Your browser could not start the 3D view. The device list and the steps below tell the same story.
78
paths any device could open to another
Alert
00:00
Managed IT, networks and security · Toronto
Kestrel designs, secures and monitors small-business networks across Ontario. This is one store from a 12-location retail chain we rebuilt. Scroll through it, or click any device.
Case study · Retail chain, 12 stores, Ontario
Card terminals, cameras and the back-office PC shared one switch fabric, and remote access ran on shared VPN passwords. We assessed 3 reference stores, then rolled the new design out to all 12 on staggered nights.
01 · The store
Two checkout lanes, four cameras and a recorder, a cooler sensor, a door sensor, a smart lock on the back door, the staff Wi‑Fi and one back-office PC. Every cable ends at the same switch in the back-office rack. Each red line is a path one device could open to another: 78 in total.
02 · Where it broke
03 · What we changed
78 open paths became 11 allowed ones. POS, cameras and IoT, and the back office each got their own VLAN. The firewall allows only the paths a store needs and denies the rest by default. Remote access moved to per-user MFA, and every VPN or POS alert now goes to a named person at the Kestrel NOC.
04 · Same attack, two networks
On the old network the traffic walks from the camera through the switch to the card terminals and the office PC. On the new one the firewall drops it at the edge of the camera zone, and the alert is acknowledged by a person.
05 · Result
Overnight “who do we call” incidents stopped. The IT lead gets one thread with the root cause instead of vendors pointing at each other.
<15min
Mean time to acknowledge VPN and POS alerts in the first 90 days, down from 2–4 hours after hours
12
Stores moved to segmented VLANs, rolled out on staggered nights
3
Zones per store: POS, cameras and IoT, back office, with deny-by-default rules between them
1
Owner for the rack, the VPN and the escalation path
“Our old MSP blamed the firewall vendor. Kestrel owned the rack, the VPN and the escalation path end to end.”
One team for the network, the security around it and the people who answer when it breaks.
Switching, Wi‑Fi and VLANs planned per site, so tills, cameras and staff devices never share a segment. Rollouts after closing time.
One login per person, a second factor on every remote session, tested backups and a firewall rule audit you can read.
VPN, POS links and firewalls watched by our NOC. Every alert goes to a named engineer, not a queue.
Cameras, recorders, door sensors and smart locks installed on their own zone, with no route to the tills.
| Site | VPN | POS link | Latency |
|---|---|---|---|
| Store 04 · Mississauga | Up | Up | 18 ms |
| Store 07 · Oakville | Up | Degraded | 96 ms |
| Clinic · Yorkville | Up | n/a | 22 ms |
| Store 11 · Barrie | Up | Up | 31 ms |
| Office · Liberty Village | Up | n/a | 9 ms |
Monthly, per site. Setup is quoted after the assessment.
$190/ site / month
$390/ site / month
What most store chains choose
$520/ site / month
Tick what is true today. It takes thirty seconds and nothing leaves this page.
Founded in Toronto in 2014. Eighteen engineers, one NOC, and a rule that every client knows who to call.
Tell us how many sites you run. Dana or Marc will call you within one business day to set up the assessment. This is a demo: the form does not send anything.