A typical Michigan breach report is less dramatic than people expect. A firewall at the edge of the network went three months without a critical firmware update. A former vendor still had an admin account. The nightly backup job had been finishing with a green checkmark since spring, and nobody had tried restoring from it. Each of those systems had been purchased, installed, and paid for, but no one had been assigned to keep checking on them.
Verizon's 2026 Data Breach Investigations Report lines up with that picture. Exploited vulnerabilities accounted for 31 percent of breaches in its dataset, the first time they have outranked stolen credentials as an entry point, and ransomware appeared in 48 percent of breaches overall.
This guide is written for owners, executives, and IT leads trying to make sense of cybersecurity services in Michigan before signing anything. It covers what consulting, managed cybersecurity, identity security, monitoring, and ransomware and incident readiness each involves. It also explains how manufacturing and healthcare change the picture here and what to ask a prospective partner. Several of these topics have their own dedicated articles, linked where they come up.
Sources: Verizon 2026 Data Breach Investigations Report; IBM 2026 Cost of a Data Breach Report
What Do Cybersecurity Services in Michigan Include?
Most cybersecurity services in Michigan fall into four kinds of work:
Identity security and employee awareness training run through all four.
Providers do not always use these terms the same way. One firm describes resold endpoint software as managed security, and another calls an external vulnerability scan a risk assessment. The labels can be defended on paper while the underlying work goes undone, so it helps to decide which problem you are trying to solve before comparing quotes.
| Service | The question it answers | Common trigger |
|---|---|---|
| Cybersecurity consulting | What should we fix first, and in what order? | New leadership, acquisition, post-incident review |
| Risk assessment | Where are we exposed right now, and can we document it? | Insurance renewal, customer security questionnaire |
| Managed cybersecurity | Who runs and maintains the controls every day? | Small IT team, patch backlog, too many unreviewed alerts |
| Security monitoring and response | Who notices an attack in progress and stops it? | No after-hours coverage, slow detection |
| Identity security | Who can access what, and can you prove it? | Cloud migration, merger, gaps in multifactor authentication |
| Ransomware and incident readiness | What happens in the first 72 hours of an attack? | Untested backups, a plan that has never been rehearsed |
| Security awareness | Will employees recognize the attack the tools miss? | Phishing incidents, new AI tools, onboarding |
Compliance and general IT support come up throughout this guide as well. Both connect to security, and both are treated as separate topics below.
Cyber Risk Is Different for Michigan Organizations
Much of the difference comes from the state's economy. Southeast Michigan is the center of the North American auto supply chain, and health systems from Detroit to Grand Rapids run large, data-heavy operations. Both industries are attractive to criminals, and many companies in them run with small IT departments.
National security advice tends to skip the details that matter most here. It rarely considers how many outside parties connect to a supplier's network, why a plant cannot take a production server down for patching mid-week, or what a two-hour EHR outage does to a clinic's schedule. Any provider of cybersecurity services in Michigan should be able to discuss those details in specifics.
The Supply Chain Turns Your Risk Into Someone Else's
Suppliers in Oakland, Macomb, Wayne, and Washtenaw counties are wired into their customers and vendors through supplier portals, EDI connections, shared engineering files, and remote-support tools. The industry depends on that connectivity, and so do attackers. In Verizon's manufacturing data, a third party was involved in 61 percent of breaches, and vulnerability exploitation was the initial entry point in 38 percent.
- Portals
- EDI links
- Eng. files
- Remote support
When a supplier's exposure turns into an automaker's incident, the consequences flow back down the chain as longer, more detailed security questionnaires. Suppliers who cannot answer them with documentation usually find out at contract renewal.
Plant Floors Run on IT More Than Anyone Admits
Engineering workstations, HMIs, historians, and MES servers usually run Windows. They are often connected to the corporate network more directly than the network diagram shows. If ransomware encrypts the business systems that production depends on, the line goes down even though the attacker never touched a PLC.
Dragos's 2026 OT/ICS Cybersecurity Report found that manufacturers made up more than two-thirds of the 3,300 industrial organizations hit by ransomware in 2025. The same report notes that OT incidents are frequently written up as IT-only events, which understates how often production is affected. Protecting manufacturing environments means treating the plant network and the office network as one environment that operates under different rules.
Healthcare Has to Protect Data and Uptime at Once
A hospital or specialty practice holds records that sell well on criminal markets. It also runs operations that cannot stop for a weekend while systems are rebuilt. Verizon's healthcare figures show ransomware-driven intrusions alongside a steady share of breaches caused by staff mistakes and misconfigured systems.
