// CASE STUDIES · HANS STUDY

Work that had to hold up

Selected engagements, anonymized to sector and scale. Public institutions, commercial towers, airports, traffic operations, and border crossings. Every one of these was a live environment where the system could not simply be taken away for a week.

Clients are described by sector and scale rather than by name, and the detail below covers work performed rather than the current state of any live system. If you want to talk through a specific class of engagement in more depth, that conversation happens under appropriate confidentiality.

Public institution · Canada

Genetec upgrade and platform rebuild across a three-site estate

3 sites12+ multi-role servers24/7 onsite SOC

The problem

The security platform was running on Windows Server 2012 that had reached end of life, on hardware that could no longer carry the load. Years of accumulated legacy configuration had left a long tail of performance and compatibility faults, and the estate spanned three sites with the main site carrying the bulk of the roles.

What I did

Migrated the estate from end-of-life Windows Server 2012 to Server 2022, with new server hardware and a rebuilt network underneath it.
Rebuilt the main site as a redundant multi-role Genetec deployment across roughly a dozen servers, sized against real recording and client load rather than a template.
Moved the database onto SQL high availability, then hardened the platform end to end.
Integrated CCTV, access control, and intrusion into one operational picture, including extensive Bosch intrusion integration.
Built automations so the 24/7 onsite security operations centre monitors and responds in real time instead of watching tiles.
Worked through the backlog of legacy performance and compatibility faults rather than carrying them onto the new platform.

Where it landed

A supported, redundant, hardened platform with the three sites operating as one system, and an SOC with automations doing the work the operators used to do by eye.

Commercial real estate · Canada

Access control stabilization and a full core network rebuild across a multi-tower complex

Multi-tower complexOne C•CURE instanceFully redundant per-tower networks

The problem

A single C•CURE 9000 instance controlled access for every tower in the complex and integrated with Genetec. The elevator integration was crashing and the system had memory faults. I was brought in to find out why and fix it.

What I did

Traced the failures to a combination of software faults and configuration problems inside C•CURE rather than the elevator interface everyone suspected.
Re-architected the C•CURE virtual environment so the towers have real redundancy between them instead of a single point of failure controlling the whole complex.
Rebuilt the core network for the entire complex: each tower on its own fully redundant network with modular HPE Aruba switching.
Deployed dynamic routing across the towers with full multicast support, tuned for CCTV traffic.

Where it landed

The elevator integration and memory faults resolved at the cause, and a complex that no longer loses access control across every tower because one instance had a bad day.

Aviation · Canada

Genetec upgrade and multi-terminal stabilization at an international airport

Multiple terminalsMultiple stakeholder organizationsMission-critical

The problem

Work spanned the airport operator and a federal agency operating inside the facility. The Genetec platform needed upgrading, the C•CURE system needed stabilizing, and there was a broad range of CCTV, access control, and network faults across the terminals.

What I did

Upgraded Genetec and stabilized the C•CURE deployment.
Worked through CCTV, access control, and network faults across multiple terminals.
Re-architected the portions of the network that could not carry what was being asked of them.
Expanded capability with new integrations across terminals for the federal stakeholder.

Where it landed

A stabilized platform across multiple stakeholder organizations in an environment where an outage is not an option, plus integrated capability those teams did not have before.

Transportation · Traffic operations centre

Mission-critical Genetec upgrade behind a live traffic operations video wall

Live operations centreVideo wallZero-tolerance downtime

The problem

A traffic operations centre needed a Genetec version upgrade. The centre runs live, the video wall is the operational surface, and every camera feed on it matters. There was no comfortable maintenance window.

What I did

Planned the upgrade in detail against a mission-critical environment where the room cannot go dark.
Handled the video wall and camera feed integrations through the version change.
Tuned the platform so the video wall behaved properly with the upgraded system rather than merely displaying something.

Where it landed

The centre came through the version upgrade with the wall and every feed working the way operators expect.

Education · Multi-campus

High availability network built to carry an emergency notification system

3 campusesDual-path redundancy end to endLife-safety adjacent

The problem

Three campuses depended on an emergency notification system as the primary way of alerting people, in an environment where audible alarms alone cannot be relied on to reach everyone. That makes the network underneath it a life-safety system in practice, not an IT service. The notification system itself runs on a single-wire architecture, so the network had to be designed around keeping that path up.

