# Clayton Cybernetics

> Clayton Cybernetics is an American cybersecurity company. We find out whether your networks, devices, data, web apps, APIs and code are safe from attackers, and fix what we find.

Slogan: American-made Super Intelligence
Location: Aventura, FL 33180, United States
Phone: (305) 404-9404 · Toll-free: (800) 767-8566 · Fax: (305) 404-7404
Leadership: Christopher Clayton (Chief Executive Officer, christopher@claytoncyber.com); Steve Gates (Chief Technology Officer, steve@claytoncyber.com); Anthony Sousa (Chief Financial Officer, anthony@claytoncyber.com)
Billing and invoices: anthony@claytoncyber.com
Service area: United States, Aventura, South Florida, Worldwide (remote)

## Key facts
- 100+ organizations have trusted our team with their infrastructure
- 99.99% uptime on all Clayton Redundant Infrastructure-contracted projects
- 15 min response time to every message from a paying client
- AI partner partner of a leading US AI company, fluent across all major AI platforms
- Paying clients receive a response to every message within 15 minutes.
- Thousands of organizations worldwide notified of vulnerabilities by our researchers
- 100,000+ mailboxes on an enterprise email platform our team designed and operates
- 4 hours to apply Microsoft security patches on that platform after release
- Since 4.0 Microsoft Exchange experience, from Exchange 4.0 to Exchange Server Subscription Edition
- Specialty: regulated operations — banks, investment advisers, broker-dealers and other SEC-supervised organizations.

## Track record (clients unnamed)
- One company in fourteen countries, with separate networks by region and business unit and zero downtime: A multinational manufacturer and distributor operating in 14 countries, a leader in its segment. Every region and business unit on its own network, with blast radius limited to one segment, VLANs that move between datacenters while the servers keep their addresses, and internet edges that withstood a synthetic flood test. All of it cut over with zero downtime.
- The technology behind a coworking pioneer's first five New York buildings: A New York coworking pioneer that grew into the world's best-known flexible-workspace brand and a leader in its segment. Our team worked side by side with its founders from 2009. More than 10,000 members across five buildings, and the experience our team then used to create two of Brazil's leading coworking centers.
- A petabyte of storage for a 150 TB risk database, live in two data centers: A balance-sheet risk analytics firm that serves banks and financial institutions, with models for interest-rate risk, net interest income and valuation. A leader in its segment. A database of more than 150 TB running live in two places at once, with tested backups on three retention tiers and no single point of failure from the firewall to the power supply. The same team carried the firm through SOC 2 and its other required certifications.
- Ten years running the U.S. offices of one of South Korea's largest companies: One of South Korea's largest conglomerates and a leader in its segments, with a trading office in New York and a venture-capital office in San Francisco. A decade of continuous operation for both offices, with security findings escalated to headquarters ahead of problems.
- A law firm replaced its legal software with its own and stopped paying licence fees per user: A 50‑person law firm, a leader in its segment, running an outdated, paid legal practice-management product. About $100 per employee per month in licence fees eliminated, roughly $5,000 a month for 50 people, with software that fits each department far better than the product it replaced.
- A nationwide dental group on its own open-source platform, with drivers we wrote for its imaging hardware: A dental organization with a nationwide presence, a leader in its segment, handling patient records and diagnostic images under HIPAA. Imaging devices that work with current systems, a practice platform built around the group's own workflows, and an open-source foundation it owns.
- A major financial institution moved off Windows to Omarchy and open-source office tools: A major financial institution, a leader in its segment. Operating-system and office-suite licence fees eliminated, with no loss in productivity.
- A weaving factory got its own software and live data from every machine: A textile weaving company, a leader in its segment, running five separate, outdated software products (ERP, machine management and more) with no live monitoring of its machines. Millions of dollars saved in software and production costs within a single year, and custom software the company owns outright.
- A 100,000-mailbox Exchange platform across three regions: An email provider that hired our team to build its in-house Microsoft Exchange infrastructure. The same architecture, at a smaller scale, now protects the email of the conglomerate, PR agency and consultancy described on this page.
- From 10 to 500+ employees, fully managed for twelve years: One of Brazil's largest AI angel investors, a leader in its segment. Twelve years of fully managed growth, from the first office to a three-building operation.
- Two floors, 100+ people, every system in one hand: A leader in online technology education. One accountable team for every physical and digital system on both floors.
- Five years of bi-coastal IT, through to acquisition: One of the largest PR agencies in New York and Santa Monica, a leader in its segment. Served continuously for more than five years, until the agency was acquired by a larger firm.
- One team for three countries: A global sustainability consulting and standards firm operating in three countries, a leader in its segment. Everything from workstations to the phone system, and from backups to the help desk, managed by one team.
- A hospital network that keeps clinical systems, medical devices and guests apart, and logs everything: A regional hospital group in the southeastern United States, a leader in its segment. Medical devices contained in their own segments, a network that identifies what is plugged in before it grants access, and one searchable audit trail that answers who and what touched which system and when. In the modeled engagement, the 12,000+ devices were profiled and placed into segments over nine months, clinic-by-clinic cutovers ran in overnight windows with a rollback plan, and unmanaged devices that could not authenticate were contained in restricted segments with a written exception and an owner. Failover of the redundant core was tested during rollout, and the audit trail retained events long enough to answer an investigation after the fact.
- A 100G colocation built for microseconds: PTP time, kernel-bypass and no surprises: A systematic hedge fund in New York and New Jersey, a leader in its segment. A repeatable, measured path in which the median time from wire to application is in the low microseconds, clocks agree to well within a microsecond, and every packet can be replayed with a trustworthy timestamp. The modeled build was commissioned in stages: cross-connect and fiber lengths were fixed and documented, clock offset between sites was measured continuously against the GNSS reference, and latency was tracked as a distribution (median, 99th and 99.99th percentile) rather than an average. Changes to the trading path went through a staging replica first, and a replayed capture reproduced any disputed order sequence with its original timestamps.