Security programs for healthcare organizations have to account for:
EHR integrations
medical devices that vendors restrict from patching
clinicians who will work around any control that slows patient care
Small IT Teams Face the Same Threats as Large Ones
Verizon also reports that small and mid-sized businesses absorb a disproportionate share of ransomware with far fewer resources than large enterprises. Picture a 200-person company with two IT staff. Patching, overnight alert review, access reviews, vendor management, and the help desk all compete for the same few hours, and security tasks usually lose to the ticket queue.
What Is Cybersecurity Consulting, and When Do You Need It?
Cybersecurity consulting is advisory work aimed at three questions:
- Where are you exposed?
- What could that exposure cost?
- What should be fixed first?
The finished product should be a ranked roadmap with an owner and target date for each item.
In many engagements, the first finding is that the organization already pays for more protection than it uses. Microsoft 365 licenses often include security features nobody has turned on. Endpoint agents are missing from a handful of machines, and alert rules are still on vendor defaults. Sorting out which tools are doing their job is the starting point for cybersecurity consulting in Michigan, and it often changes what needs to be bought.
Organizations tend to bring in a consultant at predictable moments:
A new CEO or IT director wants a baseline
An acquisition brings an unfamiliar network into the company
An insurer or large customer sends a questionnaire nobody can answer with documentation
The board asks about cyber risk after a competitor's incident makes the news
Companies that need security leadership on a continuing basis, without hiring a full-time CISO, often extend the arrangement into a virtual CISO role.
Roadmaps hold up better when they are tied to a recognized framework. CISA's Cross-Sector Cybersecurity Performance Goals 2.0, published in December 2025 and aligned with the NIST Cybersecurity Framework 2.0, added a governance section and merged IT and OT goals into a single set. That structure suits manufacturers whose plant and office systems have grown together.
Where Risk Assessments Fit
The risk assessment is usually the first piece of work a consultant delivers. A useful one documents:
- How systems are configured
- Which controls are missing
- What is reachable from the internet
- Which gaps carry the most business risk
Each finding should come with a priority and an owner. Without those, the report tends to sit untouched in a shared drive. Cybersecurity Risk Assessment: What Yours Must Uncover covers scope and method in more detail.
What Does Managed Cybersecurity Mean?
With managed cybersecurity, an outside team runs your security controls day to day. That includes applying patches, maintaining configurations, watching alerts, investigating suspicious activity, responding to incidents, and reporting on all of it. What you are paying for is a team responsible for those results.
Patching is where the difference is easiest to see. Verizon found that organizations fully remediated only 26 percent of the vulnerabilities on CISA's Known Exploited Vulnerabilities list, which are flaws attackers are already using. The median time to fully resolve one was 43 days. Attackers, many now using AI to speed up reconnaissance and exploit development, can act within hours of a flaw becoming public.
Closing that gap takes someone whose job is to own it, and that is the core of managed cybersecurity services. A quick check: ask who owns patching this month, on your team or your provider's. If the answer takes a while, that tells you something.
Managed Cybersecurity and Managed IT Are Different Jobs
Managed IT focuses on keeping systems available and users productive. Managed cybersecurity starts from the assumption that someone is trying to get in. A good managed IT services provider can run a responsive help desk and well-maintained infrastructure and still leave security underpowered if no one has been assigned to it. Most mature organizations need both, with a clear agreement about who handles what.
| Cybersecurity consulting | Managed cybersecurity | Managed IT | |
|---|---|---|---|
| Primary job | Identify exposure and set priorities | Operate and improve security controls | Keep systems running and users productive |
| Cadence | Project-based, then periodic | Continuous | Continuous |
| Typical output | Findings and a prioritized roadmap | A patched, monitored, hardened environment with reporting | Resolved tickets and maintained infrastructure |
| Measured by | Accuracy and usefulness of priorities | Exposure reduced; time to detect and contain | Uptime, response times, user satisfaction |
| Best fit | Organizations needing a baseline or second opinion | Organizations without around-the-clock security staff | Organizations that want IT operations handled |
Fully Managed or Co-Managed
Some organizations hand the whole security program to a partner. Others keep an internal team and bring in outside help for specific gaps, most often overnight monitoring, incident response, or identity administration. Either model can work as long as each control has a named owner and each type of alert has someone required to act on it.
Identity Sits at the Center of Every Security Program
Every login is a decision about who gets access to what, which is why so many attacks target accounts. An attacker who can sign in as an employee, a vendor, or a service account can bypass most perimeter controls.
Credential abuse ranked below vulnerability exploitation in Verizon's latest report. Even so, stolen session tokens, MFA fatigue attacks, and phone-based impersonation still give attackers working logins. Vendors are a frequent weak point: only 23 percent of third-party organizations in Verizon's data fully fixed missing or weak multifactor authentication on their cloud accounts.
