A network designed to contain,
not just connect.
We design, deploy, and operate your perimeter, segmentation, remote access, and WAN as one policy-driven system, hardened to vendor and CIS baselines, backed up nightly, changed only under control, and watched by the same SOC that answers when something moves where it shouldn't.
Flat networks turn incidents into outages
A workstation infection should be a bad afternoon for one person. On a flat network with a permissive firewall and a shared VPN it becomes an all-hands weekend: the attacker reaches file servers, backups, and the hypervisor from the same subnet, and the firewall only ever logged "internal to internal: allow".
Our network practice treats containment as the design goal. Every segment has a reason to talk to another or it cannot; every user and device proves who it is before it reaches an application; every site has a second path to the internet; and every change is reviewed, backed up, and reversible.
The reference architecture
We build from the same layered model at every site and scale it to size: a 12-person clinic and a 400-seat distributor get the same controls on different hardware.
Edge
- Application-aware policy rather than port-based rules; intrusion prevention with signatures updated daily; SSL/TLS inspection where legally and operationally appropriate; DNS filtering, web filtering, and geo-blocking.
- High-availability pairs or SD-WAN failover for anything business-critical; dual ISP, LTE/5G, or Starlink as the secondary path.
- Hardened management: admin access only from a management VLAN or ZTNA, MFA on every administrator, trusted-host restrictions, no management interfaces on the WAN.
Segmentation
- VLAN and VRF segmentation by function and trust level: users, servers, management, IoT/OT, guest, payment, backup.
- East-west policy enforced at the firewall, not only at the edge: servers accept only the ports their applications need, from the segments that need them.
- Micro-segmentation for high-value systems (hypervisors, backup repositories, domain controllers), reachable from jump hosts only.
- Payment and regulated-data zones designed to narrow PCI DSS and privacy scope.
Identity-aware access
- Per-application access based on identity (Entra ID / SSO), device posture (managed, patched, EDR running), and location, no broad network tunnel.
- Where VPN remains, it is MFA-enforced, split-tunnel decisions are deliberate, and sessions are logged to the SOC.
- 802.1X / RADIUS on wired and wireless so an unknown device lands in a quarantine VLAN automatically.
Wireless
- WPA3-Enterprise with certificate or identity authentication for corporate devices; isolated guest and IoT SSIDs with client isolation and rate limits.
- RF design and validation (predictive survey, post-deployment heat map) for density and roaming, not just coverage.
- Rogue-AP detection and wireless IPS alerts routed to the SOC.
SD-WAN & performance
- Multiple WAN links (fibre, cable, LTE/5G, Starlink) with health checks and per-application steering: voice and SaaS on the best path, backups on the cheapest.
- Encrypted site-to-site overlays with automatic failover; hub-and-spoke or full mesh by need.
- QoS for voice and video; bandwidth and latency baselines so degradation is caught before users call.
Observe & operate
- Syslog, NetFlow/sFlow, and SNMP from firewalls, switches, and access points into our monitoring and SOC pipeline; synthetic reachability checks from outside your network.
- Automated nightly configuration backups with versioning and diff. Every change is ticketed, peer-reviewed, scheduled in a window, and has a tested rollback.
- Firmware lifecycle: current-minus-one policy, vendor PSIRT advisories triaged within one business day, an emergency path for actively exploited vulnerabilities.
What we deliver
From a single-site refresh to a multi-site SD-WAN migration, the engineering is the same. Only the scale changes.
Firewall design & management
Rule-base design from a documented policy matrix, object naming standards, logging on every rule, quarterly clean-up of unused and shadowed rules, and change control with rollback.
Secure SD-WAN
Multi-WAN architecture with application-aware steering, encrypted overlays between sites, and central policy, including Starlink as a resilient secondary or primary path for remote and rural sites.
Segmentation & micro-segmentation
Zone design, VLAN/VRF implementation, east-west firewalling, and jump-host patterns for crown-jewel systems, with the documentation auditors ask for.
Zero-trust network access
Per-application access tied to identity and device posture, replacing broad VPN tunnels; phased migration so remote workers never lose access.
Enterprise wireless
Design, survey, deployment, and management of WPA3-Enterprise wireless with 802.1X, guest isolation, and IoT segregation.
Switching & network access control
Managed switching with 802.1X / MAC authentication, storm control, DHCP snooping, and port security so a rogue device is quarantined, not connected.
Network monitoring & NOC
24/7 availability and performance monitoring, outage detection from outside your network, capacity trending, and ISP escalation handled by us.
Firmware & vulnerability lifecycle
PSIRT advisory triage, staged firmware rollouts, and emergency patching for exploited edge vulnerabilities, the category behind many of the breaches on our incident tracker.
Structured cabling & site build-outs
Rack, cabling, and infrastructure for new offices and expansions, delivered with labelling and as-built documentation.
How a network engagement runs
No cutover happens without a design you have signed, a window you have approved, and a rollback we have tested.
- Current-state capture: topology, configs, traffic flows, dependencies
- Risk findings: flat segments, exposed management, end-of-life gear
- Target architecture, IP plan, policy matrix, bill of materials
- Staging and configuration to the hardening baseline
- Pilot site or pilot segment with real users
- Monitoring and backups wired in before cutover
- Change ticket with step-by-step plan and rollback
- Engineers on site or on a bridge for the window
- Post-change verification against a test plan
- 24/7 monitoring, patching, backups, change control
- Quarterly rule review and capacity report
- Annual architecture review against new threats
Platforms we design and operate
Certified on the platforms your business already depends on; opinionated about how they should be configured.
Operating standards
What "managed" means in practice. Contractual figures are set in your service agreement.
| Area | Standard | Evidence you receive |
|---|---|---|
| Availability | 99.99% uptime target for HA / dual-WAN designs; external reachability checked every minute | Monthly availability report per site |
| Change control | Every change ticketed, peer-reviewed, scheduled, with a tested rollback | Change record and post-change verification |
| Configuration backups | Nightly, versioned, stored off-device; restore tested quarterly | Backup status in the monthly report |
| Firmware | Current-minus-one; PSIRT advisories triaged within 1 business day; exploited vulnerabilities patched as emergency changes | Firmware inventory and advisory log |
| Rule-base hygiene | Quarterly review; unused, shadowed, and any-any rules removed or justified in writing | Quarterly rule review report |
| Security hand-off | Security events route to the SOC with network context attached | Covered under the MDR severity model |
Where you keep an existing vendor, the same standards are applied to that platform. We do not require a forklift to begin.
Where this lands in your compliance programme
Segmentation and configuration management are the controls that most often shrink audit scope.