Case studies
Banking, government, industry, SMBs and non-profits: an anonymized look at our work.
A flat network core carried twenty years of growth: one compromised endpoint could reach the payment systems.
Full flow mapping, trust-zone definition, then a wave-by-wave cutover with validated rollback windows at every step.
Heterogeneous links, end-of-life carrier contracts and no central visibility on actual site availability.
A single target WAN architecture, site-by-site migration outside public service hours, central monitoring deployed ahead of cutover.
Connected forklifts and production terminals dropped their link in heavily steel-framed zones, causing line stoppages.
On-site coverage survey, access-point resizing, then OT network segmentation and a full connected-asset inventory.
No formal security policy, untested backups, and compliance requirements discovered during a client tender.
Assessment, activation of security features already included in their existing licences, org-wide MFA, supervised backups and a processing register.
Aging equipment, a fixed grant-funded budget and no internal IT resource to run the upgrade.
Replacements prioritized by risk, equipment chosen for controlled total cost, and knowledge transfer to an internal owner.
Thousands of daily alerts drowned the real signals; incidents were reported by users before IT teams saw them.
Automated event correlation, dynamic thresholds learned from actual network behaviour, and service-oriented dashboards.
The projects below are anonymized at our clients' request, but the scopes, constraints and results are real. They share one trait: in each, a service interruption or a data leak would have carried a major direct, regulatory or reputational cost.
We systematically document the initial state, the architecture decisions and the measured results. That is what lets our clients justify their investments to a board, an auditor or a regulator.
Key points
Because in the banking and public sectors, disclosing that an organization has run a security programme is itself exploitable information. Anonymisation is our clients' requirement, not commercial reticence. The scopes, constraints and results remain accurate.
That reserve has a consequence we accept: at this stage of your thinking, you have to take our word for it. This is why we provide named references on request, confidentially, at an advanced stage of discussion, and why we arrange introductions to a comparable client when that client consents.
The figures in these cases come from our own engagement measurements. They are assertions by RISS Canada, verifiable with the clients concerned under a confidentiality agreement, and not data published by an independent third party. We prefer to say so rather than let the opposite be assumed.
In three systematic parts: the initial state as found, the architectural decisions with their trade-offs, then the measured results. This structure is not a communications exercise: it is what lets a client justify their investment to a board, an auditor or a regulator.
Two engagements. A Zero Trust segmentation of a national network core carrying twenty years of growth, delivered without service interruption. And AI-assisted monitoring on critical infrastructure where incidents were reported by users before the technical teams noticed them.
A multi-site WAN migration for a public agency, carried out outside public service hours. And an OT/IT convergence in a plant, where production terminals were losing their link in heavily steel-framed zones and causing line stoppages.
The same principles, at a different scale and under a tighter budget constraint. In both cases below, the main gain came not from a purchase but from enabling what already existed and prioritising by real risk.
The results on this page are internal measurements by RISS Canada Inc., taken on real engagements and compared against a documented initial state. They describe what was achieved in a given context and constitute neither a guarantee nor a forecast for any other context.
Yes, on request and confidentially, at an advanced stage of discussion. We do not publish names because in the banking and public sectors, disclosing the existence of a security programme is itself sensitive information, and our clients ask for that reserve. It is a frequent and legitimate request from a buyer: we handle it systematically before contracting, though never before understanding your context.
Yes, when the client concerned consents and your context is comparable in sector and size. It is often more useful than a list of logos: an executive at a manufacturing business gets answers from a counterpart that no brochure will give, particularly about how the work actually unfolded and what was difficult. We arrange these conversations without attending them where that is preferable.
It varies widely, deliberately. At one end, a one-off assessment for an organization of about fifteen people. At the other, a network core segmentation running several months with negotiated cutover windows. What our engagements have in common is not their size but their criticality: in each, a service interruption or a data leak would carry a direct, regulatory or reputational cost far exceeding that of the work.
No, and we say so plainly. These are our own engagement measurements, compared against an initial state surveyed before intervention. They are verifiable with the clients concerned under a confidentiality agreement. We do not present these results as data published by an independent body, and we extrapolate no promise from them: your context will produce its own results, which we will define with you before starting.
It depends on the engagement. Some concluded with a full knowledge transfer to internal teams, with documentation and training, which was the agreed objective. Others continue as managed monitoring or on-call coverage on critical components. Both outcomes are successes from our point of view: an architecture only the firm that built it can operate is a dependency, not a security improvement.
An initial assessment, free and without commitment, to evaluate your security posture.