I don’t see my industry — do you serve us?
Probably yes. After 24 years protecting Triangle, Triad, Charlotte, and Wilmington businesses, Petronella Technology Group has the regulatory range, the security depth, and the on-the-ground familiarity to serve more than just the verticals on the front page. This is the long catalog: who else we work with, what they typically worry about, and how to know if we’re a fit before you pick up the phone.
If you don’t see yourself below, call us anyway. The honest answer is usually that we’ve already worked with someone close enough to skip the learning curve.
The vertical specialist’s catchall, not the marketing-page version
Most cybersecurity firms in North Carolina write “industries served” pages by listing every category in the dictionary and hoping a logo lands. We took the opposite approach. The pages on our main industries menu (healthcare, defense contracting, financial services, legal, federal, small business B2B and B2C) are the verticals where we have the deepest bench, the most repeat work, and the strongest references. This page is for everyone else. The dental practice in Garner. The structural engineering firm in RTP. The nonprofit running grant-funded programs out of Durham. The hotel group with five properties between Asheville and Outer Banks. They’re real, they pay us, and they sit on this catchall because they don’t fit cleanly into a top-six bucket.
Twelve more verticals, one paragraph each
If your business shows up here, you’re in good company — we have current or recent engagements in every category below. Each card explains who buys from us in that vertical, what they’re protecting, and the worry that usually lands them on a first call. Hover or click for a quick deep-link to the related service or compliance page.
Structural, civil, MEP, and ITAR engineering firms
Who: 5–200-seat firms with CAD/BIM workloads, federal or DoD-adjacent project work, or controlled technical data on file servers.
Engineering firms care about three things on a first call: protecting the proprietary drawings and calculation files that ARE the business, satisfying ITAR or CUI requirements when work touches federal projects, and keeping multi-gigabyte CAD/Revit/Bentley sessions snappy from any office or jobsite. We’re increasingly the answer for Triangle and RTP firms running into NIST 800-171 contract clauses for the first time.
Engineering firm specialization ›Architecture and design practices
Who: practices with shared model files, contractor portals, and client document collaboration across multiple stakeholders.
Architecture firms in the Triangle and Charlotte tend to land on us after a near-miss with wire fraud during construction draw cycles, or when an institutional or government client starts asking pointed cybersecurity questions during procurement. Their identity worry is usually the same: “our project files and client communications are our reputation, and we don’t want to be the firm that lost the drawings.”
Architecture industry detail ›Nonprofits, foundations, and faith-based organizations
Who: 10–150-seat orgs running grant-funded programs, donor databases, and lean back offices across the Triangle and Triad.
Nonprofits worry about two specific things: a breach that compromises donor PII and tanks fundraising trust, and a board that starts asking cybersecurity questions when grant reporting requirements (especially federal pass-through funds) tighten. We’re the local team that sizes a real program against a real budget instead of a Fortune 500 quote sheet, and we know the donor database and grant accounting systems most of you actually run.
Nonprofit specialization ›General contractors and specialty trades
Who: GCs and specialty subs from Wake, Durham, Wilmington, and the Triad with active jobsites, project management software, and mobile crews.
Construction firms have an unusual identity. The office is small but the attack surface is huge: jobsite trailers on public Wi-Fi, project management portals shared with subs and architects, draw schedules running in seven figures. The worry that drives the call is almost always wire fraud or business email compromise on a draw payment. We come in to lock down the email layer first, then move to jobsite connectivity and PM-platform protection.
Construction IT detail ›Manufacturers and contract producers
Who: SMB manufacturers with mixed IT/OT, ERP systems, and (increasingly) DoD subcontract clauses.
Manufacturing buyers identify themselves by their downtime cost. A line idle for an afternoon is real money, and ransomware attackers know it. The companies we serve worry about a phishing-driven shutdown of the production network, an ERP outage that breaks customer commitments, and (for the growing share with DoD primes) the CMMC Level 2 requirement landing in their next contract renewal. We bring the OT/IT segmentation, the ERP backup posture, and the CMMC pathway under one roof.
CMMC for manufacturers ›Dental and orthodontic practices
Who: 1–15-chair single-location and small-group practices in Raleigh, Cary, Apex, Wake Forest, Durham, and the Triad.
Dental practices identify by the HIPAA exposure their PMS and imaging systems carry. The buyer is usually the owner-dentist or the practice manager, and the worry is twofold: a ransomware event that locks the practice management software during a fully booked day, and a HIPAA Risk Analysis gap that the next OCR audit letter would surface. We come in light, harden the imaging and patient-records environment, and produce the HIPAA artifacts the practice should already have.
Dental HIPAA specialization ›Auto dealerships and dealer groups
Who: single rooftops and small dealer groups subject to the FTC Safeguards Rule, with DMS, F&I, and customer credit data.
