Trusted by more than 100 organizations
Every engagement below was delivered end to end by the people who now lead Clayton Cybernetics' engineering.
46 engagements, end to end
Showing all 46 engagements
One company in fourteen countries, with separate networks by region and business unit and zero downtime
Every region and business unit on its own network, with blast radius limited to one segment, VLANs that move between datacenters while the…
Read the case
The technology behind a coworking pioneer's first five New York buildings
More than 10,000 members across five buildings, and the experience our team then used to create two of Brazil's leading coworking centers.
Read the case
A 150 TB Microsoft SQL Server database, live in two data centers on a petabyte of storage
A database of more than 150 TB running live in two places at once, with tested backups on three retention tiers and no single point of…
Read the case
Ten years running the U.S. offices of one of South Korea's largest companies
A decade of continuous operation for both offices, with security findings escalated to headquarters ahead of problems.
Read the case
A law firm replaced its legal software with its own and stopped paying licence fees per user
About $100 per employee per month in licence fees eliminated, roughly $5,000 a month for 50 people, with software that fits each department…
Read the case
A nationwide dental group on its own open-source platform, with drivers we wrote for its imaging hardware
Imaging devices that work with current systems, a practice platform built around the group's own workflows, and an open-source foundation it owns.
Read the case
A major financial institution moved off Windows to Omarchy and open-source office tools
Operating-system and office-suite licence fees eliminated, with no loss in productivity.
Read the case
A weaving factory got its own software and live data from every machine
Millions of dollars saved in software and production costs within a single year, and custom software the company owns outright.
Read the case
A 100,000‑mailbox, three-region Exchange platform with automatic database failover
Carrier-grade email for 500+ domains with no single point of failure.
Read the case
From 10 to 500+ employees, fully managed for twelve years
Twelve years of fully managed growth, from the first office to a three-building operation.
Read the case
Two floors, 100+ people, every system in one hand
One accountable team for every physical and digital system on both floors.
Read the case
Five years of bi-coastal IT, through to acquisition
Served continuously for more than five years, until the agency was acquired by a larger firm.
Read the case
One team for three countries
Everything from workstations to the phone system, and from backups to the help desk, managed by one team.
Read the case
A hospital network that keeps clinical systems, medical devices and guests apart, and logs everything
Medical devices contained in their own segments, a network that identifies what is plugged in before it grants access, and one searchable…
Read the case
A 100G colocation built for microseconds: PTP time, kernel-bypass and no surprises
A repeatable, measured path in which the median time from wire to application is in the low microseconds, clocks agree to well within a…
Read the case
Anycast DNS and edge for a SaaS company, absorbing attacks close to where they start
DNS answered from the nearest point of presence worldwide, and a 240 Gb/s volumetric attack in testing was absorbed with no customer-visible change.
Read the case
300 stores on one secure fabric: WireGuard SD-WAN with PCI segmentation
Store connectivity that survives the loss of a circuit without anyone noticing, a payment environment small enough to scope and assess…
Read the case
An ERP and a warehouse that talk to each other: robots, sensors and software on one platform
Stock levels updated in seconds instead of hours, manual re-keying largely eliminated, and a platform where adding a robot or sensor is…
Read the case
Zero-trust access and BEC-proof email for a Los Angeles real-estate group
Spoofing of the group’s domain blocked at the mail gateway, staff access that depends on who and what is asking rather than where they sit…
Read the caseA cross-border payments platform on Kubernetes, with card data sealed by hardware security modules
A card-data environment reduced to one cluster and one tokenization service, keys that cannot be exported from the HSMs, and evidence that…
Read the caseA campus where 10,000 devices join Wi-Fi 6E securely, and visiting scholars sign in with their home credentials
A campus network where the sign-in method follows the device rather than a shared password, visitors from other universities connect with…
Read the case
A broadcaster's studios on an IP network: uncompressed video over 100G, locked to a single clock
A facility in which a new studio is a set of leaf switches and fiber rather than a room of coax, a failure on either fabric is invisible to…
Read the case
Fourteen ships, one network: LEO and GEO satellite at sea, 5G in port, and a card-data segment that stays clean
Every ship holds a session through a loss of any one link, port calls offload the bulk of non-urgent traffic, card data sits in a small…
Read the case
A law firm that can be back in under two hours: immutable backups and a tested failover to a second region
In the last full drill the firm ran from the second region in 1 hour 40 minutes, with 11 minutes of data lost, both inside target.
