Work

Field Notes.

Engagements written up the way engineers write them: the situation, the constraint, what we built, the numbers — and what we'd do differently. That last section is where the honesty lives.

⚠ Sample studies shown below — representative of our engagement format. Replace with client-approved field notes before launch.

Manufacturing

14 servers → 1 landing zone

A manufacturing firm exits its server room

AzureTerraformZero TrustAzure Backup & Site Recovery sample

Situation

A mid-market manufacturer was running ERP, file services, and plant reporting on aging hardware in an on-site server room — with backups that had never survived a real restore test.

Constraint

The plant runs two shifts. Total tolerated downtime for cutover: one weekend.

What we built

An Azure landing zone delivered as Terraform, workload-by-workload migration over six weeks, network re-architecture with zero-trust remote access for plant engineers, and a disaster recovery design that gets rehearsed, not just diagrammed.

The numbers

  • 34% lower monthly run cost vs. hardware refresh quote
  • Cutover completed in 31 hours of the 48-hour window
  • First successful full DR rehearsal in company history

What we'd do differently

We would involve the plant-floor team two weeks earlier. Their undocumented dependencies were the only surprises we met.

Have a similar problem? →

Healthcare

Zero data left the building

A healthcare group makes its records searchable — privately

On-prem GPUsOpen-weight LLMsRAGVector database sample

Situation

A multi-site healthcare group wanted clinicians to search decades of policies, protocols, and case documentation in natural language — but patient-adjacent data could not touch a public AI service.

Constraint

PHIPA compliance, on-premises data residency, and clinician-grade answer accuracy.

What we built

An on-prem GPU inference cluster running open-weight models, a retrieval-augmented generation pipeline over their document estate, role-scoped access mirroring clinical permissions, and an evaluation harness that measures answer accuracy before every model update.

The numbers

  • Answers in under 4 seconds against 200k+ documents
  • 0 bytes of clinical data transmitted to external services
  • 87% of pilot clinicians using it weekly by month two

What we'd do differently

We would budget more time for document cleanup. Retrieval quality is a data-hygiene problem before it is a model problem.

Have a similar problem? →

Professional Services

Contained in 11 minutes

A ransomware attempt becomes a non-event

MDREDRConditional AccessSOC sample

Situation

An employee at a professional services firm opened a credential-harvesting attachment. Within minutes, the attacker was attempting lateral movement toward the document management system.

Constraint

The firm’s entire value — client files and trust — was the target.

What we built

This client was already on our MDR service: identity-first detection flagged the anomalous session, automated response isolated the endpoint, and our SOC confirmed containment and traced the full path before the attacker reached a second machine.

The numbers

  • 11 minutes from first detection to confirmed containment
  • Business impact: one rebooted laptop
  • 0 files encrypted, 0 clients notified — because there was nothing to notify about

What we'd do differently

Nothing about the response — but the phishing simulation program we ran afterward cut click-through rates by two-thirds. It should have existed before the incident, not after.

Have a similar problem? →