Aventura, Florida · serving clients across the United States (305) 404-9404Toll-free (800) 767-8566Emergency? Get a call within 1 hour
Financial services

A major financial institution moved off Windows to Omarchy and open-source office tools

A major financial institution, a leader in its segment.

Scale
Operating system and office suites replaced, no loss of productivity
Engagement
Migration planning, rollout and support

The challenge

Operating-system and office-suite licences were a recurring cost on every desk, and the institution wanted more control over its endpoints without slowing its people down.

What our team delivered

  • Migrated workstations from Windows to Omarchy, a modern Arch Linux-based desktop
  • Replaced the commercial office suites with open-source equivalents
  • Mapped every daily task to its open-source replacement before the switch, and trained staff on it
  • Security, identity and device management carried over to the new platform

Result

Operating-system and office-suite licence fees eliminated, with no loss in productivity.

Attack it before attackers do

Our red team probes your systems the way a real attacker would, and every weakness it finds becomes a fix your defenders put in place and we retest.

Attack it before attackers doDiagram of offensive versus defensive security. On the left, the red team runs reconnaissance, an exploit attempt and a lateral movement attempt against your systems in the centre. On the right, the blue team detects the activity through a SIEM and EDR alert, contains the affected host and patches the weakness. The lateral movement attempt is blocked once the host is contained. A loop along the bottom shows findings becoming fixes and then being retested. Offensive (red team)Defensive (blue team)1ReconScan and map2Exploit attemptTest weak points3Lateral movementTry to spread1DetectSIEM · EDR alert2ContainIsolate the host3PatchClose the gapYour systemsTested and hardenedEvery finding becomes a fix, then a retestFindingsFixesBlocked

Every sign-in, verified

Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.

Every sign-in, verifiedDiagram of user authentication. A user signs in; the device is checked for MDM and Intune compliance; the identity provider, Active Directory or Entra ID, verifies the account; an MFA push is approved on the user's phone; conditional access evaluates the policy; and access is granted to email, ERP and files. On a second pass, a sign-in from an unknown device in a new location is blocked by the conditional access policy. VERIFIED SIGN-INUserSigns inDevice checkMDM · IntuneIdentityAD · Entra IDMFA pushPhone approvalConditionalaccessPolicy checkEmailERPFilesUnknown deviceNew locationApprove?Blocked

Separate by region and by business unit

Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.

Separate by region and by business unitA grid with three regions, Americas, EMEA and APAC, and three business units, Finance, Retail and R&D. Each cell is a separate VRF with its own VLAN and VNI. Each business unit has one overlay running across its three regional cells, shown as a row. On the right a firewall zone enforces a zero-trust policy that denies by default. A red packet from Retail trying to reach Finance is blocked at the firewall. A teal packet from R&D to the shared DNS and identity services is allowed. AMERICASEMEAAPACFinanceVRF fin · VLAN 110VNI 10110VRF fin · VLAN 110VNI 10110VRF fin · VLAN 110VNI 10110RetailVRF retail · VLAN 120VNI 10120VRF retail · VLAN 120VNI 10120VRF retail · VLAN 120VNI 10120R&DVRF rnd · VLAN 130VNI 10130VRF rnd · VLAN 130VNI 10130VRF rnd · VLAN 130VNI 10130Firewallzoneszero trustdeny bydefaultSharedDNS · IdPdenyallowVRF · L3 isolationVLAN to VNI · L2Default-deny policyEVPN-VXLAN fabricWireGuard + IPsec WANLogs to one SIEM

Frequently asked questions

Direct answers to the questions we hear most. Something else on your mind?

Send us a message
What did the migration replace?

Workstations moved from Windows to Omarchy, a modern Arch Linux-based desktop, and the commercial office suites were replaced with open-source equivalents. The goal was to remove recurring licence costs on every desk and gain control over endpoints. Licence fees were eliminated with no loss in productivity.

How was productivity protected during the switch?

We mapped every daily task to its open-source replacement before the switch and trained staff on it. That mapping meant nobody lost a function on the day of cutover.

Did security controls change?

Security, identity and device management carried over to the new platform. The case lists them as part of the migration scope, not as separate follow-up work.

Do you know if your company is safe?

Speak with a security engineer today. The first assessment call is free and confidential.

CallFree assessment