Mid-size company

A 100‑person company replaced about $50,000 a year of closed-source software with open source, its own email servers and AI-agent operations

A 100‑person company paying about $500 per employee per year for closed-source software.

Reviewed by Christopher Clayton, CEO

Scale
100 employees, 103 desktops and laptops, 114 mailboxes, 38 daily-use applications, in-house applications and dedicated cloud
Engagement
12 weeks from inventory to the end of hypercare, then continuous AI-agent operations

The challenge

The company paid about $500 per employee per year for closed-source software, roughly $50,000 a year for 100 people, plus per-user fees for hosted email. The cost grew with every hire, and the company had little say over how the tools worked.

A 100‑person company was paying about $500 per employee per year for closed-source software, roughly $50,000 a year, and that figure rose with every person hired. It moved to nearly free software: the latest open-source operating systems, such as Omarchy, on its 103 desktops and laptops, an open-source office suite, and custom-built software for everything else it needed. The whole move took 12 weeks, from the first inventory to the end of hypercare.

A move like this starts with an inventory of what people actually use every day. This one found 112 subscriptions, tools and services, of which 38 were in daily use. Of those, 19 were replaced by open-source equivalents, 9 were rebuilt as custom software inside one in-house platform, 7 were retired because nobody needed them, and 3 specialist applications were kept in a compatibility layer until their replacements are ready. Each one was handled piece by piece so the team kept working.

People were trained before the switch and after it. Before, every employee had two 90‑minute sessions and a one-page cheat sheet. After, there was a second round, weekly office hours and a priority line. A pilot group of 12 people, from every department, used the new desktop for three weeks first, and what broke for them was fixed before anyone else moved. The rest followed in three waves of about 30 on Friday evenings, so each person came back on Monday to a machine that was already set up.

Email was part of it: the company's own dedicated email servers replaced Google Workspace and its per-user fees. About 3.1 TB of mail for 114 mailboxes was copied ahead of time, so the cutover weekend only had to move the last 40 minutes of new mail and the DNS records. Google Workspace stayed read-only for 30 days as a safety net, then was cancelled. Running your own mail properly means spam filtering, SPF, DKIM and DMARC authentication, and backups from the first day.

Everything now runs in-house on dedicated cloud infrastructure, delivering the same quality as before, for about $1,400 a month. The company owns the systems it depends on and is no longer tied to a vendor's pricing or roadmap; 23 paid subscriptions have been cancelled.

Operations are handled by AI agents. They update and fix applications and build new features or improve specific tasks as requests arrive from the team, fully automated. In the first three months the team made 47 requests: the agents shipped 39, 6 waited for a decision from a person, and 2 were declined. A human stays in the loop only when needed, for decisions and approvals. For the service behind this case, see Clayton Open Source.

What our team delivered

  • Weeks 1 to 2, inventory: found 112 subscriptions, tools and services, of which 38 were in daily use. Each one got an owner, a verdict (replace, rebuild, keep, retire) and a list of the file formats and integrations people rely on, so nothing they depend on was lost in the move
  • Weeks 3 to 4, build: set up the dedicated cloud environment, the company's own mail servers and the first in-house applications, and ran them in parallel with the old tools
  • Before the switch: every person had two 90-minute sessions on the new desktop and office suite, a one-page cheat sheet and a named person to ask
  • Weeks 5 to 7, pilot: 12 people from every department used Omarchy and the open-source office suite for real work, and a weekly list of what broke was fixed before anyone else moved
  • Weeks 8 to 10, cutover: the remaining desktops and laptops moved in three waves of about 30, each on a Friday evening with staff back at their desks on Monday, and the mail cutover took one weekend: about 3.1 TB of mail was copied ahead of time, the DNS records were lowered to a 5-minute TTL beforehand, and the final sync took 40 minutes. Google Workspace stayed read-only for 30 days as a safety net
  • Replaced Google Workspace with the company's own dedicated email servers, with spam filtering, SPF, DKIM and DMARC authentication, shared calendars and backups
  • Built custom software for the 9 needs no open-source product covered well, instead of renting another product, and kept 3 specialist applications running in a compatibility layer until their replacements were ready
  • Weeks 11 to 12, hypercare: a second round of training, weekly office hours and a priority line for questions, and 23 paid subscriptions cancelled as each replacement proved itself
  • Put AI agents in charge of operations: they update and fix applications and build new features as requests arrive from the team, with a human involved only for decisions and approvals

Result

Software cost that is nearly free instead of about $50,000 a year, at the same quality, with the company in control of its own systems and email. The dedicated cloud environment, mail servers and backups cost about $1,400 a month, about a third of the old licence spend alone, and that cost no longer grows with every hire. In the first two weeks after the last wave the help desk logged 143 tickets, about 1.4 per person and mostly shortcuts and file locations, and the number fell to 31 in the two weeks after that. Over the first six months the mail servers were available 99.98 percent of the time and the in-house platform 99.95 percent. Requests from the team now turn into fixes and features through AI agents, fully automated: in the first three months 47 requests came in, the agents shipped 39 of them, 6 waited for a decision from a person and 2 were declined, and the median request reached production in about a day and a half. People are involved only when a decision or approval is needed.

Get this for your company

Related services with fixed prices and a written scope.

