We know virtually every hardware manufacturer and platform in information technology. These are the platforms our team designs, deploys, secures and runs.
Technology choices matter less than how well they are run. Our team has designed, deployed and secured equipment and software from most major vendors, which allows us to recommend what fits your situation instead of what we happen to resell.
The groups below list the platforms and practices we work with. Product names are trademarks of their owners and appear to describe experience, not partnership. If your environment includes something not listed, ask; the list is long but not complete.
Networking is the foundation every other system sits on. Our team designs and builds business networks from the cable up: structured cabling and cable management, PoE, switching, routing, wireless, fiber, point-to-point radio and 5G links, on the hardware businesses actually run.
What we do
Switching, routing and VLAN design with documented addressing
Routing decides where every packet goes, and BGP (RFC 4271, TCP port 179) decides how a network talks to the rest of the Internet. Our team designs and runs BGP edges, internal routing and route-policy for multi-homed businesses, hosting providers and multi-region enterprises, on open-source routing daemons and carrier-grade router operating systems.
What we do
BGP edge design for multi-homed and multi-region networks
BIRD 2, FRRouting and OpenBGPD configuration and review
A flood attack fills a link or a server until real traffic cannot get through. Defense works in layers: detect the attack quickly, drop the bad traffic as close to the edge as possible, and send the rest of the traffic on its way. Our team designs these layers for networks that run their own address space and for businesses that rely on a scrubbing provider.
What we do
XDP and eBPF filters for volumetric and SYN floods on Linux hosts
Flow-based detection with FastNetMon and sFlow, NetFlow or IPFIX
A modern datacenter network is a leaf-spine fabric: every leaf switch connects to every spine, so any two servers are the same number of hops apart. Layer 2 and layer 3 segments are carried over that routed fabric with VXLAN (RFC 7348, UDP port 4789, 24‑bit VNI) and a BGP EVPN control plane (RFC 7432, RFC 9136). Our team designs and builds these fabrics, and the optics and cabling under them.
What we do
Leaf-spine fabric design with BGP as the routing protocol
VXLAN-EVPN to stretch VLANs and tenants across racks and datacenters
SD-WAN steers traffic across several internet and private circuits by application and link quality, so a branch can use broadband, 5G and MPLS together and move off a failing link. SASE (Secure Access Service Edge) adds cloud-delivered security to that: secure web gateway, zero-trust network access and cloud access security broker policy applied close to the user.
What we do
Branch SD-WAN on existing firewall or router platforms
Application-aware routing and link-quality steering
The firewall is where policy meets traffic. Our team designs, hardens and operates perimeter and internal firewalls: rule-set clean-up, segmentation, VPN termination, intrusion prevention, web filtering and logging that someone actually reads.
What we do
Firewall migrations with zero-downtime cutover plans
Rule-set audits that remove stale and overly broad rules
Security operations is the daily work of seeing and handling suspicious activity. Our team deploys endpoint protection, centralizes logs, and builds detection and response so that alerts mean something and someone acts on them.
What we do
Endpoint detection and response rollout and tuning
Identity is the new perimeter. Our team builds and repairs directories, single sign-on, multi-factor authentication and privileged access, from on-premises Active Directory to cloud identity providers.
What we do
Single sign-on across business applications with SAML and OIDC
Email is still the center of most businesses and the most common way in for attackers. Our team has run email since the first Exchange releases. Today that means Microsoft 365 and Google Workspace tenants, self-hosted mail servers, migrations, and the authentication records that decide whether mail arrives.
What we do
Microsoft 365 and Google Workspace tenant setup and hardening
Mail migrations between platforms with minimal disruption
Remote access should be simple and narrow. Our team builds site-to-site and remote-access networks on modern protocols, and grants access per device and per service instead of opening a flat network.
