Aventura, Florida · serving clients across the United States (305) 404-9404Toll-free (800) 767-8566Emergency? Get a call within 1 hour
CLAYTONCYBERNETICS
Public relations

Five years of bi-coastal IT, through to acquisition

One of the largest PR agencies in New York and Santa Monica, a leader in its segment.

Scale
40 employees, New York & Santa Monica
Engagement
5+ years, until its acquisition by a larger firm

The challenge

Client confidentiality is the product of a PR firm; its email and files had to be secure and always available on both coasts.

A PR agency's most sensitive material is its clients' unannounced news. Email and file security were therefore treated as core to the business, and the same enterprise mail architecture used in larger deployments protected both offices.

Five years of continuous service ended only when a larger firm acquired the agency, which is the kind of transition a well-documented environment makes easier.

What our team delivered

  • Email servers on our enterprise mail architecture
  • Workstations, backups and security
  • Full management of both offices

Result

Served continuously for more than five years, until the agency was acquired by a larger firm.

DMARC: from watching to rejecting

Share of mail claiming the domain that passes DMARC (SPF or DKIM aligned), week by week. In the monitoring phase (p=none) reports reveal forgotten senders; each one gets SPF and DKIM fixed. Quarantine sends failures to spam, reject refuses them at the receiving server. Illustrative figures.

DMARC: from watching to rejectingLine chart over 12 weeks. DMARC pass rate climbs from 61 percent in week 1 to 78 percent at the end of the p=none phase, 94 percent at the end of p=quarantine, and 99.1 percent in week 12 under p=reject.DMARC pass rate, 12 weeksp=nonemonitor onlyp=quarantinefailures to spamp=rejectfailures refused50%60%70%80%90%100%W1W2W3W4W5W6W7W8W9W10W11W1261%78%94%99.1%Week number on the x axis. Pass rate is measured on aggregate (rua) reports.

Mail that keeps flowing

Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.

Mail that keeps flowingDiagram of enterprise email flow. Inbound mail from an internet sender reaches the MX edge server running Postfix, where SPF, DKIM and DMARC checks light up in sequence, then passes a spam and malware filter; a spam message is diverted to quarantine. Clean mail is delivered to a mailbox cluster, a database availability group with copies in three regions. On a loop the active server in region A fails and the copy in region B activates automatically, so the next message is still delivered. Outbound mail from the user's mailbox is DKIM-signed and sent over an encrypted TLS connection to the recipient. INBOUNDOUTBOUNDSenderInternetMX edgePostfixSPFDKIMDMARCThreat filterSpam · malwareQuarantineMAILBOX CLUSTER · DAGRegion ARegion BRegion CActiveCopyActiveCopyMailboxUser inboxDKIM signingTLS encryptedRecipientSPFDKIMDMARCSPFDKIMDMARCOffline

Every sign-in, verified

Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.

Every sign-in, verifiedDiagram of user authentication. A user signs in; the device is checked for MDM and Intune compliance; the identity provider, Active Directory or Entra ID, verifies the account; an MFA push is approved on the user's phone; conditional access evaluates the policy; and access is granted to email, ERP and files. On a second pass, a sign-in from an unknown device in a new location is blocked by the conditional access policy. VERIFIED SIGN-INUserSigns inDevice checkMDM · IntuneIdentityAD · Entra IDMFA pushPhone approvalConditionalaccessPolicy checkEmailERPFilesUnknown deviceNew locationApprove?Blocked

All case studies

Facing something similar?

Tell us about your environment. We will tell you plainly what we would do and what it would take.

Book a free assessmentTalk to our team

Frequently asked questions

Direct answers to the questions we hear most. Something else on your mind?

Send us a message
How was client confidentiality protected?

Confidentiality is the product of a PR firm, so its email and files had to be secure and always available on both coasts. We ran its email servers on our enterprise mail architecture, with workstation management, backups and security. We managed both offices fully.

How long did the engagement last?

More than five years, continuously, until a larger firm acquired the agency. The agency had 40 employees in New York and Santa Monica.

Which offices were covered?

Both the New York and Santa Monica offices, managed as one environment. That included workstations, backups and security.

Do you know if your company is safe?

Speak with a security engineer today. The first assessment call is free and confidential.

Book a free assessment Book a time Call (305) 404-9404
CallFree assessment