Security infrastructure built for your mission

"A professional services firm with roughly 600 users across three offices was routing all internet traffic back to headquarters. The result was high latency to Microsoft 365, no visibility into cloud application use, and contractors with the same flat network access as employees. We led a seven month migration to Cisco Secure Access with Meraki MX SD-WAN. Secure Access replaced the web filter for secure web gateway, CASB, DLP, and remote browser isolation, and its ZTNA module replaced the VPN with 25 internal applications published through policies tied to Entra ID groups and device posture. CASB discovery surfaced more than 200 cloud applications and drove controls on unsanctioned file sharing and AI tools. Rolled out office by office with pilot groups and a rollback path for each site, the project cut WAN circuit spend by 50 percent, reduced latency to Microsoft 365, retired the AnyConnect VPN, and delivered consistent policy for employees, contractors, and remote users in support of the firm's ISO 27001 certification"

"A regional card processing provider with roughly 1,200 employees, two data centers, and a DR site was running its production edge and internal segmentation on end of support Cisco ASA 5585-X clusters. Years of growth had left roughly 3,400 rules and 9,000 objects with little visibility into what was still in use, and the platform couldn't deliver the application-aware controls required for PCI-DSS 4.0. We led a nine-month migration to Palo Alto PA-5420 firewalls under Panorama, working with two additional engineers and 30+ application owners. Following discovery and dependency mapping across 40+ VLANs and seven security zones, the team used Expedition and a 90-day hit-count review to retire about 600 unused or overly permissive rules, converted the NAT rule base, standardized naming, and rebuilt policy around App-ID and User-ID.  Production traffic moved across fourteen change windows, each with a rollback plan, application-owner sign-off, and pre/post traffic comparison; the single rollback required was resolved in fifteen minutes. The migration cut the rule base by 44 percent with zero unplanned outages, aligned segmentation to PCI-DSS 4.0 Requirements 1.2 and 1.3, and the client passed its next PCI assessment with no firewall-related findings."

"A manufacturing company with about 800 employees, three production sites, and a hybrid Active Directory environment detected mass file encryption on two file servers early on a weekend morning. The engineer was engaged within hours to direct the response. Triage using firewall logs, NetFlow, and Zeek captures traced the intrusion to a compromised VPN account without MFA. Containment moved in stages after the VPN concentrator was taken offline. Roughly 40 endpoints and 6 servers were confirmed encrypted, and 14 additional hosts with attacker tooling were rebuilt. Recovery came from offline backups with a 26-hour outage on file services. Post-incident hardening included enforcing MFA on all remote access, deploying EDR to 1,100 endpoints and servers, disabling SMBv1, restricting RDP to a hardened jump host, and moving backups to an immutable target. We then conducted a security audit and a Tenable-based vulnerability assessment across about 2,300 assets, surfacing 140 critical and high findings, including unpatched internet-facing services and flat networking between OT and corporate systems."