Aventura, Florida · serving clients across the United States (305) 404-9404Toll-free (800) 767-8566Emergency? Get a call within 1 hour
Coworking & flexible workspace

The technology behind a coworking pioneer's first five New York buildings

A New York coworking pioneer that grew into the world's best-known flexible-workspace brand and a leader in its segment. Our team worked side by side with its founders from 2009.

Scale
5 buildings, 5–10 floors each, 10,000+ members
Engagement
From 2009: the founders' first venture through their first five buildings

The challenge

Shared workspace means hundreds of independent companies on one network, each expecting the privacy and reliability of its own office, while buildings opened faster than any traditional IT department could plan them.

The technology had to work like a utility. Members arrived expecting to plug in and work, so the network, Wi-Fi, access control, cameras and phones had to behave the same way on every floor of every building, while keeping each company isolated from its neighbors.

Because the design was repeatable, each new building opened on a proven blueprint rather than a new experiment. That experience is the basis for the two coworking centers our team later created in Brazil.

What our team delivered

  • Designed and developed the technology of the first five New York buildings, starting with the founders' first eco-friendly coworking venture in 2009
  • Multi-tenant networks that keep every member company isolated and secure on shared infrastructure
  • Wi-Fi, access control, cameras and phone systems across five to ten floors per building
  • A repeatable building blueprint so each new location opened on a proven design

Result

More than 10,000 members across five buildings, and the experience our team then used to create two of Brazil's leading coworking centers.

Roaming without dropping the call

Time from leaving one access point to the first data frame on the next, split by phase. A full WPA2/WPA3‑Enterprise re-authentication repeats the 802.1X exchange; 802.11r (Fast BSS Transition) reuses cached keys, 802.11k (neighbour reports) removes the blind scan, and 802.11v (BSS transition management) lets the network steer the client. Illustrative figures.

Roaming without dropping the callStacked horizontal bars of handoff time in milliseconds. Full re-authentication 580: scan 180, authentication and association 10, 802.1X 350, four-way handshake 40. PMK caching 230. 802.11r only 200. 802.11r with k and v 40, under the 50 millisecond voice target.Handoff time by roaming method (ms)Channel scanAuth + association802.1X / EAP4-way handshake0100200300400500600ms50 ms: a voice call does not noticeFull re-authenticationno roaming aids580 msPMK caching / OKCkeys reused, still scans230 ms802.11r onlyfast transition, still scans200 ms802.11r + k + vtargeted scan, fast transition40 msIllustrative: scan 20 to 250 ms depending on channel count; EAP depends on the RADIUS round trip.

Defense in depth, on a loop

Every device on your network sits behind a monitored firewall with two internet circuits, so attacks are stopped at the door and a provider outage does not stop the business.

Defense in depth, on a loopDiagram of a protected corporate network. The internet reaches an edge firewall over two redundant ISP circuits. Behind the firewall a core switch feeds PoE access switches serving Wi-Fi access points, workstations, IP phones and cameras with door access control, plus a server and iSCSI storage cluster and an encrypted VPN link to the cloud. Gold packets show legitimate traffic passing; red threat packets are stopped and dropped at the firewall. On a loop, ISP circuit A goes down and traffic fails over to ISP circuit B, then the circuit is restored. InternetISP AISP BFirewallCloudVPN tunnelCore switchServersiSCSI storagePoE switchPoE switchWi-FiWorkstationsIP phonesCCTV · doorsISP A downRerouted to BLegitimate trafficThreat, blockedPROTECTED NETWORK

Separate by region and by business unit

Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.

Separate by region and by business unitA grid with three regions, Americas, EMEA and APAC, and three business units, Finance, Retail and R&D. Each cell is a separate VRF with its own VLAN and VNI. Each business unit has one overlay running across its three regional cells, shown as a row. On the right a firewall zone enforces a zero-trust policy that denies by default. A red packet from Retail trying to reach Finance is blocked at the firewall. A teal packet from R&D to the shared DNS and identity services is allowed. AMERICASEMEAAPACFinanceVRF fin · VLAN 110VNI 10110VRF fin · VLAN 110VNI 10110VRF fin · VLAN 110VNI 10110RetailVRF retail · VLAN 120VNI 10120VRF retail · VLAN 120VNI 10120VRF retail · VLAN 120VNI 10120R&DVRF rnd · VLAN 130VNI 10130VRF rnd · VLAN 130VNI 10130VRF rnd · VLAN 130VNI 10130Firewallzoneszero trustdeny bydefaultSharedDNS · IdPdenyallowVRF · L3 isolationVLAN to VNI · L2Default-deny policyEVPN-VXLAN fabricWireGuard + IPsec WANLogs to one SIEM

Frequently asked questions

Direct answers to the questions we hear most. Something else on your mind?

Send us a message
How are member companies kept isolated on shared infrastructure?

The case describes multi-tenant networks that keep every member company isolated and secure on shared infrastructure. Hundreds of independent companies in a building each expect the privacy and reliability of their own office. The same networks also carried Wi-Fi, access control, cameras and phone systems across five to ten floors per building.

What made new buildings open faster?

A repeatable building blueprint. Each new location opened on a design already proven in the earlier buildings, instead of being planned from scratch. The five New York buildings grew to more than 10,000 members.

Which systems did the technology cover in each building?

Multi-tenant networking, Wi-Fi, access control, cameras and phone systems. Our team designed and developed all of it for the first five New York buildings, starting with the founders' first eco-friendly coworking venture in 2009.

Do you know if your company is safe?

Speak with a security engineer today. The first assessment call is free and confidential.

CallFree assessment