Read the caseThirty schools, one managed network: CIPA-filtered, segmented and readable by a three-person IT team
The district can show a reviewer how filtering, monitoring and segmentation work, every school runs on the same templates, a compromised…
Read the caseImages that follow the radiologist: DICOM over encrypted links between fourteen imaging centers
Typical CT studies open in seconds rather than minutes, images are encrypted on every link, old modalities are contained rather than…
Read the caseOne guest network, one payment network: shrinking PCI scope across 38 hotels
The card-data environment shrank from 38 whole property networks to one payment VLAN per hotel, so the annual assessment covers far less…
Read the case
Zones, conduits and a one-way wire: separating a utility's control network from the corporate network
There is now no network path from the corporate network into the control zone, and the only path out is one that physically cannot carry traffic back.
Read the case
Surviving the holiday peak: two CDNs, an origin shield, a WAF and bot management
At peak, about 95 percent of requests are answered at the edge and the origin sees a small fraction of the load.
Read the case
Robots that stop dropping off the network: private 5G on CBRS spectrum for a Tier-1 auto plant
Robots roam between radio cells without dropping their session, so robot connectivity stoppages fell from about 41 a week on Wi-Fi to about…
Read the case
A frontier-class language model in the bank's own rack: AI for 100 staff without a prompt leaving the building
Staff use a local model as their only AI assistant.
Read the case
Out of the hurricane zone: a 1,000‑person Miami distributor moves from two server rooms to Google Cloud
A storm no longer takes the business down, only the people in the building.
Read the case
Seeing inside the black box: ALM, deposit and CECL models brought in-house at a mid-size US bank
The committee package is ready 6 business days after quarter-end instead of 19, scenarios grew from 9 to more than 40 a quarter, ad-hoc…
Read the case
From empty repository to mainnet in ten days: a market-data platform and post-quantum wallets for a new blockchain
The reference screen was live and correct from the first block of the new features, with every block and every pending transaction…
Read the case
Two colocation sites from empty cages: 40 racks, GPU, storage and compute, built, burned in and handed over
Both sites were accepted against a written checklist, production workloads moved over in waves with a rollback ready for each, and the…
Read the case
A regional ISP's edge refresh: dual 100G uplinks, BNG, carrier-grade NAT and sub-second failover
The edge carried the peak with room to spare, a transit or router failure caused a brief reroute that most subscribers did not notice, the…
Read the case
A managed SOC and EDR rollout for a 1,200‑endpoint insurer: from alert noise to a clock it can meet
Analysts saw a manageable list instead of a flood, endpoint coverage reached all managed machines, exploited vulnerabilities closed in days…
Read the caseA county government's segmented network and passkeys: from flat to default-deny in two budget cycles
A compromised workstation in one department could no longer reach another, phishing could no longer harvest a usable credential, the…
Read the casePrivate 5G on CBRS for a port terminal: remote cranes, yard tractors and scanners on one radio network
The yard had continuous coverage across stacks and berths, handhelds and tractors stayed connected as they moved, and the operator owned a…
Read the case
An Agent Security Review before a wealth manager rolls out Copilot Studio agents
In this illustrative engagement the firm launched with 11 of the 14 planned agents, held three back until their fixes were retested, and…
Read the case
A Texas title company stops a deepfake wire-change request with callback and second-approver controls
In the firm's own past result, a request that came with a convincing video call and a lookalike sender domain was held at the callback…
Read the case
An AI evidence pack for a healthcare group's insurer renewal and a hospital customer's vendor questionnaire
The group sent the same pack to its broker, its counsel and the hospital, and answered both requests from documents in days rather than by…
Read the case
Email a regulated firm can prove: delivered into an Amazon S3 bucket that cannot be deleted or overwritten, with AWS KMS protecting each message's fingerprint
The firm can answer "what did you send or receive, and can you prove it?" from a record that could not be deleted or overwritten during the…
Read the caseAn accounting firm's Active Directory, rebuilt and re-tiered after ransomware reached the domain admins
Mail, files and line-of-business systems returned in priority order, each verified before rejoining the network.
