01
Mapped what talks to what
Before touching anything, we documented every device on the shop floor and what it genuinely needed to communicate with. Most needed far less access than they had.
Back to case studies
Manufacturing
A manufacturer with production systems nobody could patch
Four CNC machines were controlled by PCs running an operating system that stopped receiving security updates years ago. The machine vendors wouldn't support anything newer. Replacing the machines wasn't happening any time soon, and everything sat on one flat network with the office.
- Organisation
- Precision engineering firm
- Size
- 90 staff, one site
- Location
- West Midlands
0 hrs
unplanned production downtime
4
legacy controllers isolated, none replaced
Passed
customer supply chain security audit
Where they started
- Unsupported controllers couldn't be patched without voiding vendor support.
- A single flat network meant an office infection could reach the shop floor.
- A major customer had started asking security questions as part of its supply chain audit.
- Any downtime on the line had a direct, measurable cost per hour.
What we did about it
02
Segmented rather than upgraded
Production systems moved onto their own isolated network segment, with tightly controlled routes for the handful of legitimate flows. The controllers stayed exactly as the vendor supports them.
03
Planned the cutover around production
The change ran across a planned shutdown weekend, with a documented rollback at each step and an engineer on site for the Monday restart.
04
Wrote the audit evidence as we went
Network diagrams, change records and the risk rationale for the legacy systems were produced during the work, not scrambled together afterwards.
Where they are now
- An office ransomware event can no longer reach production systems directly.
- The firm keeps its machine vendor support intact, because nothing on the controllers changed.
- Security questionnaires now take hours to complete rather than weeks, because the evidence exists.
"Everyone else told us to replace the machines. This was the first conversation that started with what we could actually do this year."
The part that didn't go to plan
One legacy label printer turned out to need a route nobody had documented. It failed on the Monday morning and took two hours to trace. Our discovery should have caught it.
Recognise any of this?
Tell us what's getting in the way and we'll talk through what's realistic - no pressure, no jargon.