What we do
Site-to-site WireGuard meshes across regions
IPsec/IKEv2 tunnels with strongSwan, Libreswan or firewall appliances
Cloud platforms are now part of nearly every business. Our team designs, migrates and runs workloads on the major public clouds and edge platforms, with attention to identity, network layout, cost and recovery.
What we do
Cloud landing zones with account structure and guardrails
American businesses often prefer a cloud provider built and headquartered in the United States. This group lists nineteen relevant US-headquartered providers, from the four large public clouds to GPU clouds, edge networks, object storage and data platforms. It is a working list of providers our team plans around and runs workloads on, not a ranking or a market-share claim.
What we do
Choosing a provider by workload, data location and recovery needs
Multi-provider designs with a documented exit path
Immutable storage is how a business keeps one copy that a stolen administrator login cannot erase. Our team designs write-once storage and backup vaults on the four large clouds: Amazon S3 Object Lock and AWS Backup on Amazon Web Services (AWS), Cloud Storage bucket lock and the Backup and DR Service on Google Cloud, immutable storage for Azure Blob Storage and Azure Backup on Microsoft Azure, and Object Storage retention rules and Block Volume backups on Oracle Cloud Infrastructure (OCI).
Each cloud records what happens in an account, detects threats and controls who gets in, using its own services. Our team switches these on early, sends the logs to one place and decides who reads the alerts: AWS CloudTrail, Amazon GuardDuty and AWS IAM Identity Center on Amazon Web Services (AWS); Cloud Audit Logs, Security Command Center and Google Cloud IAM on Google Cloud; the Azure Monitor activity log, Microsoft Defender for Cloud, Microsoft Sentinel and Microsoft Entra ID on Microsoft Azure; and OCI Audit, Cloud Guard and OCI IAM on Oracle Cloud Infrastructure (OCI).
What we do
Account-level audit logging turned on from day one
Threat detection and posture findings routed to one place
A private link from an office or colocation cage to a cloud avoids depending on the public internet path alone. Our team plans and documents these links: AWS Direct Connect on Amazon Web Services (AWS), Cloud Interconnect on Google Cloud (Dedicated, Partner and Cross-Cloud options), Azure ExpressRoute on Microsoft Azure and OCI FastConnect on Oracle Cloud Infrastructure (OCI).
What we do
Private connectivity from offices and colocation to cloud
Managed Kubernetes, bulk email and hosted AI each have a named service on the large clouds. For containers: Amazon Elastic Kubernetes Service (Amazon EKS) on Amazon Web Services (AWS), Google Kubernetes Engine (GKE) on Google Cloud, Azure Kubernetes Service (AKS) on Microsoft Azure and Oracle Cloud Infrastructure Kubernetes Engine (OKE). For application email: Amazon Simple Email Service (Amazon SES).
Keys and secrets are where good security usually fails. Our team designs key hierarchies, sets up managed key services and secret stores, and replaces credentials scattered in files with controlled, audited access.
What we do
Key hierarchy design with rotation schedules
Managed key service setup on AWS, Google Cloud, Microsoft Azure and OCI
Servers and storage hold the data a business cannot lose. Our team specifies, racks, configures and maintains servers, shared storage and the power behind them.
Data work covers design, tuning, migration and protection of relational and NoSQL databases. We build the schema and the backups, and a restore test is part of the job.
Our team builds with frontier models and runs open-weight models on local GPUs where data must stay in-house. We train and fine-tune models, stand up inference servers, and build retrieval and agent systems around them.
Our team develops and audits smart contracts, operates nodes and builds wallet and payment software. Security review comes first because deployed contracts are immutable.
Many business tasks live in a browser. Our team builds browser extensions for specific jobs and automates web workflows with headless-browser tooling for testing, data entry and monitoring.
Business phones still matter, and they run on the network. Our team builds and supports phone systems: PBX, SIP trunks, call flows and IVR, plus hosted voice and Microsoft Teams voice.
Every employee uses a device, and every device is a risk. Our team sets up and manages fleets of Macs, Windows PCs, Linux workstations and phones: enrollment, policies, patching, encryption and recovery.