Read the caseA manufacturer's on-premises Exchange restored after a failed cumulative update, then made redundant
Mail was back within the first two days and no mailbox data was lost.
Read the caseA multi-clinic group moves its practice-management SQL Server to Always On with point-in-time restore
A failed replica is now a routine alert rather than an outage, and a restore to a chosen minute has been performed and timed.
Read the caseThis page describes what our team has built and run, in the order a prospective client usually asks: what, for whom and how big. Every case is an engagement delivered end to end by members of the team that now forms Clayton Cybernetics.
We do not name clients. Industry and scale tell you whether the work resembles yours, and we are glad to discuss details on a call under appropriate confidentiality.
Read the cases by resemblance. Coworking and the conglomerate show how we design and run networks and offices at scale. The email provider and the education leader show resilient platforms and fast-growing organizations. The law firm and the weaving factory show what happens when a company stops renting software and owns its own.
Cases marked as illustrative describe the kind of engagement our team designs and operates, for a client type rather than a named company. They show how we combine switching, routing, security and datacenter design for global, regulated and high-performance environments.
Included in every managed deployment
- Mobile device management (MDM) and BYOD policy
- Backups, tested by restoring them
- Firewalls and network segmentation
- Managed switches and PoE
- Enterprise Wi-Fi access points
- Redundant internet circuits
- Information security program
- Defensive penetration testing
Platforms we design, deploy and run
We know virtually every hardware manufacturer. These are the platforms our team works with most. See every technology, by practice
Networking
- HPE
- Netgear
- TP-Link Omada
- Point-to-point radio
- Fiber
- 5G networks
- PoE
- Structured cabling & cable management
- VLANs, routing & wireless design
Routing & BGP
- RPKI route-origin validation (ROV)
- RTR (RPKI-to-Router)
- BFD
- BGP communities & large communities
- IXP route servers
- OSPF & IS-IS
- Prefix filtering & route policy
- Multi-homed BGP edges
DDoS & flood protection
- XDP & eBPF packet filtering
- BGP FlowSpec
- Remotely triggered blackhole (RTBH)
- uRPF source filtering
- Anycast scrubbing diversion
- GRE tunnel return paths
- sFlow / NetFlow / IPFIX detection
- Rate limiting & SYN protection
Datacenter fabric & optics
- Spine-leaf design
- VXLAN-EVPN
- MLAG
- SFP+ / SFP28
- QSFP28 / QSFP-DD
- DAC & AOC cabling
- Coherent DWDM data center interconnect
- Cumulus Linux & SONiC
- Fabric automation & validation
- Transceiver coding and compatibility
SD-WAN & SASE
- Application-aware routing
- Zero-touch branch provisioning
- Cloud on-ramps
- Secure web gateway
- Zero-trust network access
- CASB
- Underlay monitoring
- 5G and broadband failover
Firewalls & network security
- Network segmentation
- IDS/IPS (Suricata, Snort)
- Web application firewalls
Endpoint, SIEM & security operations
- Graylog
- Metasploit Framework
- Burp Suite
- Nmap
- Wireshark
- OWASP ZAP
- Kali Linux
- Penetration testing (offensive & defensive)
- Incident response & forensics
Identity & access
- SAML
- OpenID Connect (OIDC)
- OAuth 2.0
- LDAP
- RADIUS
- Single sign-on
- Custom two-factor authentication
- Auth0
- Google Cloud Identity
- FreeIPA
- Passkeys (WebAuthn)
- Every identity system: directories, SSO, MFA and privileged access
Email & collaboration
- Microsoft Exchange (4.0 to Subscription Edition)
- Dovecot
- SPF · DKIM · DMARC
- Microsoft Teams
- Custom email routing
VPN & mesh networking
- Cloudflare Tunnel
- IPsec / IKEv2
- Site-to-site VPN
- Zero-trust network access
- WireGuard site-to-site mesh
- Route-based IPsec with BGP over tunnels
- NAT traversal & overlay networks
