Skip to content

Eight engagements, told with their numbers

The starting point, the constraints, what we did and what we would do differently. Clients are not named; everything else is here.

Case Studies

Discover

Why these eight engagements

Routine projects on paper, demanding in the field

Migrating a fleet, replacing a network, securing access: nothing exceptional at first glance. The difference lies in tight work windows, internal teams already stretched and the unexpected. That is why each case also covers what did not work the first time.

The eight engagements

Pick a sector or a result to jump straight to the case.

Healthcare2025

1,240 workstations moved to Windows 11 without closing a single clinic

A private network of 31 medical and physiotherapy clinics had to leave Windows 10 before end of support, with a three-person IT team and clinics open six days a week.

The starting point

The fleet had 1,240 workstations from five hardware generations, bought as clinics opened over the years. More than a quarter (338 devices) did not meet Windows 11 hardware requirements: no TPM 2.0 chip or an older processor. Windows 10 support was ending on October 14, 2025, and the three-person IT department could barely keep up with day-to-day operations.

What made it hard

  • Clinics open from 7 a.m. to 9 p.m. on weekdays and Saturdays: no disruption during consultation hours.
  • Electronic medical record software, imaging viewers and specimen label printers to validate before any cutover.
  • Quebec’s Law 25: every retired drive had to be wiped verifiably, with proof by serial number.
  • A fixed capital budget for the fiscal year: replace only what could not be upgraded.

What we did

  1. Discover

    Inventory cross-checked between Intune and visits to all 31 sites in two weeks. 46 applications and drivers tested on a reference device from each generation.

  2. Recommend

    Upgrade the 902 compatible workstations in place. Replace the other 338 with ThinkPad T14 laptops in exam rooms and ThinkCentre Tiny desktops at reception, prepared with Windows Autopilot.

  3. Deploy

    Two evening teams, four clinics a week, with a rollback plan for every workstation. Old devices collected, wiped with certification, then resold or recycled.

The results

of the 1,240 workstations on Windows 11 by September 26, 2025
100%
18 days before end of support
of hands-on time per new device
35 min
Before: 3 h 10 with manual imaging
clinics closed because of the project
0
Work done between 9 p.m. and 2 a.m.
retired devices wiped and certified
338
212 resold, 126 recycled

How we measured it: Intune compliance reports, the client’s ticket log and the wiping certificates delivered at the end of the engagement.

What we would do differently

Label printer drivers caused 61% of first-week tickets. They are now among the first items we test, even before the clinical software.

Back to all eight cases

K-12 Education2025

52 schools, one summer and a wireless network ready for back-to-school

A school service centre was equipping students with Chromebooks, but its 2016 Wi-Fi saturated as soon as a whole class connected. The replacement had to fit between two school years.

The starting point

The wireless network dated from 2016: 1,100 Wi-Fi 5 access points designed for a few devices per classroom, not for 30 Chromebooks opening the same activity at once. Teachers had gotten used to splitting classes into two groups. End-of-life floor switches could not deliver enough power (PoE) for a new generation of access points.

What made it hard

  • A single window: from June 23, the last day of class, to August 22, when staff returned.
  • Summer construction already planned in 14 schools (roofs, ventilation), and building access to coordinate with custodial teams.
  • Asbestos in the ceilings of 9 schools: supervised work, with separate procedures and schedules.
  • No service loss for the day camps and summer courses held in 6 schools.

What we did

  1. Discover

    Predictive Ekahau survey from floor plans at one access point per classroom, then on-site measurements in 8 representative schools.

  2. Recommend

    HPE Aruba Networking Wi-Fi 6E access points, 214 switches replaced with PoE-capable CX 6300 models and central management in Aruba Central. The 412 new drops were handled by the service centre’s cabling contractor.

  3. Deploy

    Three teams in parallel: one elementary school per team per day, three to five days per high school. Every classroom validated with 30 devices connected at once before sign-off.

The results

schools delivered by August 22, 2025
52 / 52
Last sign-off on August 21
of classrooms with a signal of at least −67 dBm
98%
Measured room by room at sign-off
Wi-Fi-related tickets in September
−71%
Compared with September 2024
Chromebooks per classroom tested at once, with no disconnections
30
Before: drops beyond 15 devices

How we measured it: room-by-room acceptance surveys, the Aruba Central dashboard and the service centre’s ticket log.