Physical security is IT with legal requirements. Our team designs and installs access control, cameras and alarm systems, and connects them to the network and identity systems they depend on.
What we do
Door access control with reader and controller installation
Drones and robots are increasingly useful for inspection, mapping and repeated tasks. Our team deploys them and integrates their data and control software with the rest of the business.
Our team builds machine monitoring and sensing systems on small, inexpensive hardware. Raspberry Pi, Arduino and ESP32 boards read industrial sensors for temperature, humidity and vibration, and send readings over MQTT to a platform that stores, graphs and alerts.
What we do
Sensor nodes for temperature, humidity and vibration
Healthcare IT needs security and privacy built in. Our team helps practices and health-technology companies with the HIPAA Security Rule, risk analysis, audit logging and protection of personal data under privacy law.
Accounting, ERP and CRM systems run the business. Our team implements, integrates and cleans up these systems, connecting them with APIs and automating the repetitive entry between them.
Network automation means treating device configuration as data and code: a source of truth describes what should exist, templates and scripts render it, and tooling pushes it to routers, switches and firewalls the same way every time. Our team builds this with Ansible, Nornir and NAPALM for change execution, NetBox as the inventory and IP address record, and Git as the history of every change.
What we do
Ansible, Nornir and NAPALM playbooks and scripts for repeatable network changes
NetBox as the source of truth for devices, VLANs, prefixes and cabling
A network reaches the Internet through transit, through peering, or both. Transit means paying an upstream provider to carry traffic to everywhere; peering means exchanging traffic directly with another network, usually at an Internet exchange point (IXP) or over a private cross-connect inside a data center. Our team designs which mix fits a business: how many upstreams, which exchanges, and where the physical handoffs happen.
What we do
Transit versus peering analysis and upstream selection
Out-of-band (OOB) management is a second, independent path to your network equipment. When a configuration mistake or an outage takes the production network down, a console server with a serial connection and a cellular uplink still lets an engineer reach the device. We deploy console servers from vendors such as Opengear and Lantronix, with LTE failover and central management.
What we do
Console-server design with serial, LTE and break-glass access
Out-of-band network isolated from production routing
Every log line, certificate, trade, broadcast frame and cellular handoff depends on clocks that agree. The Network Time Protocol (NTP, RFC 5905) keeps ordinary servers and devices within milliseconds of each other over a normal network, and Network Time Security (NTS, RFC 8915) adds TLS-based key setup and authenticated packets so a forged time reply can be detected. We design the time hierarchy for a business: which sources are trusted, how many, and how clients are told to use them.
What we do
Time-source architecture with redundant, authenticated NTP/NTS
PTP deployments with grandmaster, boundary and transparent clocks
The Domain Name System turns names into addresses, and almost every service fails visibly when it breaks. Authoritative servers publish the answers for a domain; recursive resolvers look them up for users and cache the result. We design both sides: where the zones are hosted, how many independent providers answer for them, and which resolvers a company's devices use.
What we do
Authoritative zone design across two or more independent providers
DNSSEC signing, DS publication and safe key rollover
Wireless is where most people meet the network, and where most office complaints start. Wi-Fi 6E (IEEE 802.11ax with the 6 GHz band) and Wi-Fi 7 (IEEE 802.11be) add clean 6 GHz spectrum; Wi-Fi 7 adds multi-link operation, which spreads traffic over several links, and 320 MHz channels. A good design starts with a site survey, channel and power planning, and the wired uplinks to match, not with the access point model.
What we do
Predictive and on-site RF surveys with channel and power plans
Every network sits on cable, and cabling outlives the equipment above it by decades. ANSI/TIA-568 defines how commercial buildings are cabled: horizontal runs to the desk, backbone runs between closets, permanent links and channels. For copper we work with Category 6A, which carries 10 GbE over 100 m, and we label, document and certify every run so that faults can be found later.