Multifactor authentication is the starting point. A mature identity program also:
Uses conditional access
Replaces permanent admin rights with on-request elevation
Reviews vendor and service accounts on a schedule
Flags risky sign-ins as they happen
In most Michigan organizations, that work runs through Microsoft 365 identity controls such as Entra ID and conditional access policies.
A practical way to test your setup is to pick one ordinary user account and trace what it can reach, including file shares, finance systems, and backup consoles. Then do the same for your most privileged vendor account. Why Identity Is the New Perimeter goes deeper into identity-first design.
What Should Security Monitoring Catch, and Who Responds?
Good security monitoring covers identities, endpoints, email, and cloud services, plus plant systems for manufacturers. It is staffed by people who are expected to investigate and act on what they see. Without that second part, monitoring mostly produces alerts.
Dragos's numbers show why speed matters. Organizations with comprehensive OT visibility detected and contained OT ransomware in an average of 5 days, compared with an industry-wide average of 42 days.
When you evaluate a monitoring service, ask three things:
- Which data sources are covered, and which are excluded?
- Who reviews an alert at 2 a.m. on a Sunday, and can that person isolate a laptop or disable an account without first reaching someone at your company?
- Do the people who see the alert also handle the incident through containment and recovery, or do they open a ticket and pass it to another team?
Each handoff costs time, because the new team has to learn your environment before it can act. For plants and clinics, there is also a physical side. Taking an engineering workstation offline or restarting a line in the right order is easier with someone who can be in the building the same day.
How Ready Is Your Organization for Ransomware?
Being ready for ransomware means three things:
- Blocking the common ways in.
- Limiting how far an attack spreads.
- Restoring operations from backups the attacker could not reach, quickly enough that the business can absorb the downtime.
Organizations usually invest heavily in one of these and assume the other two are covered.
Fewer victims are paying: Verizon found that 69 percent of ransomware victims refused. IBM's 2026 Cost of a Data Breach Report shows ransomware incidents rising to 39 percent of the organizations studied, up from 34 percent. Attackers are also leaning more on threats to publish employee data or damage a company's reputation. When paying is off the table, how quickly you can restore becomes the deciding factor.
Prevention, Containment, and Recovery
Each of the three depends on different work:
Prevention focuses on the routes ransomware typically uses: remote access exposed to the internet, unpatched firewalls and VPN appliances, phished passwords, and accounts with more access than their owners need.
Containment relies on network segmentation and on endpoint and identity tools that can isolate a machine or end a session within minutes.
Recovery relies on backups that are isolated or immutable, tested with real restores on a regular schedule, and organized around which business processes have to come back first.
Why Business Continuity Services Belong in Every IT Strategy covers backup design and recovery targets.
The Real Cost of an Outage
IBM put the 2026 global average cost of a data breach at a record $4.99 million, a 12 percent increase over the prior year. For manufacturers, lost production often adds up faster than the breach costs themselves.
As an illustration, take a Southeast Michigan supplier that runs two eight-hour shifts and produces about $15,000 of output per production hour:
A three-day shutdown removes 48 production hours, or roughly $720,000 in output.
If backups fail during restore and recovery takes seven days, the loss rises to about $1.68 million.
Illustrative lost output only. Freight, overtime, chargebacks, and recovery costs are not included.
Expedited freight, catch-up overtime, customer chargebacks for late shipments, and the recovery effort itself all come on top of that.
Insurers have tightened their questions as a result. Applications now ask in detail about multifactor authentication, endpoint detection, backups, and incident plans, and inaccurate answers can affect coverage. Cyber Insurance Requirements: A Michigan Renewal Guide explains what underwriters look for.
What an Incident Response Plan Should Cover Before You Need It
An incident response plan should settle the decisions that are hardest to make under pressure:
Who leads the response
Who can approve shutting systems down
Who contacts outside counsel and the insurance carrier
How the team will communicate if email is compromised
Which notification rules apply
NIST's SP 800-61 Revision 3, finalized in April 2025, places incident response inside everyday risk management and maps it across all six functions of the Cybersecurity Framework 2.0. For a mid-sized company, that means a plan that is rehearsed, revised after major changes, and owned by the people who run the systems.
Michigan organizations should also check that their plan covers these points:
The Michigan State Police's Michigan Cyber Command Center (MC3) investigates cyber incidents involving Michigan businesses, including ransomware and business email compromise. It can be reached at mc3@michigan.gov or 877-MI-CYBER. Decide with counsel ahead of time when that call gets made.
