Client names and identifying details are withheld. Most of the environments we work in are covered by confidentiality terms, and several are regulated — so what follows is the shape of the work rather than a logo wall. If you want references, ask on a call and we will arrange introductions where clients have agreed to it.
The security team's position going in was that no vendor gets an inbound rule. That constraint shaped the whole deployment: collectors dial out over a tunnel they establish themselves, and the perimeter policy was never touched. What the team got back was per-flow visibility their existing tooling had not been surfacing — and an audit answer that did not require a firewall exception to explain.
Sites had been added one at a time over years, each with its own addressing decisions and its own idea of how routing should work. Before anything could move to cloud, someone had to reconcile all of it. We mapped what was actually running, resolved the overlaps, and rebuilt route distribution so the migration had a stable base to sit on instead of a set of assumptions nobody had tested.
In broadcast, the failure mode is public. The work was multi-homed circuits with genuinely independent paths, multicast that behaves under load, and — the part that matters most — testing the whole thing at show-level traffic before the show, not during it.
We will walk through the relevant engagement in detail on a call, including the parts that did not go to plan. That tends to be more useful than a testimonial anyway.
Book a discovery call