What we would do differently

In six schools built in the 1960s, plaster ceilings left no room for cabling: surface raceways had to be added along the way. We now have ceilings inspected during the survey rather than at installation.

Back to all eight cases

Finance2026

One email fraud attempt, then 10 weeks to close the door

After an attempt to divert a payment through an advisor’s mailbox, a wealth management firm had to harden access before its cyber insurance renewal.

The starting point

In January, a fraudster took over an advisor’s mailbox through a reused password, then requested a wire transfer in a client’s name. The assistant instinctively called the client to confirm, and the transfer never happened. The investigation showed that multifactor authentication covered only 61% of accounts, that 14 people held global administrator rights, and that the insurer would require evidence on 23 specific controls at the April renewal.

What made it hard

  • Advisors often on the road at client sites, who could not be locked out away from the office.
  • Communication retention requirements specific to the securities industry.
  • Three offices, two languages and a single four-person internal IT team.
  • A non-negotiable deadline: the insurance policy renewal.

What we did

  1. Discover

    Review of 90 days of Entra ID sign-in logs, plus an inventory of privileged accounts, authorized third-party apps and mail forwarding rules.

  2. Recommend

    Phishing-resistant authentication for everyone: passkeys in Microsoft Authenticator and FIDO2 keys for administrators. Conditional access by device and country, just-in-time admin rights with PIM and Defender on every workstation.

  3. Deploy

    Rollout office by office, starting with leadership and assistants, with 15-minute assisted enrollment sessions. Alert monitoring was added to our managed services, with escalation to the client’s IT team.

The results

of employee accounts protected by phishing-resistant authentication
100%
Before: basic MFA on 61% of accounts
global administrators, activated only when needed
4
Before: 14, permanently
controls required by the insurer, documented by the renewal date
23 / 23
click rate in the June phishing simulation
3.1%
Before: 11.8% in February

How we measured it: Entra ID and Microsoft Secure Score reports, the insurer’s questionnaire and results from simulation campaigns run by the client.

What we would do differently

We underestimated enrollment for travelling advisors: 9% needed a call to support. We now schedule assisted enrollment sessions before turning on new rules, not after.

Back to all eight cases

Higher Education2025

A 3,400-request back-to-school, with an 11-minute median response

A CEGEP’s IT help desk could no longer keep up at the start of each term: queues, no evening service and a third of requests for forgotten passwords.

The starting point

Support relied on three college technicians, from 8:30 a.m. to 4:30 p.m., while most students work on their courses in the evening. At the start of each term, volume tripled: requests waited more than a day on average and password resets made up 38% of tickets. The technicians no longer had time for projects.

What made it hard

  • Transition to be completed before the fall term, with no break-in period.
  • Service in French, with English support for international students.
  • Collective agreements respected: no internal positions replaced, and college technicians keep level 2.
  • Students’ personal information: access limited to what is strictly necessary, and logged.

What we did

  1. Discover

    Analysis of 14 months of tickets to establish volumes by hour and by week, the 40 most frequent requests and peak needs.

  2. Recommend

    Service desk from 7 a.m. to 10 p.m. on weekdays and 9 a.m. to 5 p.m. on weekends, self-service password reset, a 140-article knowledge base and clear escalation to the college team.

  3. Deploy

    Six-week handover: procedures written with the technicians, access tested and three extra agents for the first three weeks of each term. The first term start brought 3,400 requests in three weeks, with an average phone wait of 2 min 40 s.

The results

median first response time
11 min
Before: 1 day and 6 hours
of requests resolved on first contact
74%
Before: 52%
password tickets, thanks to self-service
−81%
satisfaction, across 2,900 responses in the first term
4.6 / 5

How we measured it: data from the ticketing and phone systems, plus a one-question survey sent when each ticket is closed.

What we would do differently

In the first week, 30% of calls were about Wi-Fi access for new students. A help page shown directly on the sign-in portal would have prevented them: it is now in place for every term start.

Back to all eight cases

Retail2026

86 stores modernized overnight, without a single late opening

A chain of hardware and sporting goods stores was replacing its checkouts and store networks, with one night per location and never during the holiday season.

