Engineering Case Studies
Long-form architecture write-ups from our engineering team — reference designs for secure, regulated, and AI-driven systems, at the depth we build them. Capability, not client name-drops: no confidential details, no invented numbers.
A Defence Architecture for Prompt Injection and Tool Abuse in LLM Agents
How to contain an LLM agent that reads untrusted content and calls tools, so a poisoned document or web page can't hijack its actions.
Software Supply-Chain Integrity: SLSA Provenance and Signing
A reference architecture for build provenance, hermetic builds, and cryptographic signing that makes a tampered artifact detectable before it reaches production.
A Zero-Downtime Secrets Management and Rotation Architecture
How to design a secrets platform where every credential is short-lived, every access is attributable, and rotation never causes an outage.
Architecting a Threat-Detection and Alerting Pipeline for a SOC
How to design a detection-and-alerting pipeline that turns noisy telemetry into triage-ready alerts a SOC can actually act on, without drowning analysts.
Multi-Tenant Isolation Architecture for a SaaS Platform
How tenant boundaries are designed to survive a compromised neighbor: pooled infrastructure with enforced isolation, scoped keys, and contained blast radius.
Designing a Passwordless Authentication System with WebAuthn and Passkeys
How we architect passwordless login: WebAuthn/FIDO2 credential flows, passkey sync trust boundaries, recovery paths, and the failure modes teams underestimate.
Zero-Trust Network Segmentation for a Regulated Cloud Workload
How we replace a flat, perimeter-trusted VPC with identity-based microsegmentation, policy-as-code enforcement, and tamper-evident audit trails for regulated workloads.
Data-Protection Architecture for Clinical Research
How sensitive clinical and research data is architected for least-privilege access, layered encryption, tamper-evident audit trails, and GxP/HIPAA/GDPR-style regulatory alignment.
Email Security and Anti-Phishing Architecture
How SPF, DKIM and DMARC, gateway filtering, business-email-compromise defenses, and awareness training combine into a layered anti-phishing architecture for a professional-services firm.
OT/ICS Security Architecture for a Smart Factory
How a smart-factory floor is segmented into IEC 62443 zones and conduits, given protocol-aware monitoring and brokered remote access, without pretending the plant can be patched like IT.
PCI DSS Forensic Investigation Architecture
How a PFI-style payment-card investigation is architected: evidence preservation, chain of custody, cardholder-data-environment scoping, and a defensible workflow that survives scrutiny.
Pre-Launch Security Architecture Review for a Mobile Banking App
How a mobile banking app is threat-modeled, hardened against a hostile device, and made pen-test-ready before launch — treating the client as untrusted and the backend as the real boundary.
Ransomware Containment for a Multi-Site Network
How we architect rapid segmentation, blast-radius limiting, identity lockdown, and EDR isolation to stop ransomware spreading across many sites — the hospitality multi-site pattern, generically.
Ransomware Recovery and Resilience Architecture
How we design detection, isolation, immutable backups, and clean-room rebuild so a network like a school district's can recover from ransomware without paying and without guessing.
Security Architecture and Audit Methodology for a Cross-Chain Bridge
How a cross-chain bridge's trust model, validator/relayer set, and replay defences are architected and audited — treating the bridge as the highest-value target in DeFi.
Security Architecture for a Fleet Management / Telematics Platform
How a telematics platform is architected for device identity, signed OTA updates, API hardening, and tenant isolation when the endpoints are vehicles you cannot physically trust.