The challenge
14,000 doors, one key under the mat.
Orbital’s fleet had grown by acquisition: five device-management regimes, inconsistent disk encryption, and service accounts with standing domain-admin rights. Our initial assessment showed that compromising any single laptop could reach production data within four hops.
The board wanted zero-trust — but without halting a company that ships daily.
Approach
Roll out in waves, verify by attack.
Identity
Unified identity first
Phishing-resistant MFA and short-lived credentials replaced standing privileges — service accounts included — before a single agent was deployed.
Segment
Micro-segmentation in waves
Device classes moved in staged waves with automatic rollback triggers. Four hops to production became zero routable paths.
Prove
Adversarial acceptance test
We re-ran the original four-hop attack path against the finished estate. It died at the first device — exactly as designed.
Outcome
96% less surface. Zero downtime.
“They think three moves ahead of any attacker we’ve faced. Our detection got faster and my team got their weekends back.”
— Marcus Hale, VP Security, Orbital
How many hops to your production data?
More work: 47-second containment · Verdant hospitals
Keep exploring
More works.
Caught a supply-chain breach in 47 seconds.
Red Team · Aegis Bank · 2025 — behavior-based detection, isolation and rollback with zero loss.
View case →Zero-trust across 14,000 endpoints in 30 days.
Pentest · Orbital · 2024 — unified identity, micro-segmentation and adversarial verification.
View case →Ransomware-proofed 40 hospitals.
Hardening · Verdant · 2024 — clinical segmentation, immutable backups and 24/7 monitoring.
View case →