Dealerships identify by the FTC Safeguards Rule and the staff turnover problem. Service writers, F&I, and sales teams cycle, the customer financial data on file is high-value, and dealer management systems are sticky vendor environments that don’t love security overlays. The worry is a Safeguards finding during the next state or NADA-aligned audit, plus the very real risk of customer PII exfiltration. We do the assessment, the staff training, and the technical controls without disrupting the sales floor.
Auto dealer specialization ›Hotels, restaurants, and multi-property hospitality groups
Who: independent hotels, small chains, restaurant groups, and event venues with PMS, POS, and high-volume card transactions.
Hospitality buyers identify by PCI scope and guest experience. POS systems run thousands of card transactions a day, the property management system holds reservation and guest profile data, and the front desk is a high-turnover, high-pressure environment that’s also a phishing-prone email recipient. The worry is a card-data breach that triggers brand-standard penalties, a ransomware event during a peak weekend, or a wire-fraud event aimed at the property accounting team.
Talk to us about hospitality IT ›Independent retail and small chains
Who: brick-and-mortar retailers, multi-location chains, and DTC brands with e-commerce, POS, and inventory systems.
Retail buyers identify by the same PCI lens as hospitality but with a different shape. The threat that drives the call is usually a card-data exposure or a successful phishing attack on the back office. Increasingly, the second worry is the e-commerce site itself: card-skimming Magecart attacks, plugin vulnerabilities, and compliance with state-level data privacy rules that now reach DTC retailers far smaller than Fortune 500.
Talk to us about retail IT ›Independent schools, charters, and ed-tech
Who: K-12 independent and charter schools, private universities, and ed-tech vendors handling student data at North Carolina addresses.
Education buyers identify by FERPA, by tight budgets, and by a wide attack surface: student devices, parent portals, transportation routing, financial aid records, and learning management systems. The worry is the headline-grade ransomware event that closes the school for a week, plus the slower-burn risk of student PII exposure. We size programs that respect education budgets and lean heavily on configuration hygiene, identity controls, and phishing-resistant authentication for staff.
Talk to us about education IT ›Real estate brokerages, property management, and title
Who: brokerages, multi-office property managers, title companies, and mortgage brokers handling closing funds and tenant PII.
Real estate professionals identify by wire-fraud risk first and tenant/client data second. Closing-fund redirection is one of the highest-frequency, highest-loss attack patterns we see in North Carolina. Property managers add a second concern: tenant SSN and credit data sitting in the property management database. The conversation usually starts with email authentication (SPF, DKIM, DMARC), wire-verification procedures, and PMS hardening.
Real estate specialization ›SaaS startups and software companies pursuing SOC 2
Who: 10–200-seat SaaS companies in RTP, Durham, and Charlotte with enterprise sales motion, often raising or growing into SOC 2.
SaaS buyers identify by the deal-blocker. They’ve usually had a prospect ask for a SOC 2 Type II report or a security questionnaire they can’t answer cleanly, and the cost of losing the deal is bigger than the cost of the program. The worry is twofold: failing the readiness assessment and missing the deal window, and embedding security controls in a way that doesn’t kneecap the engineering velocity that makes the company valuable. We’ve done this many times.
SOC 2 for SaaS specialization ›North Carolina footprint by region
Identity is geographic too. We work statewide, but the texture of the conversation changes by region. If you’re trying to figure out whether we’ll show up in person or whether we’ve already protected someone in your zip, this is the quick map.
Triangle (Raleigh, Cary, Durham, Chapel Hill, Apex, Morrisville, RTP, Wake Forest)
Our home market. Most of our engineering, SaaS, healthcare, dental, legal, and federal-contractor clients are within a 30-mile radius of our Centerview Drive office. Onsite work happens fast and often. RTP biotech, ed-tech, and government contractor density makes this the densest part of our customer book.
Triad (Greensboro, Winston-Salem, High Point, Burlington)
Strong concentration of small and mid-size manufacturers, nonprofits, and family-owned businesses. We serve them with a hybrid of remote operations and scheduled onsite visits, plus the same after-hours response posture as Triangle clients.
Charlotte and the Metrolina region
Heavy on financial-services-adjacent firms, professional services, real estate, and growing dealer-group and hospitality concentration. Most engagements are remote-first with periodic onsite for assessments, training, and major project work.
Wilmington, the coast, and Eastern NC
Hospitality, retail, healthcare practices, and a growing population of remote-friendly professional services firms. We support these clients on the same managed services model and travel for project work and assessments.
Western NC and the mountains
Smaller footprint, primarily nonprofits, hospitality groups, and remote-friendly professional firms. Same managed services posture, scheduled onsite for major work.
Buyer scenarios we hear every week
If any of these sound like the conversation you would start with us, the answer is yes — we work with companies like yours, and the conversation starts with listening, not pitching. These are paraphrased from actual first calls.