Cloud
- Terraform
- Cloud migration & landing zones
- Cloud cost control
US cloud providers
- Multi-cloud account structure and guardrails
- Provider selection by workload, data location and recovery needs
- Regional US capacity planning
- Exit plans that avoid single-provider lock-in
Cloud storage, immutability & backup
- Retention modes and legal holds
- Logically air-gapped and isolated backup vaults
- Restore testing and clean-room recovery
- Encryption keys held apart from the data
Cloud security & audit services
- Log retention and export
- Alert routing and ownership
- Least-privilege access reviews
Cloud networking & DNS
- Redundant circuits in two locations
- BGP routing to cloud on-ramps
- Failover tests
- Google Cloud DNS
Cloud containers, email & AI
- Amazon Bedrock AgentCore
- Bedrock Guardrails
- Foundry Agent Service
Key management & secrets
- Hardware security modules (HSM)
- Google Cloud External Key Manager (Cloud EKM)
- Cloudflare Secrets Store
- SOPS
- age
- Key rotation & escrow design
Storage, servers & virtualization
- HPE ProLiant
- HPE MSA
- Dell PowerEdge
- Dell EMC
- iSCSI
- Virtualization
- VMware vSphere
- APC Smart-UPS
- RAID & capacity planning
Data
- MariaDB
- SQLite
- SQL databases
- NoSQL databases
- restic
- Backups & disaster recovery
- Data migration & ETL
- Immutable backups and Object Lock
- 3-2-1-1-0 backup rule
- Clean-room restore
AI & machine learning
- Local GPU servers: NVIDIA GPUs & CUDA
- Open-weight & abliterated models (private research)
- LLM training & fine-tuning from scratch
- PyTorch
- vLLM
- llama.cpp
- Ollama
- Retrieval-augmented generation (RAG)
- AI agents & tool use
- Model Context Protocol (MCP)
Blockchain & Web3
- Solidity
- Ethereum Virtual Machine (EVM)
- Rust & Solana
- Smart-contract auditing
- Hardhat & Foundry
- Wallets
- x402 agentic payments
- Node operation
- Cardano
Browser extensions & automation
- Chrome extensions
- Manifest V3
- Web scraping & data entry automation
Voice & unified communications
- SIP trunking
- IVR & voice applications
- Fax over IP
Devices & endpoint management
- Windows
- Linux
- Windows Autopilot
- Mobile device management (MDM)
- BYOD
Physical security
- Access control
- Video management systems (VMS)
- IP cameras
- Alarm systems
- Avigilon
- Door controllers & readers
Drones & robotics
- Robot Operating System (ROS)
- PX4 & ArduPilot
- Drone data processing
Industrial IoT & embedded
- ESP32
- Industrial sensors: temperature
- Industrial sensors: humidity
- Industrial sensors: vibration
- MQTT
- Node-RED
- PLC integration
- Industrial enclosures
- Custom electronics
- Real-time machine monitoring
Healthcare IT & compliance
- HIPAA Security Rule
- HL7
- FHIR
- EHR integration
- GDPR
- CCPA
- LGPD
- Risk analysis & audit logging
ERP & business systems
- Data migration
- System integration
Open source & custom integrations
- Open-source technologies
- Custom integrations & APIs
- Node.js
- Python
- Rust
- Virtually every hardware manufacturer
Network automation & observability
- NETCONF & YANG
- gNMI streaming telemetry
- sFlow
- IPFIX
- GitOps for network configuration
- Config backup & drift detection
- Source-of-truth inventory (IPAM/DCIM)
- Pre-change validation
- Alerting & dashboards
Internet exchange & carrier connectivity
- Internet exchange points (IXPs)
- BGP route servers
- Transit and peering strategy
- Cross-connects
- Wavelengths & dark fiber
- Cloud on-ramps
- Remote peering
- Routing security (RPKI, IRR filtering)
Out-of-band management & network labs
- Console servers
- LTE/cellular out-of-band access
- Zero-touch provisioning (ZTP)
- Secure ZTP (RFC 8572)
- Virtual network labs
- Pre-change validation
- Serial console and break-glass access
- Lab-to-production configuration pipelines
Timing & precision time (NTP, PTP)
- NTP servers and pools (RFC 5905)
- Network Time Security (RFC 8915)
- PTP IEEE 1588-2019
- ITU-T G.8275.1 telecom profile