- Anycast DNS and edge for a SaaS company, absorbing attacks close to where they start: A business-software company serving customers in North America and Europe, a leader in its segment. DNS answered from the nearest point of presence worldwide, and a 240 Gb/s volumetric attack in testing was absorbed with no customer-visible change. In the modeled design, the nine points of presence announced the same prefixes over BGP with health-checked withdrawal, so a failing site left rotation in seconds. Quarterly drills withdrew a site on purpose, and the 240 Gb/s test was staged with the upstream providers under an agreed window. Escalation ran from XDP filtering at the edge, to FlowSpec and RTBH, to upstream scrubbing, with the 24x7 team following a written runbook.
- 300 stores on one secure fabric: WireGuard SD-WAN with PCI segmentation: A specialty retail chain with stores across the United States, a leader in its segment. Store connectivity that survives the loss of a circuit without anyone noticing, a payment environment small enough to scope and assess clearly, and lower monthly circuit costs than the private carrier network it replaced. In the modeled rollout, a pilot of 12 stores ran for eight weeks before the national wave, then roughly 25 stores a week were cut over with the old carrier circuit kept until each store had held a clean week. Stores failed over between the two paths in seconds, a regional hub could be lost without store impact, and the payment segment was documented as a small, separately assessed scope.
- An ERP and a warehouse that talk to each other: robots, sensors and software on one platform: A third-party logistics company with distribution centers in the southeastern United States, a leader in its segment. Stock levels updated in seconds instead of hours, manual re-keying largely eliminated, and a platform where adding a robot or sensor is configuration rather than a project. In the modeled program, the first building went live after six months as a pilot, the other three followed in sequence over the remaining eight, and the old system ran in parallel until stock counts matched for a full month. Each building's edge server kept scanning and picking during a link outage and synchronized afterward, and exceptions such as a short pick or an out-of-range temperature opened a task automatically.
- Zero-trust access and BEC-proof email for a Los Angeles real-estate group: A real-estate development and brokerage group in Los Angeles County, a leader in its segment. Spoofing of the group’s domain blocked at the mail gateway, staff access that depends on who and what is asking rather than where they sit, and a payment-change process that does not trust an email alone. In the modeled ten weeks, the first two went to mail authentication (monitoring-only DMARC, then quarantine, then reject once legitimate senders were inventoried), the middle weeks to identity-aware access and passkey enrollment for finance and executive staff, and the last to the wire-change procedure and a phishing exercise. The measurable outcomes were a domain that could no longer be spoofed, no shared remote-access passwords, and a call-back record for every changed payment instruction.
- A cross-border payments platform on Kubernetes, with card data sealed by hardware security modules: A cross-border payments company moving money between the United States, Europe and Latin America, a leader in its segment. A card-data environment reduced to one cluster and one tokenization service, keys that cannot be exported from the HSMs, and evidence that is generated by the platform rather than assembled by hand before each assessment. In the modeled migration, the 140 services moved in waves over eleven months, with the tokenization service live first so that every wave reduced the card-data scope instead of growing it. HSM failover and key ceremonies were rehearsed before cutover, the second region carried production load in a game day, and policy-as-code checks blocked a non-compliant deployment before it reached the cluster.
- A campus where 10,000 devices join Wi-Fi 6E securely, and visiting scholars sign in with their home credentials: A private university in the northeastern United States, with residence halls, labs and a teaching hospital partnership, a leader in its segment. A campus network where the sign-in method follows the device rather than a shared password, visitors from other universities connect with the credentials they already have, and a lecture hall of 600 laptops keeps working. In the modeled year, a predictive and on-site survey set the access-point plan, the summer break was used to install in the residence halls and lecture buildings, and the 600-seat lecture hall was load-tested with real laptops before the semester. Certificates reached managed laptops through the existing device management, and the shared passphrase network was switched off only after usage dropped to near zero.
- A broadcaster's studios on an IP network: uncompressed video over 100G, locked to a single clock: A regional television broadcaster in the United States with news, sports and live-event production, a leader in its segment. A facility in which a new studio is a set of leaf switches and fiber rather than a room of coax, a failure on either fabric is invisible to viewers, and every device in the building agrees on the time to within a fraction of a microsecond.
- Fourteen ships, one network: LEO and GEO satellite at sea, 5G in port, and a card-data segment that stays clean: A cruise line operating from US Atlantic and Gulf ports, a leader in its segment. Every ship holds a session through a loss of any one link, port calls offload the bulk of non-urgent traffic, card data sits in a small segment that is simple to scope and test, and the bridge is isolated from everything guests touch.
- A law firm that can be back in under two hours: immutable backups and a tested failover to a second region: A law firm of about 300 attorneys with offices in three U.S. cities, a leader in its segment. In the last full drill the firm ran from the second region in 1 hour 40 minutes, with 11 minutes of data lost, both inside target. Backups are out of reach of an attacker who holds production credentials, and the partners have a measured answer when a client asks about recovery.
- Thirty schools, one managed network: CIPA-filtered, segmented and readable by a three-person IT team: A public school district in the Southeast, a leader in its segment. The district can show a reviewer how filtering, monitoring and segmentation work, every school runs on the same templates, a compromised student device cannot reach the student information system, and the three-person team manages all thirty buildings from one place.
- Images that follow the radiologist: DICOM over encrypted links between fourteen imaging centers: A radiology group with 14 imaging centers and 3 hospital reading rooms, a leader in its segment. Typical CT studies open in seconds rather than minutes, images are encrypted on every link, old modalities are contained rather than replaced, and every study exists in two places, so a failed disk or a failed site does not lose a read.
- One guest network, one payment network: shrinking PCI scope across 38 hotels: A hotel group with 38 properties across the United States and the Caribbean, a leader in its segment. The card-data environment shrank from 38 whole property networks to one payment VLAN per hotel, so the annual assessment covers far less and a compromised guest device has nowhere to go. Streaming to the room TV works, loyalty members connect without a login page, and a failed internet circuit moves the PMS to the second path in about a second.
- Zones, conduits and a one-way wire: separating a utility's control network from the corporate network: A regional electric and gas utility with 140 substations and two control centers, a leader in its segment. There is now no network path from the corporate network into the control zone, and the only path out is one that physically cannot carry traffic back. Operations keep live telemetry in the business systems, the utility has an inventory it can defend, and the isolation drill takes a few minutes.