The starting point

The checkouts were nine years old, each store’s network relied on a consumer-grade router and an unmanaged switch, and the payment terminals supplied by the retailer’s acquirer had to be replaced before their certification expired. The retailer wanted a standard store: same hardware, same configuration, same support process.

What made it hard

  • Change freeze from November 15 to January 10 for the holiday season.
  • A single night per store, between closing at 9 p.m. and staff arriving at 7 a.m.
  • PCI DSS requirements: payment network isolated from the rest of the store.
  • Remote stores in Abitibi, the Gaspé Peninsula and Northern Ontario, several hours’ drive away.

What we did

  1. Discover

    Visits to 6 representative stores and design of a standard store: network, checkouts, printers, payment terminals and phones.

  2. Recommend

    HP Engage One Pro checkouts, a remotely managed Cisco Meraki network (firewall, switches, Wi-Fi) with an isolated payment segment, and checkouts managed in Intune.

  3. Deploy

    Kits staged and tested in our warehouse, labelled by checkout and delivered the day before. Four night teams, a rollback procedure and a real test transaction before leaving each store.

The results

stores cut over in 19 weeks
86 / 86
Average of 6 h 40 per night
of stores finished on the first night
94%
5 stores required a second visit
checkout-related tickets in the first month
−58%
Compared with the previous 6-month average
of payment terminals on an isolated network, validated by the compliance lead
100%

How we measured it: each store’s cutover log, the retailer’s ticket log and Meraki dashboard reports.

What we would do differently

The five stores that needed a second visit had undocumented cabling behind the counters. We now require photos of counters and wiring closets, taken by the store manager two weeks before the scheduled night.

Back to all eight cases

Manufacturing2025

Three plants segmented without stopping a single production line

A metal and plastic parts manufacturer no longer knew exactly what was connected to its plant networks, and 23 machine vendors were accessing them remotely, each in its own way.

The starting point

The plant network was flat: controllers, operator stations, cameras and office computers shared the same space. The client estimated it had about 600 industrial devices. Seven production stoppages in 2024 had been traced to the network, including ransomware stopped just in time on an office computer. The insurer and two automotive customers were demanding a segmentation plan.

What made it hard

  • Production 24 hours a day, five days a week: outages only during planned shutdowns.
  • Machines whose vendors forbid any change, or the warranty is void.
  • Operator stations running Windows 7 and Windows XP that cannot be updated.
  • Plant safety rules: lockout, protective equipment and escort by maintenance staff.

What we did

  1. Discover

    Passive traffic monitoring with Cisco Cyber Vision for four weeks in each plant, changing nothing, to inventory every device and every flow.

  2. Recommend

    Fourteen zones based on the ISA/IEC 62443 model: industrial switches, firewalls between zones and a single controlled, logged remote access path for all vendors.

  3. Deploy

    Zone-by-zone cutover during weekend shutdowns and the two-week July shutdown, with plant maintenance at every step.

The results

industrial devices inventoried
1,140
The client estimated about 600
isolated zones, with a written rule for every flow between them
14
single remote access path for vendors, logged and approved case by case
1
Before: 23 different tools
network-related production stoppages in 8 months
0
Versus 7 in 2024

How we measured it: the Cyber Vision inventory, the plant’s production stoppage log and the remote access register.

What we would do differently

Two older machines only worked with fixed IP addresses written into their programs. They had to be isolated as-is in their own zone. We now look for this kind of dependency during the inventory, with the machine vendor on the phone.

Back to all eight cases

Professional Services2026

A Microsoft bill cut by 19%, Copilot included

A business law firm was renewing its Microsoft agreement and wanted to try Copilot without paying for idle licences.

The starting point

The firm was paying for 337 Microsoft 365 E5 licences for about 290 people. Its Enterprise Agreement was coming to term and would not be renewed in the same form. The partners also wanted to know whether Copilot was worth its price for drafting and research, without committing the whole firm blindly.

What made it hard

  • Professional secrecy: no matter document could become visible to unauthorized people, through Copilot or otherwise.
  • Document retention and legal hold obligations for litigation.
  • Very busy partners: training limited to 45 minutes per person.
  • A decision required before the agreement’s anniversary date.

