Critical infrastructure, delivered

Why are your case studies anonymised?

Because in the banking and public sectors, disclosing that an organization has run a security programme is itself exploitable information. Anonymisation is our clients’ requirement, not commercial reticence. The scopes, constraints and results remain accurate.

That reserve has a consequence we accept: at this stage of your thinking, you have to take our word for it. This is why we provide named references on request, confidentially, at an advanced stage of discussion, and why we arrange introductions to a comparable client when that client consents.

The figures in these cases come from our own engagement measurements. They are assertions by RISS Canada, verifiable with the clients concerned under a confidentiality agreement, and not data published by an independent third party. We prefer to say so rather than let the opposite be assumed.

How do you document an engagement?

In three systematic parts: the initial state as found, the architectural decisions with their trade-offs, then the measured results. This structure is not a communications exercise: it is what lets a client justify their investment to a board, an auditor or a regulator.

• The initial state. A factual survey of the environment before intervention, including the assets the organization did not know it was exposing. Without that baseline, no result is demonstrable afterwards.
• The architectural decisions. What was chosen, what was ruled out, and on what grounds. We document the options not taken, because that record is what prevents the debate reopening in two years with no memory of the constraints of the time.
• The measured results. Compared against the initial state, on indicators defined before work started rather than chosen at the end to flatter the outcome.

What have you delivered in the banking sector?

Two engagements. A Zero Trust segmentation of a national network core carrying twenty years of growth, delivered without service interruption. And AI-assisted monitoring on critical infrastructure where incidents were reported by users before the technical teams noticed them.

• Zero Trust segmentation of a national banking network. A flat network core where one compromised endpoint could reach the payment systems. Complete flow mapping, definition of trust zones, then a wave-by-wave cutover with a validated rollback window at every step. Result: payment systems isolated, full traceability of cross-zone access, audit file delivered to the regulator, no service interruption during the migration.
• AIOps monitoring on critical infrastructure. Thousands of daily alerts were drowning the real signals. Automated event correlation, thresholds learned from actual network behaviour, service-oriented dashboards. Result: alert noise sharply reduced, detection ahead of user impact, incidents down 35% year over year.

And in the public sector and industry?

A multi-site WAN migration for a public agency, carried out outside public service hours. And an OT/IT convergence in a plant, where production terminals were losing their link in heavily steel-framed zones and causing line stoppages.

• Multi-site WAN migration for a public agency. Heterogeneous links, end-of-life carrier contracts, no central visibility on actual site availability. A single target architecture, site-by-site migration outside service hours, central monitoring deployed ahead of cutover. Result: link costs reduced, unified monitoring, no interruption to citizen services, more than 40 sites migrated in 9 months.
• High-density Wi-Fi and OT/IT convergence in a plant. Connected forklifts and production terminals were dropping their link in metal-framed zones. On-site coverage survey, access-point resizing, OT network segmentation and a full connected-asset inventory. Result: network-related line stoppages eliminated, OT networks isolated from office IT, industrial asset inventory kept current, 99.9% coverage across the site.

What do these methods produce for a smaller business or a non-profit?

The same principles, at a different scale and under a tighter budget constraint. In both cases below, the main gain came not from a purchase but from enabling what already existed and prioritising by real risk.

• Full SIRIS rollout at an 85-employee manufacturer. No formal security policy, untested backups, compliance requirements discovered during a client tender. Assessment, activation of security features already included in existing licences, organization-wide multi-factor authentication, supervised backups, processing register. Result: Law 25 compliance documented, disaster recovery tested, client tender won.
• Technology standards upgrade at a non-profit. Aging equipment, a fixed grant-funded budget, no internal IT resource. Replacements prioritised by risk, equipment chosen for controlled total cost, knowledge transfer to an internal owner. Result: endpoints and network renewed, a self-sufficient internal owner, granted budget respected in full.