- Surviving the holiday peak: two CDNs, an origin shield, a WAF and bot management: An online retailer shipping to the United States and Canada, a leader in its segment. At peak, about 95 percent of requests are answered at the edge and the origin sees a small fraction of the load. Bots no longer decide who gets the limited drops, a provider fault moves traffic in about a minute without a page of errors, and checkout stays fast because it is the only part that has to reach the origin.
- Robots that stop dropping off the network: private 5G on CBRS spectrum for a Tier-1 auto plant: A Tier-1 automotive supplier in the Midwest, a leader in its segment. Robots roam between radio cells without dropping their session, so robot connectivity stoppages fell from about 41 a week on Wi-Fi to about 2 on private 5G, and roughly 30 operator hours a week went back to production. Most spindles now report vibration and temperature, final inspection looks at every part instead of a sample, and a new production asset joins the network in an hour instead of days. The figures in this case are modeled, not measured, and the board's segmentation requirement is met by design.
- A frontier-class language model in the bank's own rack: AI for 100 staff without a prompt leaving the building: A regional bank and wealth manager in the Midwest, a leader in its segment. Staff use a local model as their only AI assistant. In our modeled benchmarks a single user sees about 118 tokens per second, and at the busiest hour, with about 32 people generating at once on a node, each still sees about 60, so answers finish faster than anyone can read them. No prompt or document leaves the building. Per token it costs more than a cloud API, and the case says so plainly: the bank bought the cluster because the cloud was not an option for this data.
- Out of the hurricane zone: a 1,000‑person Miami distributor moves from two server rooms to Google Cloud: A consumer-goods importer and distributor in Miami-Dade, about 1,000 employees, a leader in its segment. A storm no longer takes the business down, only the people in the building. Core systems fail over to the second region in minutes and the drill runs every quarter, month-end close shortens because reports read one dataset, and both server rooms are gone. The figures in this case are modeled and illustrative; the lessons are real: order network links first, keep any temporary landing zone temporary and spend as much on people as on platforms.
- Seeing inside the black box: ALM, deposit and CECL models brought in-house at a mid-size US bank: A nationally chartered bank in the Midwest with roughly $7 billion in assets and a treasury team of five. The committee package is ready 6 business days after quarter-end instead of 19, scenarios grew from 9 to more than 40 a quarter, ad-hoc scenarios run the same day, and every parameter and its data lineage are visible to treasury and examiners. The bank's own deposit behavior moved its rate sensitivity noticeably, which it presented to examiners itself. Figures are modeled; the pattern holds: the hard part is behavior, not mathematics, and a parallel run builds trust.
- From empty repository to mainnet in ten days: a market-data platform and post-quantum wallets for a new blockchain: A digital-asset market-data start-up. The reference screen was live and correct from the first block of the new features, with every block and every pending transaction preserved in three regions. The platform runs on a few modest cloud machines, has no exposed servers, calls a person when something is wrong, and was redesigned twice after launch without downtime. Load figures come from the test network and synthetic databases, not production traffic.
- Two colocation sites from empty cages: 40 racks, GPU, storage and compute, built, burned in and handed over: A fast-growing fintech and AI company in the United States, a leader in its segment. Both sites were accepted against a written checklist, production workloads moved over in waves with a rollback ready for each, and the company's own staff operate the rooms with our documentation and a remote-hands contract. Power, rack, server and failure figures are modeled for a build of this kind, not measurements from a client.
- A regional ISP's edge refresh: dual 100G uplinks, BNG, carrier-grade NAT and sub-second failover: A regional fiber and wireless internet provider in the Southeast, a leader in its segment. The edge carried the peak with room to spare, a transit or router failure caused a brief reroute that most subscribers did not notice, the new NAT could answer a log request in minutes, and the team had a runbook for each failure. Subscriber counts and failover times are modeled for a refresh of this kind, not measurements from a client.
- A managed SOC and EDR rollout for a 1,200-endpoint insurer: from alert noise to a clock it can meet: A regional property and casualty insurer in the United States, a leader in its segment. Analysts saw a manageable list instead of a flood, endpoint coverage reached all managed machines, exploited vulnerabilities closed in days rather than weeks, and the insurer could show the board and its examiners a program with owners, evidence and tested response. Counts and times are modeled for an engagement of this kind, not measurements from a client.
- A county government's segmented network and passkeys: from flat to default-deny in two budget cycles: A county government in the United States with a population of several hundred thousand, a leader in its segment. A compromised workstation in one department could no longer reach another, phishing could no longer harvest a usable credential, the commissioners had a one-page view of risk, and the IT team could run the network from templates. Sizes and durations are modeled for an engagement of this kind, not measurements from a client.
- Private 5G on CBRS for a port terminal: remote cranes, yard tractors and scanners on one radio network: A container terminal operator at a US Gulf Coast port, a leader in its segment. The yard had continuous coverage across stacks and berths, handhelds and tractors stayed connected as they moved, and the operator owned a network it could tune and extend. Coverage and latency figures are modeled for a design of this kind, not measurements from a client.
- An Agent Security Review before a wealth manager rolls out Copilot Studio agents: A registered investment adviser in Connecticut with about 90 staff, a leader in its segment. In this illustrative engagement the firm launched with 11 of the 14 planned agents, held three back until their fixes were retested, and kept a written inventory, test report and approval record. The review shows what was found in scope and time, not that the agents are free of vulnerabilities.
- A Texas title company stops a deepfake wire-change request with callback and second-approver controls: A title and escrow company in Texas with about 35 staff, a leader in its segment. In the firm's own past result, a request that came with a convincing video call and a lookalike sender domain was held at the callback step, and about $412,000 never left the escrow account. That is one client's outcome, not a promise: the controls do not detect every deepfake, they make a faked instruction insufficient to move money.
- An AI evidence pack for a healthcare group's insurer renewal and a hospital customer's vendor questionnaire: An outpatient medical group in Arizona with six clinics and about 140 clinicians, a leader in its segment. The group sent the same pack to its broker, its counsel and the hospital, and answered both requests from documents in days rather than by reconstruction. The pack is technical evidence only. It is not insurance or legal advice, and it does not say the group is compliant or covered: the broker, the insurer and counsel draw those conclusions.