What we did

  1. Discover

    Analysis of 180 days of actual usage in the admin centre and sign-in logs: 47 E5 licences assigned to inactive accounts (departures, students) and 112 people using only E3 features.

  2. Recommend

    Move to an annual subscription with Avatec as Cloud Solution Provider (CSP): E5 for lawyers who need the compliance tools, E3 for support staff, and a 60-licence, 90-day Copilot pilot.

  3. Deploy

    Before the pilot, 1,900 overshared sites and folders were corrected. Small-group training, weekly usage tracking and a survey at the end of the pilot.

The results

on the annual Microsoft bill, Copilot included
−19%
inactive licences removed in the first month
47
pilot participants still active three days a week after 90 days
38 / 60
The firm kept those 38 licences
time to produce a first draft, according to participants
−30%
Self-reported in a survey, not timed

How we measured it: Microsoft 365 and Copilot usage reports, invoices before and after, and a survey of the 60 pilot participants.

What we would do differently

Fixing overshared content took three weeks longer than planned and delayed the pilot. We now start it during the licensing analysis, since it has to be done either way.

Back to all eight cases

Public Sector2025

186 virtual servers moved and a first real disaster recovery test

A mid-sized city received a sharply higher renewal offer for its virtualization platform, while its two server rooms had never been put to the test of a disaster.

The starting point

The city’s 186 virtual servers ran in two rooms: city hall and the public works garage. The servers were reaching end of warranty, the virtualization licence renewal proposal came to nearly three times the previous cost, and no recovery test had ever been done. Property assessment, payroll, the municipal court and public works dispatch all depended on them.

What made it hard

  • Online citizen services available at all times: migrations only at night and on weekends.
  • Municipal software licensed to the server it is installed on.
  • Municipal contract award rules: hardware acquired through a public tender.
  • A six-person IT team, also responsible for employee support.

What we did

  1. Discover

    Inventory of the 186 virtual servers, their dependencies and their importance to citizen services, validated with each department.

  2. Recommend

    Hyper-V clusters on Windows Server 2025 running on HPE ProLiant servers with HPE Alletra storage, backups in an immutable Azure vault and recovery in Azure for the 22 essential applications.

  3. Deploy

    Migration in 14 waves, at night and on weekends, followed by a full recovery test: essential applications failed over to Azure, then back.

The results

virtual servers migrated in 12 weeks
186 / 186
No unplanned outages
annual cost compared with the renewal proposal
−31%
Hardware, licences and cloud services included
to restart the 22 essential applications during the test
4 h
Before: never tested
of backups copied off-site to an immutable vault
100%

How we measured it: the migration log, the recovery test report signed by the IT director and a five-year annualized cost comparison.

What we would do differently

Three municipal applications required a new licence key after the server change, and one vendor took a month to provide it. We now request these keys six weeks before migration.

Back to all eight cases

Confidentiality

Why we don’t name our clients

Our service agreements almost always include a confidentiality clause, and describing the infrastructure or security of an identifiable organization would expose it. Names are therefore removed; size and region are rounded or broadened. Constraints, steps and results are described as they were measured.

  • Names removed, profiles rounded
  • Results taken from measurement tools
  • Setbacks and lessons included
  • More detail in a meeting

Frequently asked questions

Answers to the questions we hear most often.

Why don’t you name your clients?

Most of our engagements are covered by a confidentiality agreement, and describing the network or security of an identifiable organization would expose it. We remove names and round size and region; everything else is described as is.

Where do the numbers come from?

From the tools used during the engagement: Microsoft consoles, network dashboards, ticket logs and migration logs. When a result comes from a survey rather than a measurement, we say so.

Can you deliver a similar engagement for us?

Yes. Each of these engagements started with a discovery call to understand the environment and constraints. We then propose an approach, its cost and its timeline before starting.

Do you work across Quebec and Ontario?

Yes. Our Québec City, Montréal, Toronto and Ottawa offices coordinate the teams, and our technicians travel to the regions, as far as Abitibi, the Gaspé Peninsula and Northern Ontario.

A similar challenge?

Let’s talk about your next project.

Tell us your starting point and constraints: an advisor will propose an approach, its cost and its timeline.

Contact us

Let’s talk

Tell us what you want to achieve. An advisor will get back to you to schedule a first conversation.

Would you rather talk to someone?1-855-339-9543