AI agent bot, standard

One bot for a task that crosses two systems or handles varied documents, with exception handling and a review queue for your team.

About 3 to 4 weeks

$5,900 per bot

Details

Managed IT and security (MSP)

One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.

Onboarding starts within 10 business days

$100 per team member, per month

Details

Show 5 more

Managed security monitoring

Endpoint detection and response watched by our analysts, priced per device.

Agents deployed within 7 business days

$18 per endpoint, per month

Details

Scanning of software codebase

Static analysis and secret detection across one codebase, reviewed by an engineer so you get findings, not noise.

Report within 3 business days of read-only access

$500 per codebase

Details

Discovery and requirements workshop

Workshops with your team to map every system, process, user group and integration, and to agree what the new platform must do.

Written requirements and a system inventory in 2 to 3 weeks

$6,500 fixed fee

Details

Email security with AI detection and DLP

Inbound and outbound protection: phishing, malware and impersonation caught by AI detection, with data loss prevention for what leaves.

Live within 7 business days

$7 per mailbox, per month

Details

Compromised-mailbox monitoring and alerts

We watch each mailbox for signs of takeover, such as odd logins, forwarding rules and mass sending, and alert you fast.

Live within 5 business days

$4 per mailbox, per month

Details

After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.

No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).

Superintelligence data flow

Every request is classified by sensitivity, so confidential data stays on models inside your walls while routine work can use the best frontier AI.

Superintelligence data flowEmail, documents, phone calls, ERP and CRM records and sensor data enter a secure gateway that classifies each request by sensitivity. Sensitive requests are answered by local models inside the firewall, internal ones by a private cloud, and general ones by frontier models from leading US AI labs. Results flow back into ERP, CRM, dashboards and to people.SOURCESGATEWAYMODEL TIERSYOUR SYSTEMSEmailDocumentsPhone callsERP / CRMSensorsSecuregatewaysorts bysensitivityLocal modelsIn your firewallPrivate cloudYour own tenantFrontier modelsleading US AI labsERPCRMDashboardsPeopleSensitive: stays localInternal: private cloudGeneral: frontier model

Mail that keeps flowing

Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.

Mail that keeps flowingDiagram of enterprise email flow. Inbound mail from an internet sender reaches the MX edge server running Postfix, where SPF, DKIM and DMARC checks light up in sequence, then passes a spam and malware filter; a spam message is diverted to quarantine. Clean mail is delivered to a mailbox cluster, a database availability group with copies in three regions. On a loop the active server in region A fails and the copy in region B activates automatically, so the next message is still delivered. Outbound mail from the user's mailbox is DKIM-signed and sent over an encrypted TLS connection to the recipient. INBOUNDOUTBOUNDSenderInternetMX edgePostfixSPFDKIMDMARCThreat filterSpam · malwareQuarantineMAILBOX CLUSTER · DAGRegion ARegion BRegion CActiveCopyActiveCopyMailboxUser inboxDKIM signingTLS encryptedRecipientSPFDKIMDMARCSPFDKIMDMARCOffline

Three approval tiers for AI agents

Every action an agent can take falls into one of three tiers: it runs on its own, a named person approves it first, or a human always does it. The examples are illustrative; each firm draws its own lines during scoping.

Three approval tiers for AI agentsThree side-by-side cards. Runs on its own: reading, drafting, searching approved sources, writing its own log. Needs approval: external email, changing records, widening access, running scripts. Never automated: moving money, changing bank details, switching off logging, deleting backups, signing contracts.What an agent may do, by approval tierRuns on its ownLow impact, easy to undoRead and summarise filesDraft text for reviewSearch approved sourcesWrite its own activity logNeeds approvalA named person says yesSend email outside the firmChange a customer recordGrant or widen accessRun a script on a serverNever automatedA human does it, every timeMove moneyChange bank detailsSwitch off logging or alertsDelete backupsSign a contractImpact and difficulty of undoing rise from left to rightExample tiers only. The lines between them are set per firm, per workflow.

Frequently asked questions

Direct answers to the questions we hear most. Something else on your mind?

Send us a message
How much did the 100-person company save, and what replaced what?

The company paid about $500 per employee per year for closed-source software, roughly $50,000 a year for 100 people. Open-source desktops such as Omarchy, an open-source office suite, its own dedicated email servers and custom-built software replaced it. The dedicated cloud environment, mail servers and backups cost about $1,400 a month, about a third of the old licence spend alone, and that cost no longer grows with every hire. The details of this engagement are provisional.

What happens when the AI agents running operations are unsure or a request is risky?

People are involved only when a decision or approval is needed. In the first three months the team made 47 requests: the agents shipped 39, 6 waited for a decision from a person and 2 were declined. The median request reached production in about a day and a half.

How long did the move to open source take, and how was the risk kept low?

It took 12 weeks from inventory to the end of hypercare. A pilot group of 12 people used the new tools for real work first, the remaining machines moved in three waves of about 30 on Friday evenings, and the mail cutover took one weekend after about 3.1 TB of mail was copied ahead of time. The old email service stayed read-only for 30 days as a safety net. Over the first six months the mail servers were available 99.98 percent of the time.

Do you know if your company is safe?

Speak with a security engineer today. The first assessment call is free and confidential.

CallFree assessment