- Email a regulated firm can prove: delivered into an Amazon S3 bucket that cannot be deleted or overwritten, with AWS KMS protecting each message's fingerprint: A regulated firm that needed to prove what it sent and received, a leader in its segment. The firm can answer "what did you send or receive, and can you prove it?" from a record that could not be deleted or overwritten during the retention period, with a protected fingerprint to show a message is unchanged. This is technical evidence, not legal advice, and it does not say the firm is compliant with any rule: counsel decides what the firm must retain and for how long. The client is not named.
- Every managed deployment includes: Mobile device management (MDM) and BYOD policy, Backups, tested by restoring them, Firewalls and network segmentation, Managed switches and PoE, Enterprise Wi-Fi access points, Redundant internet circuits, Information security program, Defensive penetration testing.

## Case studies
- [One company in fourteen countries, with separate networks by region and business unit and zero downtime](https://claytoncyber.com/experience/global-network-separation-multinational/): Global manufacturing & distribution. A multinational manufacturer and distributor operating in 14 countries, a leader in its segment. Every region and business unit on its own network, with blast radius limited to one segment, VLANs that move between datacenters while the servers keep their addresses, and internet edges that withstood a synthetic flood test. All of it cut over with zero downtime.
- [The technology behind a coworking pioneer's first five New York buildings](https://claytoncyber.com/experience/coworking-pioneer-new-york/): Coworking & flexible workspace. A New York coworking pioneer that grew into the world's best-known flexible-workspace brand and a leader in its segment. Our team worked side by side with its founders from 2009. More than 10,000 members across five buildings, and the experience our team then used to create two of Brazil's leading coworking centers.
- [A petabyte of storage for a 150 TB risk database, live in two data centers](https://claytoncyber.com/experience/petabyte-storage-financial-risk-analytics/): Financial risk analytics. A balance-sheet risk analytics firm that serves banks and financial institutions, with models for interest-rate risk, net interest income and valuation. A leader in its segment. A database of more than 150 TB running live in two places at once, with tested backups on three retention tiers and no single point of failure from the firewall to the power supply. The same team carried the firm through SOC 2 and its other required certifications.
- [Ten years running the U.S. offices of one of South Korea's largest companies](https://claytoncyber.com/experience/global-conglomerate-us-offices/): Global industrial conglomerate. One of South Korea's largest conglomerates and a leader in its segments, with a trading office in New York and a venture-capital office in San Francisco. A decade of continuous operation for both offices, with security findings escalated to headquarters ahead of problems.
- [A law firm replaced its legal software with its own and stopped paying licence fees per user](https://claytoncyber.com/experience/law-firm-custom-practice-platform/): Legal. A 50‑person law firm, a leader in its segment, running an outdated, paid legal practice-management product. About $100 per employee per month in licence fees eliminated, roughly $5,000 a month for 50 people, with software that fits each department far better than the product it replaced.
- [A nationwide dental group on its own open-source platform, with drivers we wrote for its imaging hardware](https://claytoncyber.com/experience/dental-group-open-source-practice-platform/): Healthcare, dental. A dental organization with a nationwide presence, a leader in its segment, handling patient records and diagnostic images under HIPAA. Imaging devices that work with current systems, a practice platform built around the group's own workflows, and an open-source foundation it owns.
- [A major financial institution moved off Windows to Omarchy and open-source office tools](https://claytoncyber.com/experience/financial-institution-windows-to-omarchy/): Financial services. A major financial institution, a leader in its segment. Operating-system and office-suite licence fees eliminated, with no loss in productivity.
- [A weaving factory got its own software and live data from every machine](https://claytoncyber.com/experience/textile-weaving-factory-automation/): Manufacturing, textiles. A textile weaving company, a leader in its segment, running five separate, outdated software products (ERP, machine management and more) with no live monitoring of its machines. Millions of dollars saved in software and production costs within a single year, and custom software the company owns outright.
- [A 100,000-mailbox Exchange platform across three regions](https://claytoncyber.com/experience/email-provider-exchange-platform/): Email hosting provider. An email provider that hired our team to build its in-house Microsoft Exchange infrastructure. The same architecture, at a smaller scale, now protects the email of the conglomerate, PR agency and consultancy described on this page.
- [From 10 to 500+ employees, fully managed for twelve years](https://claytoncyber.com/experience/venture-investor-brazil/): Venture capital & AI investment. One of Brazil's largest AI angel investors, a leader in its segment. Twelve years of fully managed growth, from the first office to a three-building operation.
- [Two floors, 100+ people, every system in one hand](https://claytoncyber.com/experience/online-education-leader/): Online education. A leader in online technology education. One accountable team for every physical and digital system on both floors.
- [Five years of bi-coastal IT, through to acquisition](https://claytoncyber.com/experience/public-relations-agency/): Public relations. One of the largest PR agencies in New York and Santa Monica, a leader in its segment. Served continuously for more than five years, until the agency was acquired by a larger firm.
- [One team for three countries](https://claytoncyber.com/experience/global-sustainability-consultancy/): Global consulting & standards. A global sustainability consulting and standards firm operating in three countries, a leader in its segment. Everything from workstations to the phone system, and from backups to the help desk, managed by one team.
- [A hospital network that keeps clinical systems, medical devices and guests apart, and logs everything](https://claytoncyber.com/experience/hospital-segmented-clinical-network/): Healthcare. A regional hospital group in the southeastern United States, a leader in its segment. Medical devices contained in their own segments, a network that identifies what is plugged in before it grants access, and one searchable audit trail that answers who and what touched which system and when. In the modeled engagement, the 12,000+ devices were profiled and placed into segments over nine months, clinic-by-clinic cutovers ran in overnight windows with a rollback plan, and unmanaged devices that could not authenticate were contained in restricted segments with a written exception and an owner. Failover of the redundant core was tested during rollout, and the audit trail retained events long enough to answer an investigation after the fact.
- [A 100G colocation built for microseconds: PTP time, kernel-bypass and no surprises](https://claytoncyber.com/experience/hedge-fund-low-latency-colo/): Financial services, trading. A systematic hedge fund in New York and New Jersey, a leader in its segment. A repeatable, measured path in which the median time from wire to application is in the low microseconds, clocks agree to well within a microsecond, and every packet can be replayed with a trustworthy timestamp. The modeled build was commissioned in stages: cross-connect and fiber lengths were fixed and documented, clock offset between sites was measured continuously against the GNSS reference, and latency was tracked as a distribution (median, 99th and 99.99th percentile) rather than an average. Changes to the trading path went through a staging replica first, and a replayed capture reproduced any disputed order sequence with its original timestamps.
