Case studies

The operational record.

Anonymized engagements, with the before/after metrics each one moved. Each study documents the problem we walked into, the operational constraint that shaped the approach, and the outcomes. Client names withheld by request; we don't publish case studies our clients haven't reviewed.

  1. Executive transportation, Toronto · Website rebuild + managed hosting · Summer 2026 launch; September 2026 rebuild

    Executive transport: a hardened launch, then a tested Astro rebuild

    A Toronto executive-transportation company launched on our hardened edge in the summer of 2026 as nine hand-edited HTML pages, and its untested booking path broke silently for about three weeks. After the fix, the booking funnel got end-to-end tests. In September we rebuilt the site in Astro, deployed from CI, with staged releases and automatic rollback, and cut its JavaScript from 980 KiB to 216 KiB.

    • Front-end Nine hand-edited HTML pages, copied into place on each deploy → Astro build, deployed from CI
    • Booking funnel Untested; it broke silently for about three weeks → Tested end to end; a failing test blocks the deploy
    Read the engagement

  2. Major Ontario venue · Zero-trust network redesign · 12 weeks (8 design, 4 live)

    Major venue: a zero-trust redesign of a flat, always-on network

    A major Ontario venue ran public Wi-Fi, ticketing, operational systems, and back-office on a single flat network — every tier could reach every other. We redesigned it to a zero-trust, VLAN-per-tier architecture with identity-first, time-boxed access, so the systems the public can touch can never reach the systems that run the building.

    • Network segmentation Flat L2 across all tiers → VLAN per tier (corporate, broadcast, crew, public)
    • Operational-system exposure Reachable from public Wi-Fi → Isolated VRF, no public-tier reachability
    Read the engagement

  3. National registered charity · Posture audit + remediation · 6 weeks

    Registered charity, exposed surface to A+ headers in 6 weeks

    A donor-data-handling Canadian charity engaged us after a board-level concern about a competitor's recent breach. Six weeks later: A+ header posture, MFA across the entire staff, donor PII encrypted in transit and at rest, board-ready PIPEDA documentation in their hands.

    • Header posture F (no CSP, no HSTS) → A+ (strict CSP, HSTS preload)
    • MFA coverage across staff 18% → 100%
    Read the engagement
PRIVATE REFERENCES

Want a private reference?

Most of our clients are comfortable being a private reference but not a public case study. Talk to us for an introduction.

Talk to a senior engineer
START

Want one of these for your work?

Every engagement starts with a 30-minute posture call. Free, no commitment.

Talk to a senior engineer