Hospitality & Travel
We test whether guest networks, payment systems, property systems and booking sites are safe from attackers, and fix what we find. Guests expect fast Wi-Fi and a payment that just works. We build the networks behind hotels, resorts and ships: guest access, payment systems and the property systems that must stay out of reach.
A hotel, a resort or a ship is a business that runs on guest trust. Guests bring dozens of devices, pay with cards at several points of sale, and expect the Wi-Fi to work in every room and corridor. Behind the scenes, the same building runs reservations, door locks, cameras and building controls. All of it shares cable, and almost none of it should share a network.
Our team designs hospitality networks with separate zones for guests, staff, payments and building systems, Wi-Fi that roams cleanly and signs loyalty members in automatically, and encrypted links to regional hubs or a shore hub. The goal is a smaller card-data environment, a guest experience that feels effortless and a property that keeps trading when a circuit fails.
What we see in your industry
- Guest and business traffic share the building. Without separation, a guest device can reach the front desk, the card terminals and the door-lock gateways.
- Card payments pull the whole property into PCI DSS scope unless the payment network is segmented, encrypted end to end and tested.
- Guests judge the stay by the Wi-Fi. Roaming across hundreds of access points, casting to the room TV and automatic sign-in for loyalty members are network design problems.
- Properties are remote and thinly staffed. Internet circuits fail, and a hotel or a ship must keep checking guests in and taking payments when they do.
Segmentation comes first. Guest, in-room, staff, PMS and POS, building and camera systems each get their own VRF and firewall zone with default-deny rules, so a compromised guest laptop has nowhere to go.
Payments come second. Point-to-point encrypted terminals on one dedicated VLAN that reaches only the processor keep PCI DSS scope to a few ports instead of the whole property. An annual segmentation test proves it.
The guest experience comes third. WPA3 with client isolation, Passpoint for loyalty members and per-room private keys for casting give guests a network that works without a login page and without exposing their devices to strangers.
Resilience is the last piece. Dual internet circuits, IPsec to two hubs and BGP failover mean that check-in and card payments continue when one provider fails. We test it by pulling the cable.
Every industry's reference library and routine can run offline. Our Apocalypse IT Package is an on-premises continuity kit with a local reference library, document scanning, a private AI desk, chat and battery backup, offered to every customer.
Related work on our track record: a hotel group's guest Wi-Fi and PCI scope reduction (illustrative) and a cruise line's ship-to-shore SD-WAN (illustrative).
PCI DSS 4.0.1 for Small Merchants: What Changed, What Is Now Required, and How to Cut Scope
PCI DSS v4.0.1 is the only active version of the card-security standard. The requirements that were best practices until March 31, 2025 are now mandatory in every assessment. For a small merchant the work depends on the Self-Assessment Questionnaire that applies. This article explains the version history, the changes that reach small businesses, what the SAQ types mean, and how to reduce what you must protect.
Work like yours
A multi-location company cuts its phishing click rate and lifts its report rate in 12 months
A US services company with 14 locations and about 450 staff, a leader in its segment.
About 450 staff across 14 sites, 1 Microsoft 365 tenant, 4 role tracksRead the case
Fourteen ships, one network: LEO and GEO satellite at sea, 5G in port, and a card-data segment that stays clean
A cruise line operating from US Atlantic and Gulf ports, a leader in its segment.
14 ships, 3,000 to 5,000 guests each, 2 LEO terminals + 1 GEO terminal per ship, 5G and fiber in port, 2 shore hubsRead the case
One guest network, one payment network: shrinking PCI scope across 38 hotels
A hotel group with 38 properties across the United States and the Caribbean, a leader in its segment.
38 hotels, ~6,400 rooms, ~3,000 Wi-Fi 6 APs, 1 Gb/s dual internet per property, 2 regional hubsRead the caseHow we help
Managed IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreClayton Secure
One view of your entire cybersecurity program, in near real time.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageCan a guest device reach the front desk or card terminals?
It should not. Guest Wi-Fi is separated from the property management system, payment terminals, door-lock gateways and cameras by firewall zones with default-deny, so only named flows are allowed. A flat property network is the usual weakness we find.
How do you reduce PCI DSS scope for a hotel?
By segmenting the payment network so only a small dedicated VLAN holds the card environment, encrypting card data end to end and testing the separation. The assessor then covers far less than a whole property. Your own obligations and assessment remain yours.
Can guests stream from a phone to the room TV?
Yes. Casting fails on many hotel networks because wireless client isolation blocks it. A per-room private network lets a guest's devices and room TV see each other while no one else can.
What happens to check-in and payments when the internet circuit fails?
Properties are remote and thinly staffed, so we design for it with dual internet circuits and automatic failover, so check-in and payments continue. Failover time depends on the circuits, and we test it before relying on it.
Do you work with cruise lines and travel companies as well as hotels?
Yes. Hotels, resorts, ships and travel companies share the same needs: guest access, payment systems and property systems kept out of reach, plus connectivity that survives remote or intermittent links.
Can loyalty members connect to Wi-Fi without a login page?
Yes, with Passpoint (Hotspot 2.0) and enterprise authentication, members can join automatically on arrival. Visitors without an account use a captive portal on an isolated guest network.