- [Anycast DNS and edge for a SaaS company, absorbing attacks close to where they start](https://claytoncyber.com/experience/saas-anycast-dns-edge/): Software as a service. A business-software company serving customers in North America and Europe, a leader in its segment. DNS answered from the nearest point of presence worldwide, and a 240 Gb/s volumetric attack in testing was absorbed with no customer-visible change. In the modeled design, the nine points of presence announced the same prefixes over BGP with health-checked withdrawal, so a failing site left rotation in seconds. Quarterly drills withdrew a site on purpose, and the 240 Gb/s test was staged with the upstream providers under an agreed window. Escalation ran from XDP filtering at the edge, to FlowSpec and RTBH, to upstream scrubbing, with the 24x7 team following a written runbook.
- [300 stores on one secure fabric: WireGuard SD-WAN with PCI segmentation](https://claytoncyber.com/experience/retail-300-store-sdwan/): Retail. A specialty retail chain with stores across the United States, a leader in its segment. Store connectivity that survives the loss of a circuit without anyone noticing, a payment environment small enough to scope and assess clearly, and lower monthly circuit costs than the private carrier network it replaced. In the modeled rollout, a pilot of 12 stores ran for eight weeks before the national wave, then roughly 25 stores a week were cut over with the old carrier circuit kept until each store had held a clean week. Stores failed over between the two paths in seconds, a regional hub could be lost without store impact, and the payment segment was documented as a small, separately assessed scope.
- [An ERP and a warehouse that talk to each other: robots, sensors and software on one platform](https://claytoncyber.com/experience/logistics-erp-warehouse-iiot/): Logistics & distribution. A third-party logistics company with distribution centers in the southeastern United States, a leader in its segment. Stock levels updated in seconds instead of hours, manual re-keying largely eliminated, and a platform where adding a robot or sensor is configuration rather than a project. In the modeled program, the first building went live after six months as a pilot, the other three followed in sequence over the remaining eight, and the old system ran in parallel until stock counts matched for a full month. Each building's edge server kept scanning and picking during a link outage and synchronized afterward, and exceptions such as a short pick or an out-of-range temperature opened a task automatically.
- [Zero-trust access and BEC-proof email for a Los Angeles real-estate group](https://claytoncyber.com/experience/miami-real-estate-zero-trust/): Real estate, Los Angeles. A real-estate development and brokerage group in Los Angeles County, a leader in its segment. Spoofing of the group’s domain blocked at the mail gateway, staff access that depends on who and what is asking rather than where they sit, and a payment-change process that does not trust an email alone. In the modeled ten weeks, the first two went to mail authentication (monitoring-only DMARC, then quarantine, then reject once legitimate senders were inventoried), the middle weeks to identity-aware access and passkey enrollment for finance and executive staff, and the last to the wire-change procedure and a phishing exercise. The measurable outcomes were a domain that could no longer be spoofed, no shared remote-access passwords, and a call-back record for every changed payment instruction.
- [A cross-border payments platform on Kubernetes, with card data sealed by hardware security modules](https://claytoncyber.com/experience/fintech-pci-kubernetes-hsm/): Financial technology. A cross-border payments company moving money between the United States, Europe and Latin America, a leader in its segment. A card-data environment reduced to one cluster and one tokenization service, keys that cannot be exported from the HSMs, and evidence that is generated by the platform rather than assembled by hand before each assessment. In the modeled migration, the 140 services moved in waves over eleven months, with the tokenization service live first so that every wave reduced the card-data scope instead of growing it. HSM failover and key ceremonies were rehearsed before cutover, the second region carried production load in a game day, and policy-as-code checks blocked a non-compliant deployment before it reached the cluster.
- [A campus where 10,000 devices join Wi-Fi 6E securely, and visiting scholars sign in with their home credentials](https://claytoncyber.com/experience/university-802-1x-eduroam-wifi-6e/): Higher education. A private university in the northeastern United States, with residence halls, labs and a teaching hospital partnership, a leader in its segment. A campus network where the sign-in method follows the device rather than a shared password, visitors from other universities connect with the credentials they already have, and a lecture hall of 600 laptops keeps working. In the modeled year, a predictive and on-site survey set the access-point plan, the summer break was used to install in the residence halls and lecture buildings, and the 600-seat lecture hall was load-tested with real laptops before the semester. Certificates reached managed laptops through the existing device management, and the shared passphrase network was switched off only after usage dropped to near zero.
- [A broadcaster's studios on an IP network: uncompressed video over 100G, locked to a single clock](https://claytoncyber.com/experience/broadcaster-st-2110-media-network/): Media & broadcast. A regional television broadcaster in the United States with news, sports and live-event production, a leader in its segment. A facility in which a new studio is a set of leaf switches and fiber rather than a room of coax, a failure on either fabric is invisible to viewers, and every device in the building agrees on the time to within a fraction of a microsecond.
- [Fourteen ships, one network: LEO and GEO satellite at sea, 5G in port, and a card-data segment that stays clean](https://claytoncyber.com/experience/cruise-line-ship-to-shore-sd-wan/): Travel, cruise. A cruise line operating from US Atlantic and Gulf ports, a leader in its segment. Every ship holds a session through a loss of any one link, port calls offload the bulk of non-urgent traffic, card data sits in a small segment that is simple to scope and test, and the bridge is isolated from everything guests touch.
- [A law firm that can be back in under two hours: immutable backups and a tested failover to a second region](https://claytoncyber.com/experience/law-firm-second-region-disaster-recovery/): Legal services. A law firm of about 300 attorneys with offices in three U.S. cities, a leader in its segment. In the last full drill the firm ran from the second region in 1 hour 40 minutes, with 11 minutes of data lost, both inside target. Backups are out of reach of an attacker who holds production credentials, and the partners have a measured answer when a client asks about recovery.