- SMPTE ST 2059-2 broadcast profile
- GNSS-disciplined grandmaster clocks
- Boundary and transparent clocks
- Hardware timestamping on Linux
- Holdover oscillators
- Offset and path-delay monitoring
DNS & DNSSEC
- Authoritative DNS
- Recursive resolvers
- DNSSEC signing and key rollover
- DNS over HTTPS (DoH)
- DNS over TLS (DoT)
- Anycast DNS
- Split-horizon (internal and external) zones
- Traffic steering and health checks
- Response rate limiting
- DNS monitoring and logging
Wireless: Wi-Fi 6E/7 & private 5G
- Wi-Fi 6E (IEEE 802.11ax)
- Wi-Fi 7 (IEEE 802.11be)
- 6 GHz and AFC planning
- WPA3 and 802.1X
- 802.11r/k/v roaming
- Site surveys and RF planning
- CBRS private LTE (FCC Part 96)
- Private 5G standalone cores
- Neutral-host indoor cellular
- Wireless controllers and cloud management
- Open-source 5G cores and RAN for labs
- Priority Access and General Authorized Access planning
- AFC registration for standard-power 6 GHz
Structured cabling & fiber
- ANSI/TIA-568 horizontal and backbone cabling
- Category 6A copper
- OM3 / OM4 / OM5 multimode fiber
- OS2 single-mode fiber
- MPO/MTP trunks and polarity
- Fiber splicing and termination
- OTDR and insertion-loss testing
- Copper certification
- PoE (IEEE 802.3bt) power budgets
- Labeling, pathways and documentation
- ANSI/TIA-606 labeling and administration
- Patch panel and patching standards
PKI, certificates & ACME
- Offline root and online issuing CAs
- Certificate templates and auto-enrollment
- ACME clients and servers (RFC 8555)
- cert-manager on Kubernetes
- SCEP and network device enrollment
- OCSP and CRL design
- HSMs and PKCS #11
- TPM key attestation
- Short-lived certificates and mTLS
- CA/Browser Forum lifetime schedule
- Certificate inventory and expiry monitoring
Load balancers & application delivery
- Layer 4 and Layer 7 load balancing
- Active and passive health checks
- TLS termination, offload and re-encryption
- Session persistence
- Global server load balancing (GSLB)
- Blue-green and canary routing
- Connection draining
- WAF and rate limiting at the edge
- Service mesh sidecars and ingress
- High availability pairs and VRRP
Data center power, cooling & DCIM
- Double-conversion, line-interactive and standby UPS
- Rack PDUs and metered outlets
- A and B power feeds
- Automatic transfer switches
- Generators and fuel planning
- Lithium-ion UPS batteries
- Hot and cold aisle containment
- Precision and in-row cooling
- Environmental sensors and leak detection
- Power and capacity monitoring
- DCIM software (EcoStruxure IT)
- Micro and edge data centers
- kW per rack budgeting
- ASHRAE TC 9.9 thermal guidelines
Log pipelines, SIEM & data retention
- Syslog (RFC 5424)
- OpenTelemetry Collector
- Log parsing and normalization
- Kafka buffering and fan-out
- Hot, warm, cold and frozen tiers
- Searchable snapshots on object storage
- SIEM detection rules and hunting
- Retention and legal hold policy
- Pipeline health and dropped-event alerts
Post-quantum cryptography
- ML-KEM (FIPS 203)
- ML-DSA (FIPS 204)
- SLH-DSA (FIPS 205)
- Hybrid X25519MLKEM768 for TLS 1.3
- Cryptographic inventory
- Algorithm agility
- Post-quantum certificates
- liboqs prototypes
- Harvest-now, decrypt-later risk assessment
- Post-quantum signing for wallets
GPU servers & LLM inference serving
- NVIDIA HGX B200, H200 and H100 servers
- Tensor and pipeline parallelism
- FP8 and INT4 quantization
- Continuous batching and prefix caching
- OpenAI-compatible inference APIs
- Mixture-of-experts models
- Model evaluation harnesses
- GPU monitoring and capacity planning
- Air-gapped model delivery
Quantitative finance & risk engines
- Yield-curve construction
- Interest-rate risk (EVE and NII)
- Deposit and prepayment modeling
- CECL and expected-loss analytics
- XVA and exposure simulation
- Python and Jupyter workflows
- Public data pipelines
- Model documentation and validation support
- Backtesting and reconciliation