Michigan's Identity Theft Protection Act requires notice to affected Michigan residents after a security breach, unless the organization determines the breach is not likely to cause substantial loss, injury, or identity theft. HIPAA and other sector rules can add obligations. Counsel should make that determination, and the plan should bring counsel in early.
If Microsoft 365 is compromised, an attacker may be able to read Teams chats and email about the response. Agree on a separate communication channel in advance.
Many cyber insurance policies require prompt notice and the use of approved incident responders. Check those terms before an incident, not during one.
Run one at least once a year with senior leaders taking part. It tends to expose gaps that a document review misses.
Where Cybersecurity Ends and Compliance Begins
Cybersecurity lowers the chance and impact of an attack. Compliance shows a regulator, customer, or assessor that you meet a specific standard. The two overlap a great deal, but an organization can satisfy a checklist and still be easy to breach, which is why they are best planned as separate efforts that share information.
In Michigan, the frameworks that come up most often are:
for defense suppliers
for healthcare
for automotive suppliers working with European automakers
for organizations that handle criminal justice data
Each spells out what has to be documented and demonstrated. Security work puts the controls in place, and compliance work maps them to the framework, collects evidence, and prepares for review.
Certification itself, such as CMMC Level 2 or a TISAX label, is issued by accredited third-party assessors, so no provider can certify an organization on its own. Gap analysis and audit preparation fall under compliance readiness, which is covered separately.
Choosing a Partner for Cybersecurity Services in Michigan
Look at accountability, response, and industry fit. Find out who owns the results, who acts during an incident, whether the team understands how your type of business runs, and how quickly someone can be on site. A list of supported products or partner logos says little about any of those.
Providers of cybersecurity services in Michigan tend to fall into three groups:
Large national firms offer scale and around-the-clock tooling. Some monitor from a central operations center and send response work to another team. Some serve Michigan through a local company they acquired recently and are still integrating.
Small local firms are close by and often know their clients well. Many cover a wide range of industries and have limited depth in plant networks or clinical systems.
Regional providers fall between the two. They are close enough to send someone on site within hours and large enough to have dedicated security staff.
Each group includes strong and weak options, and the questions below help tell them apart.
7 Questions to Ask Before You Sign
If your current provider has trouble with these questions, 5 Signs Your MSP Is Not Managing Risk describes the warning signs that tend to appear first. For a sense of what a dependable partner looks like, the answers above point to three things: a single owner for IT operations and security, an assessment before any recommendation, and the same team involved from design through incident response.
Frequently Asked Questions
How much do cybersecurity services in Michigan cost?
Pricing depends on several factors, so published figures are rarely meaningful:
the number of users and devices
servers and cloud workloads
compliance requirements
hours of coverage
whether on-site response is included
Most providers now price as a predictable monthly subscription, with a baseline of core protections plus add-ons for specific needs. That makes budgeting easier than paying break-fix invoices after an incident.
Is antivirus and a firewall enough for a mid-sized business?
For most mid-sized organizations, no. Many breaches now start with an unpatched system, a hijacked login session, or a vendor's access, and antivirus and a firewall address only part of that. A reasonable baseline adds consistent patching, identity controls, monitored alerts with someone assigned to respond, and tested backups.
Do manufacturers need separate security for plant-floor systems?
Plant systems need coverage, but that does not always mean a separate program. Engineering workstations, HMIs, and production servers need segmentation, monitoring, and patch schedules that account for production uptime, and they work best inside the same program that protects the office network. When the two are run separately, incidents are more likely to be misclassified and response tends to slow down.
Who should a Michigan business call first during a cyberattack?
Your incident response plan should specify the order. Typically:
The internal incident lead and the security partner start containment.
Outside counsel and the cyber insurance carrier are contacted next, since many policies limit which responders you can use.
Michigan businesses can also report incidents to the Michigan Cyber Command Center at 877-MI-CYBER.
How often should a cybersecurity program be reassessed?
Plan on at least once a year, plus after any major change: an acquisition, a cloud migration, a new compliance requirement, or a significant incident. Systems, users, and vendors change throughout the year, and an assessment from last year will miss some of those changes.
Start With a Clear View of Your Exposure
The common thread in this guide is accountability. Good tools help, but results depend on someone taking responsibility every day for patching, identity, monitoring, response, and recovery, and knowing the environment well enough to act quickly when something goes wrong.
Centaris works with organizations across Michigan and the Great Lakes region as an IT and cybersecurity partner, with particular depth in manufacturing and healthcare. Engagements begin with an assessment that shows where you are exposed. The recommendations that follow cover only what the findings support, delivered fully managed or co-managed on a predictable monthly subscription. If an incident occurs, the in-house team that already knows your systems handles the response and can be on site when needed.
To see where your organization stands today, schedule a no-obligation assessment.