- [Thirty schools, one managed network: CIPA-filtered, segmented and readable by a three-person IT team](https://claytoncyber.com/experience/school-district-cipa-segmented-network/): Education, K-12. A public school district in the Southeast, a leader in its segment. The district can show a reviewer how filtering, monitoring and segmentation work, every school runs on the same templates, a compromised student device cannot reach the student information system, and the three-person team manages all thirty buildings from one place.
- [Images that follow the radiologist: DICOM over encrypted links between fourteen imaging centers](https://claytoncyber.com/experience/radiology-pacs-dicom-wan/): Healthcare, diagnostic imaging. A radiology group with 14 imaging centers and 3 hospital reading rooms, a leader in its segment. Typical CT studies open in seconds rather than minutes, images are encrypted on every link, old modalities are contained rather than replaced, and every study exists in two places, so a failed disk or a failed site does not lose a read.
- [One guest network, one payment network: shrinking PCI scope across 38 hotels](https://claytoncyber.com/experience/hotel-group-guest-wifi-pms-pos-pci-scope/): Hospitality, hotel group. A hotel group with 38 properties across the United States and the Caribbean, a leader in its segment. The card-data environment shrank from 38 whole property networks to one payment VLAN per hotel, so the annual assessment covers far less and a compromised guest device has nowhere to go. Streaming to the room TV works, loyalty members connect without a login page, and a failed internet circuit moves the PMS to the second path in about a second.
- [Zones, conduits and a one-way wire: separating a utility's control network from the corporate network](https://claytoncyber.com/experience/energy-utility-ot-iec-62443-data-diode/): Energy and utilities, regional electric and gas. A regional electric and gas utility with 140 substations and two control centers, a leader in its segment. There is now no network path from the corporate network into the control zone, and the only path out is one that physically cannot carry traffic back. Operations keep live telemetry in the business systems, the utility has an inventory it can defend, and the isolation drill takes a few minutes.
- [Surviving the holiday peak: two CDNs, an origin shield, a WAF and bot management](https://claytoncyber.com/experience/ecommerce-multi-cdn-waf-bot-peak-season/): E-commerce, online retailer. An online retailer shipping to the United States and Canada, a leader in its segment. At peak, about 95 percent of requests are answered at the edge and the origin sees a small fraction of the load. Bots no longer decide who gets the limited drops, a provider fault moves traffic in about a minute without a page of errors, and checkout stays fast because it is the only part that has to reach the origin.
- [Robots that stop dropping off the network: private 5G on CBRS spectrum for a Tier-1 auto plant](https://claytoncyber.com/experience/automotive-plant-private-5g-cbrs/): Manufacturing, automotive supplier. A Tier-1 automotive supplier in the Midwest, a leader in its segment. Robots roam between radio cells without dropping their session, so robot connectivity stoppages fell from about 41 a week on Wi-Fi to about 2 on private 5G, and roughly 30 operator hours a week went back to production. Most spindles now report vibration and temperature, final inspection looks at every part instead of a sample, and a new production asset joins the network in an hour instead of days. The figures in this case are modeled, not measured, and the board's segmentation requirement is met by design.
- [A frontier-class language model in the bank's own rack: AI for 100 staff without a prompt leaving the building](https://claytoncyber.com/experience/bank-sovereign-llm-on-prem-gpu/): Banking, regional bank and wealth manager. A regional bank and wealth manager in the Midwest, a leader in its segment. Staff use a local model as their only AI assistant. In our modeled benchmarks a single user sees about 118 tokens per second, and at the busiest hour, with about 32 people generating at once on a node, each still sees about 60, so answers finish faster than anyone can read them. No prompt or document leaves the building. Per token it costs more than a cloud API, and the case says so plainly: the bank bought the cluster because the cloud was not an option for this data.
- [Out of the hurricane zone: a 1,000‑person Miami distributor moves from two server rooms to Google Cloud](https://claytoncyber.com/experience/distributor-google-cloud-hurricane-migration/): Logistics and distribution, importer and distributor. A consumer-goods importer and distributor in Miami-Dade, about 1,000 employees, a leader in its segment. A storm no longer takes the business down, only the people in the building. Core systems fail over to the second region in minutes and the drill runs every quarter, month-end close shortens because reports read one dataset, and both server rooms are gone. The figures in this case are modeled and illustrative; the lessons are real: order network links first, keep any temporary landing zone temporary and spend as much on people as on platforms.
- [Seeing inside the black box: ALM, deposit and CECL models brought in-house at a mid-size US bank](https://claytoncyber.com/experience/bank-in-house-alm-cecl-models/): Banking, $5–10B US bank. A nationally chartered bank in the Midwest with roughly $7 billion in assets and a treasury team of five. The committee package is ready 6 business days after quarter-end instead of 19, scenarios grew from 9 to more than 40 a quarter, ad-hoc scenarios run the same day, and every parameter and its data lineage are visible to treasury and examiners. The bank's own deposit behavior moved its rate sensitivity noticeably, which it presented to examiners itself. Figures are modeled; the pattern holds: the hard part is behavior, not mathematics, and a parallel run builds trust.
- [From empty repository to mainnet in ten days: a market-data platform and post-quantum wallets for a new blockchain](https://claytoncyber.com/experience/crypto-market-data-platform-pq-wallets/): Financial technology, digital-asset market data. A digital-asset market-data start-up. The reference screen was live and correct from the first block of the new features, with every block and every pending transaction preserved in three regions. The platform runs on a few modest cloud machines, has no exposed servers, calls a person when something is wrong, and was redesigned twice after launch without downtime. Load figures come from the test network and synthetic databases, not production traffic.
- [Two colocation sites from empty cages: 40 racks, GPU, storage and compute, built, burned in and handed over](https://claytoncyber.com/experience/colocation-datacenter-build-two-sites/): Technology, datacenter and colocation infrastructure. A fast-growing fintech and AI company in the United States, a leader in its segment. Both sites were accepted against a written checklist, production workloads moved over in waves with a rollback ready for each, and the company's own staff operate the rooms with our documentation and a remote-hands contract. Power, rack, server and failure figures are modeled for a build of this kind, not measurements from a client.