Rust, WebAssembly & Cloudflare edge
- Rust services and command-line tools
- Rust compiled to WebAssembly
- workers-rs and wasm-bindgen
- Cloudflare KV, R2, D1 and Durable Objects
- Cloudflare WAF managed rules
- Rate limiting
- Edge caching and routing
- Browser-side Wasm modules
Google Cloud & Workspace services
- Cloud Storage with retention locks
- Landing zones and VPC design
- Cloud Interconnect
- Chrome Enterprise
- Cost controls and committed use
- Datastream
Document OCR, local search & offline chat
- Mailroom scanning and searchable PDFs
- Local full-text and vector search
- Retrieval over private documents
- Local summarization and deadline extraction
- Self-hosted chat and file sharing
- Air-gapped operation
- Local mail and calendars
- UPS power for the continuity kit
- Offline legal and reference libraries
- Continuity drills
Server hardware & datacenter builds
- HPE ProLiant
- DDR5 RDIMM population
- NVMe U.2, U.3 and E3.S
- EDSFF E1.S
- BMC and IPMI
- Firmware baselines
- OCP-style hardware
Datacenter operations & colocation
- Colocation selection and moves
- Cross-connects and meet-me rooms
- Remote hands and smart hands
- MOPs and change windows
- Asset tracking
- A/B power feed cabling
- Decommissioning and data sanitization
Kubernetes & service mesh
- Helm and Kustomize
- Gateway API
- Hubble observability
- Progressive delivery with Flagger
OT & ICS security
- Purdue-style segmentation
- Passive OT network monitoring
- Secure remote access for vendors
- OT asset inventory
- OT incident response planning
AI agent security
- Prompt injection testing
- Agent identity and least-privilege scopes
- MCP server review and sandboxing
- Token audience validation
- Agent audit trails
- Agent registry and lifecycle
- Tool-misuse and excessive-agency testing
- Agent skill scanning
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership. Clients are described by industry only, to protect their confidentiality.
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageHow much experience does your team have?
The team that leads Clayton Cybernetics has delivered infrastructure for over 100 organizations, from small startups to a large global conglomerate. The cases on this page describe typical engagements.
Can I contact your previous clients?
We never name clients without written permission. We can discuss relevant experience in a call and arrange references where permission exists.
Were these projects delivered by Clayton Cybernetics?
They were delivered by the people who now lead our engineering, before the company was formed. Clayton Cybernetics brings that team together under one roof. We describe the work in general terms and never name a client.
What is included in every managed deployment?
MDM and BYOD policy, tested backups, firewalls and segmentation, managed switches, enterprise Wi-Fi, redundant circuits, a security program and defensive penetration testing. The scope is sized to each client. These are the baseline pieces our team puts in every deployment.
Do you have experience at large scale?
Yes. Our team designed and operates an email platform with more than 100,000 mailboxes.
Do you have experience with small companies?
Yes. We have supported teams as small as ten people through growth to hundreds.
What systems have you built for multi-tenant buildings?
Isolated networks, Wi-Fi, access control, cameras and phone systems for coworking buildings. Each member company is separated from the others, and the building team can manage it centrally. Our team built this for a New York coworking pioneer's first five buildings and for coworking centers in Brazil.
Do you run BGP for your clients?
Yes. Our team designs and operates BGP (RFC 4271) edges, including peering with carriers, route filtering and prefix limits, RPKI origin validation (RFC 6811) and failover testing. Software routers such as BIRD 2 are one of the tools we use, alongside commercial routers.