What we do
Cabling design to TIA-568 for offices, data halls and plants
A public key infrastructure (PKI) is the system that decides which keys a business trusts: certificate authorities (CAs) that sign certificates, rules for who may get one, and a way to revoke them. It sits under HTTPS, VPNs, Wi-Fi with 802.1X, mutual TLS between services, code signing and S/MIME mail. We build internal CAs with an offline root and online issuing CAs, certificate templates that match real roles, and revocation that actually gets checked.
What we do
Internal CA design with offline root and issuing tiers
ACME automation for web, mail and appliance certificates
A load balancer spreads traffic over several servers and sends it only to those that are healthy. A Layer 4 balancer decides on addresses and ports and passes TCP or UDP through; a Layer 7 balancer reads the request (host, path, headers, cookies) and can route, rewrite, cache and apply security rules. Many designs use both: a fast L4 front, L7 behind it. We choose by what the application needs, not by brand.
What we do
L4 and L7 balancer design with health-check strategy
TLS offload and certificate lifecycle for balancers
Every server, switch and camera eventually depends on a UPS, a power distribution unit and a generator that starts when it is needed. The uninterruptible power supply (UPS) comes in three common designs. Standby (offline) units run from utility power and switch to the inverter when it fails, which can take up to about 25 ms. Line-interactive units add a transformer that corrects brownouts and surges without using the battery. Online double-conversion units rectify incoming power to DC and invert it again, so the load never sees the utility and there is no transfer switch.
Logs are the memory of a network, and they are only useful if they arrive, are parsed and can be found months later. Syslog (RFC 5424) is still the common language of network gear and servers: a layered protocol with a structured message format that works over several transports. OpenTelemetry adds a vendor-neutral way to produce traces, metrics and logs, with a Collector that receives, processes and exports them.
A large enough quantum computer would break the public-key cryptography that protects today's TLS, VPNs, code signing and wallets, and data recorded now can be decrypted later. In August 2024 NIST published the first three finalized post-quantum standards: FIPS 203 (ML-KEM, a key-encapsulation mechanism derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, a digital signature scheme derived from CRYSTALS-Dilithium) and FIPS 205 (SLH-DSA, a hash-based signature derived from SPHINCS+, a backup built on different mathematics).
What we do
Cryptographic inventory across TLS, VPN, SSH, mail and signing
Running a large language model on your own hardware is a systems problem: memory, bandwidth, scheduling and security. NVIDIA HGX is the eight-GPU baseboard platform behind many AI servers: the HGX B200 carries eight Blackwell SXM GPUs with 1.4 TB of total GPU memory and fifth-generation NVLink at 1.8 TB/s per GPU, so a big model can be sharded across GPUs that talk to each other fast.
Banks and asset managers price instruments and measure risk with models, and regulators expect those models to be understood, documented and validated. QuantLib is a free, open-source quantitative finance library in C++ with bindings for Python, C#, Java and R, released under a modified BSD licence. The Open Source Risk Engine (ORE), sponsored by Post Trade Solutions (formerly Acadia), builds on QuantLib for risk analytics and valuation adjustments (XVA), with XML and API interfaces and Python and Jupyter launchers.
What we do
QuantLib and ORE environments with reproducible runs
Rust is a systems language with no garbage collector, a type system and ownership model that guarantee memory safety and thread safety, and tooling that makes the result easy to build and test. That suits servers that must not crash, parsers of untrusted input, blockchain nodes and high-rate data capture. WebAssembly (Wasm) is a portable, sandboxed binary format that runs near native speed in browsers and on servers, and Rust compiles to it.
Google Cloud is a broad platform; the useful question is which service fits which workload. BigQuery is a serverless data platform that separates storage from compute and offers SQL, Python and BigQuery ML for forecasting and classification without managing servers. AlloyDB for PostgreSQL is a managed, PostgreSQL-compatible database with a columnar engine for analytics and cross-region secondary clusters for disaster recovery.
