Cybersecurity Services for North Carolina Businesses

Detection and response runs on two layers. Endpoint detection and response (EDR) watches each computer and server for attacker behavior, not just known virus signatures, and managed detection and response (MDR) puts people behind it around the clock so an alert at 2 a.m. gets acted on, not read on Monday. Our article on why antivirus alone is no longer enough covers the difference in more detail.

Security is delivered as part of managed IT services, by the same team that patches your machines and answers your help desk calls. That matters during an incident: the team acting on an alert already knows your network, your servers and your line-of-business software.

• Preferred Essentials: the full baseline above, plus Microsoft 365 matched to each role and domain and email authentication that is locked and monitored.
• Preferred Professional: adds identity threat detection and response, an enterprise password manager, email encryption, and zero-trust VPN with DNS filtering.
• Preferred Complete: adds recurring vulnerability scanning, an annual security assessment with penetration test coordination, and compliance readiness management for CMMC and NIST 800-171.

Key takeaway: Monitoring without response means nobody acts on the alert, and backup without restore testing means you find out it failed on the worst possible day. Every plan includes both halves.

The risk is not limited to defense suppliers or large plants. Among ransomware complaints from businesses outside the critical infrastructure sectors, the FBI lists non-critical manufacturing such as furniture and building materials at 5%, alongside contractors and engineering firms. That describes a large share of the Piedmont Triad, from furniture makers to textile mills and distribution and logistics operations.

In Verizon's 2026 data, exploitation of software vulnerabilities was the entry point for 38% of manufacturing breaches, and 87% of manufacturing breaches were financially motivated. Patching quickly and knowing what is exposed to the internet are not paperwork; they close the door attackers use most.

• More than 3,600 ransomware complaints reached the FBI in 2025, and the FBI notes the reported losses run low because many victims never report a dollar figure.
• Verizon counted 3,627 security incidents in manufacturing in its 2026 dataset, 2,713 of them with confirmed data disclosure.
• Plant floor systems (older PCs running machines, shared logins, vendor remote access) are often the weakest point. We handle OT and IT network segmentation to keep a compromised office PC away from production equipment.

Key takeaway: For a North Carolina manufacturer, ransomware is a production problem first and an IT problem second.

The table above maps the controls on Marsh's list to the Preferred Data plan where each one is included. Whether a policy is issued, and at what price, is always the carrier's decision, so we say "built to what carriers expect", not "guaranteed insurable".

The fastest way to lose a claim is to answer "yes" on an application for a control that is only partly deployed, such as MFA on email but not on remote access. We document what is in place so your application matches reality. Our cyber insurance renewal playbook walks through the questions carriers ask.

Key takeaway: MFA, EDR and tested backups are three of the controls insurers assess, and all three are in every Preferred Data plan. Marsh also lists privileged access management, incident response planning and testing, remote desktop hardening, logging and monitoring, end-of-life systems and supply chain risk, which the standard plans do not list; ask us how they apply to your environment.

The CMMC program rule sets levels by the information you handle. Level 1 covers FCI and means meeting the 15 basic safeguarding requirements in FAR 52.204-21, with an annual self-assessment posted in the Supplier Performance Risk System (SPRS). Level 2 covers CUI and means meeting the 110 requirements of NIST SP 800-171 Rev 2.

What the suspension did not change matters more than what it did. Phase 1 self-assessments, DFARS 252.204-7012, NIST SP 800-171 and SPRS score submissions all remain in effect. A reform task force report was due to the DoD CIO on September 11, 2026 and had not been made public when this page was last verified. Our CMMC Phase 2 suspension briefing and Level 1 self-assessment guide go further.

• Preferred Complete includes compliance readiness management for CMMC and NIST 800-171: ongoing monitoring, documentation and evidence collection. It is also available as an add-on to Preferred Professional.
• We prepare you for the assessment. A CMMC certification is issued by an accredited third-party assessor (C3PAO) or recorded through your own self-assessment, never by your IT provider.
• If only part of your business touches CUI, scoping the assessment to that part can reduce cost. We plan that with you before any spending.

Key takeaway: The pause is on outside certification, not on the security controls. Contracts that include DFARS 7012 still require NIST 800-171 and an SPRS score today.

Paying the ransom is less common: in Verizon's 2026 data, 69% of ransomware victims did not pay, and the median payment among those who did was $139,875. Recovering without paying depends on backups the attacker could not reach, which is why ours are tested by actually restoring them. See backup and disaster recovery and our guide to testing your backups.

People are still the most common way in. Verizon found the human element in 62% of breaches, which is why security awareness training is in every plan rather than an add-on.

• 24/7 threat detection and response is in every plan. 24/7 help desk support (after hours and weekends) is part of Preferred Complete; Essentials and Professional have business-hours and extended-hours help desk support.
• Backups cover workstations and Microsoft 365, and restores are tested, not assumed.
• Third parties were involved in 48% of breaches in Verizon's 2026 report, so vendor remote access and shared accounts get the same MFA and monitoring as your own staff.

National providers often sell security as a tool plus an alert queue, and leave the fix to your internal IT staff. We run your IT and your security together, so the team that acts on an alert is the team that can isolate the machine, reset the account and restore the files.

We also work inside manufacturing environments every day: ERP systems, shop floor PCs, label printers and the shared accounts that come with them. Security that ignores those systems leaves the most important part of the business uncovered.

Before you sign with anyone, compare providers on the questions in our guide to choosing a cybersecurity provider. A good provider will tell you in writing what its plan does and does not cover.

• Start with the free cybersecurity assessment tool to see where you stand.
• For software your business builds or runs, ask about AI-assisted security audits of code and infrastructure.
• Compare the three plans side by side on the pricing page, then book a review of your environment.