What I did

Designed, built, and tested the network from the ground up across all three campuses rather than adapting what was there.
Built the headend on dual virtually stacked Cisco cores, with a stacked access layer beneath it.
Ran dual-path redundancy throughout, so no single link or device failure takes the notification path down.
Deployed high availability firewalls and an SD-WAN architecture across the campuses.
Tested the design against failure rather than assuming redundancy works because it is configured.

Where it landed

Three campuses on a network engineered to the standard the system deserves: if the notification system needs to alert, the infrastructure carrying it is not the thing that fails.

Utilities · Water

A water utility brought off end-of-life infrastructure and hardened

Server 2003 → 2019/2022ESXi 6 → Hyper-VDomain built from scratch

The problem

A water utility was running production systems on VMware ESXi 6 and Windows Server 2003, both long past end of life, in an environment with little security in place and no real hardening. For a utility, that is not just technical debt.

What I did

Migrated off ESXi 6 and Server 2003 onto modern Hyper-V with Server 2019 and 2022.
Deployed a Windows domain, then configured and hardened it properly rather than accepting defaults.
Built custom LTSC workstation images so the endpoint fleet is consistent and stripped to what the environment needs.
Reconfigured the network and hardened the environment against the threats a utility actually faces.

Where it landed

A utility running supported, hardened, and consistently managed infrastructure instead of operating critical services on platforms that stopped receiving security updates years ago.

Automotive technology · Startup

From no compliance function to ISO 27001 ready, as fractional CISO

vCISO engagementZero to ISO 27001 readyEnterprise automotive customers

The problem

A startup still raising funding was already winning contracts with major automotive manufacturers. Those customers expect enterprise security posture. The company had effectively no compliance function, no policy set, and an environment that had grown the way startup environments grow.

What I did

Acted as fractional CISO, owning the security function while the company was too early to justify a full-time hire.
Built the policy set from nothing, aligned to ISO 27001 rather than written to look good in a questionnaire.
Re-architected access to environments, and the network architecture underneath, so access could actually be governed and evidenced.
Ran security reviews and worked with the engineering team on secure coding practice, so the controls held in the product rather than only on paper.

Where it landed

A company that went from no compliance function to ISO 27001 ready, able to answer enterprise automotive customer security requirements without stalling a deal.

Defence and aerospace manufacturing

Small-business IT to CMMC and NIST SP 800-171 readiness, as fractional CTO and CISO

vCTO / vCISO engagementCMMC + NIST SP 800-171Defence supply chain

The problem

A manufacturer supplying wiring harnesses into armoured vehicle and military aircraft programs had standard small-business IT and no information security function. The defence supply chain requirements they were being held to were a long way from where they were.

What I did

Took a combined fractional CTO and CISO role, covering both the technology direction and the security function.
Re-architected the infrastructure so it could support controlled unclassified information handling rather than being retrofitted around it.
Built the policy set and put the controls in place against CMMC and NIST SP 800-171.
Moved the organization from typical small-business practice to a defensible, documented control set with the evidence behind it.

Where it landed

A defence supplier that went from no information security programme to CMMC and NIST SP 800-171 ready, with the architecture, policies, and controls to support the contracts it was pursuing.

Critical infrastructure · Border crossing

Security, traffic control, and message-sign infrastructure unified on one platform

Camera count quadrupledHA Genetec + HA SQLPlaza-wide DMS control

The problem

A border crossing needed its CCTV, access control, and network infrastructure redesigned, and the plaza needed traffic control infrastructure that could actually be operated as one system.

What I did

Redesigned CCTV, access control, and the network, including extensive fibre upgrades.
Built Genetec on high availability with SQL high availability underneath it.
Integrated card access and intercoms at multiple gates controlling access to the plaza.
Quadrupled the camera count across static, PTZ, and thermal, each integrated to the function it serves.
Extended the platform beyond security: traffic ramp control with interlocks, and the complete digital and variable message sign infrastructure for the entire plaza, with the automations to support traffic flow.

Where it landed

One platform running security, traffic ramps, and the plaza-wide message sign infrastructure together. To my knowledge one of the first major deployments to run DMS infrastructure through Genetec this way.