services · IT Consulting · IT Support
Cybersecurity elsewhere: Denver · Albuquerque · Bellevue, Washington · Colorado · Colorado Springs · Hawaii
Related services: Penetration Testing · Cyber Insurance Readiness · Security Assessments · Managed Detection & Response (MDR)
Cybersecurity in Utah: FAQs
How does cybersecurity work for Utah organizations?
It is delivered remotely and through the cloud. Our engineers deploy ThreatDown, Defender, Conditional Access and Barracuda over the network, then watch alerts and act on them from Brooklyn: isolating a computer, disabling an account, restoring files. All of Utah keeps Mountain time, so the help desk window of 2 a.m. to 9 p.m. Mountain covers every office from Logan to St. George, and a security emergency outside it still reaches an engineer. NetSys has no Utah office and sends no one into the state; replacement devices ship configured and your team handles physical work.
How much do cybersecurity services cost in Utah?
Ongoing protection is billed monthly per user at a rate fixed by an assessment, either as a standalone service or as part of a managed IT agreement. It moves with how many computers, servers and Microsoft 365 tenants you run, whether your Microsoft 365 plan already carries Defender and Conditional Access, whether you hold CUI, patient records or card data, and how much documentation your insurer or a prime contractor expects. One-time projects, such as a written program for the affirmative defense or a breach-response plan rehearsed with your managers, are quoted after scoping. The remote external penetration test is the one free piece.
Does Utah's affirmative-defense law help a small business?
It can, because the program only has to fit your size and complexity, the nature of your work, the sensitivity of the data, the cost of available tools and your resources. It will not cover neglect: the defense is lost if you had actual notice of a threat, did not take known remedial steps within a reasonable time, and that threat caused the breach. A risk assessment does not count as that notice, so finding problems is safe and ignoring them is not. When a framework you rely on is revised, the statute allows one year from publication to catch up. Your counsel decides how it applies to you.
Which Utah privacy and breach laws apply to my business?
Almost any business holding Utah residents' personal information falls under Utah Code 13-44: reasonable procedures against misuse, secure destruction of records you no longer keep, and a prompt, good-faith investigation after a breach. Residents are notified when misuse is likely; at 500 or more affected residents the Attorney General and the Utah Cyber Center must also be told, and at 1,000 the nationwide credit bureaus. The Utah Consumer Privacy Act reaches far fewer firms: only those with at least $25 million in annual revenue that also process data on 100,000 consumers, or on 25,000 while earning most revenue from selling data.
What happens in the first hours if ransomware hits a Utah office?
Phone our emergency number, answered by an engineer day or night, and pull the network cable or Wi-Fi from affected machines while leaving them powered on. Do not contact the attackers. Your dedicated engineer isolates devices through ThreatDown, disables compromised accounts, confirms the immutable backups were untouched and starts preserving logs for your insurer and counsel. Utah's notice law sets no fixed number of days, but it expects a prompt investigation and notice without unreasonable delay. Over the last three years NetSys has worked more than 30 ransomware cases, and every client was fully recovered; the ones that had a disaster recovery plan were running again inside 24 hours.
See what an attacker sees before they do.
The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Internal reviews and ongoing security management are scoped separately.