What we do
Cloud discovery, dependency mapping and wave planning
Some offices cannot depend on the internet: law firms with privileged files, clinics, ships, and anyone planning for a long outage. A self-contained stack covers four jobs. Optical character recognition (OCR) turns scanned paper into searchable text: Tesseract is an open-source engine with an LSTM neural network recognizing more than 100 languages, and PaddleOCR converts PDFs and images into structured data and supports over 100 languages.
A datacenter build starts with the server. We specify, rack and burn in servers from Supermicro, Dell PowerEdge, HPE ProLiant and Lenovo ThinkSystem, choosing CPUs, memory, storage and GPUs against the workload instead of the catalogue. AMD EPYC 9005 processors, for example, offer up to 192 cores per socket and 12 DDR5 memory channels per socket, which makes memory population a design decision: every channel should carry a DIMM.
What we do
Server specification by workload: cores, memory channels, NVMe and PCIe layout
Memory population plans that use every DDR5 channel
Colocation rents space, power, cooling and physical security while the customer owns the IT equipment. We help clients choose and move into a colocation facility, order cross-connects, use the meet-me room where carriers exchange traffic, and decide what remote hands can do for them. Many facilities supply redundant A and B power feeds, so servers with two power supplies are cabled to separate feeds.
What we do
Colocation requirements, site selection and contract review
Cross-connect and carrier ordering with documented demarcation
Kubernetes is an open source platform for managing containerized workloads, built around declarative configuration: you describe the state you want and the system works to maintain it, with scaling, failover, service discovery, rollouts and self-healing. It provides building blocks rather than a finished platform, so the surrounding choices matter.
Operational technology (OT) runs physical processes: PLCs, SCADA, DCS and building systems. NIST SP 800-82 Rev. 3, published September 2023, explains how to secure OT while accounting for performance, reliability and safety, and the ISA/IEC 62443 series sets requirements for industrial automation and control systems, split by role: asset owners, integrators and product suppliers.
What we do
OT asset discovery and inventory
Segmentation design between IT, OT and safety zones
AI agents read untrusted content, call tools and act with real credentials, so they need security controls that chatbots never did. The frameworks that describe the risk are public: the OWASP Top 10 for Agentic Applications 2026, the OWASP Top 10 for LLM Applications 2025 and the security guidance in the Model Context Protocol specification.
What we do
Agent threat modelling against the OWASP agentic and LLM risk lists
Prompt-injection and jailbreak testing with PyRIT, garak and promptfoo
Which technologies does Clayton Cybernetics work with?
We work across networking, firewalls, identity and email, cloud, storage, data, voice, devices and open source. The page groups each platform.
Are you partners or resellers of these vendors?
The names show platforms our team has experience with. They are trademarks of their owners and do not imply a partnership or certification.
Do you work with Cisco, Palo Alto or Fortinet?
Yes, our team has deployed and secured them, among other networking and firewall platforms. We choose equipment for the client's size, budget and risk, not for a vendor. Product names on this site are trademarks of their owners and describe experience, not partnerships.
Do you support Microsoft 365 and Active Directory?
Yes, including Entra ID, Intune and Exchange. We manage identity, device policy, mail flow and security settings, and we have run hybrid Exchange with on-premises Active Directory. We also help move organizations between these platforms.
Which cloud platforms do you support?
Amazon Web Services (AWS), Google Cloud, Microsoft Azure, Oracle Cloud Infrastructure (OCI), IBM Cloud, Cloudflare, DigitalOcean and OVHcloud, among others. We review cost and security on each and place each workload where it fits best. See our Cloud Management service for the full scope.
Do you only support products on the page?
No. We know virtually every hardware manufacturer. Ask about yours.
Do you build custom integrations?
Yes. We write APIs and integrations between systems.
Do you know if your company is safe?
Speak with a security engineer today. The first assessment call is free and confidential.