The unfamiliar-vertical buyer
“We’re a [niche industry], and your site doesn’t mention us. Do you actually serve businesses like ours?”Yes, almost always. The verticals on the main industries menu are where we have the deepest bench, but the catalog above is just the next dozen we work with regularly. The first call is exploratory, no pressure: we ask about your tech stack, your regulatory exposure, your headcount, and the worry that’s on your mind. By the end of the call, you’ll have a clear sense of whether we’re a fit and what an engagement would look like.
The federal-contract buyer
“A prime contractor or federal customer just asked us about CMMC, NIST 800-171, or DFARS clause 252.204-7012. We don’t know what to do.”Common conversation. We’re a CMMC Registered Provider Organization (RPO #1449), and we’ve walked many engineering, manufacturing, and professional services firms through this exact moment. We start with a scoping conversation to figure out whether you’re looking at Level 1 or Level 2, then we map the gap and build a realistic timeline. The deliverable view of that work lives at solutions/industries/more.
The post-incident buyer
“Something just happened. Wire fraud, a phishing hit, a ransomware note, a stolen laptop. Help.”Pick up the phone. Craig Petronella holds NC Digital Forensics Examiner license #604180 and the team handles the technical investigation, the evidence preservation, and the coordination with insurance carriers, law enforcement, and (when needed) outside counsel. After containment and triage, we’ll talk about whether the right next step is a managed relationship to make sure the same gap doesn’t reappear.
The compliance-deadline buyer
“We have a HIPAA, PCI, SOC 2, FTC Safeguards, or state-data-privacy deadline coming and we’re behind.”We work fast in this scenario. The first call clarifies the actual deadline, the actual framework, and the actual gap, then we build a remediation plan that’s sequenced to hit the deadline rather than gold-plate the program. We’ll tell you honestly when a deadline is unrealistic and when it’s achievable with focus. After the deadline, the conversation usually shifts to a maintenance model so the program doesn’t decay.
The size-mismatch buyer
“Your site mentions Fortune-500-sounding capabilities. We’re a 25-person shop. Are we too small?”You’re not too small. Most of our managed-services clients are between 5 and 200 seats. The reason the site references enterprise-grade capabilities is that we run an enterprise-grade security stack and resell it appropriately scoped for SMB pricing. The catchall here exists specifically because small businesses across niche verticals want a real answer, not a brochure.
Why niche verticals choose Petronella over generalists
A typical break-fix MSP can keep your printers working. A typical compliance consultant can hand you a binder. We sit at the intersection: the security and compliance depth a regulated firm needs, paired with the day-to-day responsiveness a small or mid-size business actually relies on. Here is the honest view of what we bring to a vertical we don’t advertise on the front page.
We’ve done this before, somewhere close to your industry
Even when the exact vertical isn’t one of our top six, the technical and regulatory shape almost always rhymes with something we’ve done. Engineering ITAR rhymes with defense CUI. Dental HIPAA rhymes with healthcare HIPAA. Hospitality PCI rhymes with retail PCI. We don’t learn on your dollar; we map the patterns we already know.
One firm covers the security, compliance, forensics, and AI conversation
You don’t need to triage between an MSP, a compliance firm, a forensics shop, and an AI consultancy. We carry CMMC RPO accreditation, an NC Licensed Digital Forensics Examiner, the cybersecurity stack, and the private AI infrastructure under one engagement. That’s rare in North Carolina at our scale.
We tell you when we’re not the right answer
If the work would be better served by a niche specialist (high-volume mobile device forensics with Cellebrite, traditional e-discovery at major-litigation scale, or a different geographic footprint), we’ll tell you on the first call. The catchall above is the list of verticals where we know we add value. The honest no is faster and cheaper than the wrong yes.
Local presence, statewide reach
Headquartered in Raleigh, with onsite reach across the Triangle, Triad, Charlotte metro, Wilmington, and the rest of North Carolina. Remote-first when it’s the right tool, in-person when it’s required. The accent on the phone is local; so is the accountability.
Want the deliverable view instead?
This page covers the “who we serve” angle. If you’d rather see the bill-of-materials view (what stack we ship per niche, what audit evidence comes out the other side, what the reference architectures look like), the sister page covers the same verticals from the build perspective.
View the industry-tuned solution stacks ›FAQ for the “do you serve us?” question
I really don’t see my industry above. Should I still call?
Do you work outside North Carolina?
What size company is the right fit?
What’s the difference between this page and the main “Industries” menu?
What if my situation is half-vertical and half-something-else?
Do you have references in my industry?
How fast do you respond on a first inquiry?
Don’t see your industry? Call anyway.
Twenty-four years of Triangle, Triad, Charlotte, and Wilmington work means we’ve almost certainly served someone close enough to skip the learning curve. The first conversation is free and the honest answer (yes, no, or referral) takes about fifteen minutes.
(919) 348-4912 Schedule a free 15-minute fit call Petronella Technology Group · 5540 Centerview Dr., Suite 200, Raleigh, NC 27606