- [A regional ISP's edge refresh: dual 100G uplinks, BNG, carrier-grade NAT and sub-second failover](https://claytoncyber.com/experience/regional-isp-bgp-bng-cgnat-edge-refresh/): Telecommunications, regional internet service provider. A regional fiber and wireless internet provider in the Southeast, a leader in its segment. The edge carried the peak with room to spare, a transit or router failure caused a brief reroute that most subscribers did not notice, the new NAT could answer a log request in minutes, and the team had a runbook for each failure. Subscriber counts and failover times are modeled for a refresh of this kind, not measurements from a client.
- [A managed SOC and EDR rollout for a 1,200-endpoint insurer: from alert noise to a clock it can meet](https://claytoncyber.com/experience/insurer-managed-soc-edr-1200-endpoints/): Insurance, regional carrier. A regional property and casualty insurer in the United States, a leader in its segment. Analysts saw a manageable list instead of a flood, endpoint coverage reached all managed machines, exploited vulnerabilities closed in days rather than weeks, and the insurer could show the board and its examiners a program with owners, evidence and tested response. Counts and times are modeled for an engagement of this kind, not measurements from a client.
- [A county government's segmented network and passkeys: from flat to default-deny in two budget cycles](https://claytoncyber.com/experience/county-government-segmented-network-passkeys/): Government, county. A county government in the United States with a population of several hundred thousand, a leader in its segment. A compromised workstation in one department could no longer reach another, phishing could no longer harvest a usable credential, the commissioners had a one-page view of risk, and the IT team could run the network from templates. Sizes and durations are modeled for an engagement of this kind, not measurements from a client.
- [Private 5G on CBRS for a port terminal: remote cranes, yard tractors and scanners on one radio network](https://claytoncyber.com/experience/port-terminal-private-5g-cbrs/): Logistics, maritime container terminal. A container terminal operator at a US Gulf Coast port, a leader in its segment. The yard had continuous coverage across stacks and berths, handhelds and tractors stayed connected as they moved, and the operator owned a network it could tune and extend. Coverage and latency figures are modeled for a design of this kind, not measurements from a client.
- [An Agent Security Review before a wealth manager rolls out Copilot Studio agents](https://claytoncyber.com/experience/wealth-management-agent-security-review-copilot-studio/): Financial services, wealth management. A registered investment adviser in Connecticut with about 90 staff, a leader in its segment. In this illustrative engagement the firm launched with 11 of the 14 planned agents, held three back until their fixes were retested, and kept a written inventory, test report and approval record. The review shows what was found in scope and time, not that the agents are free of vulnerabilities.
- [A Texas title company stops a deepfake wire-change request with callback and second-approver controls](https://claytoncyber.com/experience/title-escrow-deepfake-wire-change-callback-controls/): Real estate, title and escrow. A title and escrow company in Texas with about 35 staff, a leader in its segment. In the firm's own past result, a request that came with a convincing video call and a lookalike sender domain was held at the callback step, and about $412,000 never left the escrow account. That is one client's outcome, not a promise: the controls do not detect every deepfake, they make a faked instruction insufficient to move money.
- [An AI evidence pack for a healthcare group's insurer renewal and a hospital customer's vendor questionnaire](https://claytoncyber.com/experience/healthcare-group-ai-evidence-pack-insurer-renewal/): Healthcare, outpatient medical group. An outpatient medical group in Arizona with six clinics and about 140 clinicians, a leader in its segment. The group sent the same pack to its broker, its counsel and the hospital, and answered both requests from documents in days rather than by reconstruction. The pack is technical evidence only. It is not insurance or legal advice, and it does not say the group is compliant or covered: the broker, the insurer and counsel draw those conclusions.
- [Email a regulated firm can prove: delivered into an Amazon S3 bucket that cannot be deleted or overwritten, with AWS KMS protecting each message's fingerprint](https://claytoncyber.com/experience/immutable-email-proof-s3-object-lock-kms/): Financial services, regulated firm. A regulated firm that needed to prove what it sent and received, a leader in its segment. The firm can answer "what did you send or receive, and can you prove it?" from a record that could not be deleted or overwritten during the retention period, with a protected fingerprint to show a message is unchanged. This is technical evidence, not legal advice, and it does not say the firm is compliant with any rule: counsel decides what the firm must retain and for how long. The client is not named.

## Packages
- [Apocalypse IT Package](https://claytoncyber.com/packages/apocalypse-it-package/): An on-premises continuity kit for any business: an offline reference library for your industry, document scanning and OCR, a private AI desk, local chat, UPS power and drills.

## How we use AI
- [How we use AI: our approval model](https://claytoncyber.com/how-we-use-ai/): How Clayton Cybernetics runs AI agents: named owners, least privilege, human approval for changes, full logs you can review, and a kill switch.

