Cybersecurity for Metro Detroit companies

Cybersecurity and endpoint protection

Supplier security requirements and cyber insurance applications ask about the same core controls, so those go in first: multi-factor authentication everywhere it's supported, endpoint detection and response on every device, email filtering for phishing and impersonation, and removal of everyday admin rights. For defense suppliers, those same controls map directly to NIST SP 800-171 requirements, so the work counts twice.

Then we build habits. Staff get security awareness training and periodic phishing simulations. We review accounts regularly for former employees and shared logins, configure logging so there's a record if something does happen, and help you write an incident response plan that covers what customers typically ask to see.

Why the supply chain makes you a target

Large automakers and defense primes spend heavily on security, so attackers often go around them through smaller suppliers with trusted connections: a portal login, an EDI link, a shared engineering folder, or simply an email address the customer recognizes. An outage at one supplier can also stop a customer's line. That's why OEMs now audit supplier security, and why a machine shop in Sterling Heights can't treat it as someone else's problem.

The response starts with an honest inventory of those connections. Which customer portals do you use, from which machines, under which accounts? Who holds credentials to a customer's system? Where do drawings and specifications land when they arrive? Once that's known, we can put the right protections around each connection and show your customers exactly how their data and access are handled.

Detection and logging, not just prevention

Prevention tools stop most attacks, but not all of them, so we pair them with detection. Endpoint detection and response watches every device for suspicious behavior, and its alerts get investigated rather than ignored. Microsoft 365 sign-in and audit logs are retained and reviewed for impossible travel, new forwarding rules and unusual admin activity. Firewall logs are kept long enough to reconstruct events after an incident.

Logging is also what customers and assessors increasingly ask about. NIST SP 800-171 has an entire family of audit and accountability requirements, and automotive supplier questionnaires ask how long logs are kept and who reviews them. A clear answer backed by real records turns those questions from a weak spot into a point in your favor during a customer review.

Planning for the bad day

An incident response plan answers a few practical questions before anyone is under pressure: who declares an incident, who calls the cyber insurer, which systems get isolated first, how you keep shipping if the ERP is down, and who tells customers. Many supplier agreements in this region now require notifying the customer within a set period after a cybersecurity incident, so that contact list belongs in the plan as well.

We write the plan with you, keep it short enough to use, and then test it with a tabletop exercise: a walk-through of a realistic scenario, such as ransomware on a Friday night before a Monday launch, with your managers in the room. The exercise always surfaces gaps, like a missing phone number or an unclear decision, and fixing those ahead of time is far cheaper than discovering them live.