## Technologies
- [Networking](https://claytoncyber.com/technologies/networking/): HPE, Netgear, TP-Link Omada, Point-to-point radio, Fiber, 5G networks, PoE, Structured cabling & cable management, VLANs, routing & wireless design
- [Routing & BGP](https://claytoncyber.com/technologies/routing-bgp/): RPKI route-origin validation (ROV), RTR (RPKI-to-Router), BFD, BGP communities & large communities, IXP route servers, OSPF & IS-IS, Prefix filtering & route policy, Multi-homed BGP edges
- [DDoS & flood protection](https://claytoncyber.com/technologies/ddos-flood-protection/): XDP & eBPF packet filtering, BGP FlowSpec, Remotely triggered blackhole (RTBH), uRPF source filtering, Anycast scrubbing diversion, GRE tunnel return paths, sFlow / NetFlow / IPFIX detection, Rate limiting & SYN protection
- [Datacenter fabric & optics](https://claytoncyber.com/technologies/datacenter-fabric-optics/): Spine-leaf design, VXLAN-EVPN, MLAG, SFP+ / SFP28, QSFP28 / QSFP-DD, DAC & AOC cabling, Coherent DWDM data center interconnect, Cumulus Linux & SONiC, Fabric automation & validation, Transceiver coding and compatibility
- [SD-WAN & SASE](https://claytoncyber.com/technologies/sd-wan-sase/): Application-aware routing, Zero-touch branch provisioning, Cloud on-ramps, Secure web gateway, Zero-trust network access, CASB, Underlay monitoring, 5G and broadband failover
- [Firewalls & network security](https://claytoncyber.com/technologies/firewalls-network-security/): Network segmentation, IDS/IPS (Suricata, Snort), Web application firewalls
- [Endpoint, SIEM & security operations](https://claytoncyber.com/technologies/endpoint-siem-secops/): Graylog, Metasploit Framework, Burp Suite, Nmap, Wireshark, OWASP ZAP, Kali Linux, Penetration testing (offensive & defensive), Incident response & forensics
- [Identity & access](https://claytoncyber.com/technologies/identity-access/): SAML, OpenID Connect (OIDC), OAuth 2.0, LDAP, RADIUS, Single sign-on, Custom two-factor authentication, Auth0, Google Cloud Identity, FreeIPA, Passkeys (WebAuthn), Every identity system: directories, SSO, MFA and privileged access
- [Email & collaboration](https://claytoncyber.com/technologies/email-collaboration/): Microsoft Exchange (4.0 to Subscription Edition), Dovecot, SPF · DKIM · DMARC, Microsoft Teams, Custom email routing
- [VPN & mesh networking](https://claytoncyber.com/technologies/mesh-vpn/): Cloudflare Tunnel, IPsec / IKEv2, Site-to-site VPN, Zero-trust network access, WireGuard site-to-site mesh, Route-based IPsec with BGP over tunnels, NAT traversal & overlay networks
- [Cloud](https://claytoncyber.com/technologies/cloud/): Terraform, Cloud migration & landing zones, Cloud cost control
- [US cloud providers](https://claytoncyber.com/technologies/us-cloud-providers/): Multi-cloud account structure and guardrails, Provider selection by workload, data location and recovery needs, Regional US capacity planning, Exit plans that avoid single-provider lock-in
- [Cloud storage, immutability & backup](https://claytoncyber.com/technologies/cloud-storage-immutability-backup/): Retention modes and legal holds, Logically air-gapped and isolated backup vaults, Restore testing and clean-room recovery, Encryption keys held apart from the data
- [Cloud security & audit services](https://claytoncyber.com/technologies/cloud-security-audit-services/): Log retention and export, Alert routing and ownership, Least-privilege access reviews
- [Cloud networking & DNS](https://claytoncyber.com/technologies/cloud-networking-dns/): Redundant circuits in two locations, BGP routing to cloud on-ramps, Failover tests, Google Cloud DNS
- [Cloud containers, email & AI](https://claytoncyber.com/technologies/cloud-containers-email-ai/): Amazon Bedrock AgentCore, Bedrock Guardrails, Foundry Agent Service
- [Key management & secrets](https://claytoncyber.com/technologies/key-management-secrets/): Hardware security modules (HSM), Google Cloud External Key Manager (Cloud EKM), Cloudflare Secrets Store, SOPS, age, Key rotation & escrow design
- [Storage, servers & virtualization](https://claytoncyber.com/technologies/storage-servers-virtualization/): HPE ProLiant, HPE MSA, Dell PowerEdge, Dell EMC, iSCSI, Virtualization, VMware vSphere, APC Smart-UPS, RAID & capacity planning
- [Data](https://claytoncyber.com/technologies/data/): MariaDB, SQLite, SQL databases, NoSQL databases, restic, Backups & disaster recovery, Data migration & ETL, Immutable backups and Object Lock, 3-2-1-1-0 backup rule, Clean-room restore
- [AI & machine learning](https://claytoncyber.com/technologies/ai-machine-learning/): Local GPU servers: NVIDIA GPUs & CUDA, Open-weight & abliterated models (private research), LLM training & fine-tuning from scratch, PyTorch, vLLM, llama.cpp, Ollama, Retrieval-augmented generation (RAG), AI agents & tool use, Model Context Protocol (MCP)
- [Blockchain & Web3](https://claytoncyber.com/technologies/blockchain-web3/): Solidity, Ethereum Virtual Machine (EVM), Rust & Solana, Smart-contract auditing, Hardhat & Foundry, Wallets, x402 agentic payments, Node operation, Cardano
- [Browser extensions & automation](https://claytoncyber.com/technologies/browser-extensions-automation/): Chrome extensions, Manifest V3, Web scraping & data entry automation
- [Voice & unified communications](https://claytoncyber.com/technologies/voice-unified-communications/): SIP trunking, IVR & voice applications, Fax over IP
- [Devices & endpoint management](https://claytoncyber.com/technologies/devices-endpoint-management/): Windows, Linux, Windows Autopilot, Mobile device management (MDM), BYOD
- [Physical security](https://claytoncyber.com/technologies/physical-security/): Access control, Video management systems (VMS), IP cameras, Alarm systems, Avigilon, Door controllers & readers
- [Drones & robotics](https://claytoncyber.com/technologies/drones-robotics/): Robot Operating System (ROS), PX4 & ArduPilot, Drone data processing
- [Industrial IoT & embedded](https://claytoncyber.com/technologies/industrial-iot-embedded/): ESP32, Industrial sensors: temperature, Industrial sensors: humidity, Industrial sensors: vibration, MQTT, Node-RED, PLC integration, Industrial enclosures, Custom electronics, Real-time machine monitoring
- [Healthcare IT & compliance](https://claytoncyber.com/technologies/healthcare-it-compliance/): HIPAA Security Rule, HL7, FHIR, EHR integration, GDPR, CCPA, LGPD, Risk analysis & audit logging
- [ERP & business systems](https://claytoncyber.com/technologies/erp-business-systems/): Data migration, System integration
- [Open source & custom integrations](https://claytoncyber.com/technologies/open-source-custom/): Open-source technologies, Custom integrations & APIs, Node.js, Python, Rust, Virtually every hardware manufacturer
- [Network automation & observability](https://claytoncyber.com/technologies/network-automation-observability/): NETCONF & YANG, gNMI streaming telemetry, sFlow, IPFIX, GitOps for network configuration, Config backup & drift detection, Source-of-truth inventory (IPAM/DCIM), Pre-change validation, Alerting & dashboards
- [Internet exchange & carrier connectivity](https://claytoncyber.com/technologies/internet-exchange-carrier/): Internet exchange points (IXPs), BGP route servers, Transit and peering strategy, Cross-connects, Wavelengths & dark fiber, Cloud on-ramps, Remote peering, Routing security (RPKI, IRR filtering)
- [Out-of-band management & network labs](https://claytoncyber.com/technologies/out-of-band-lab/): Console servers, LTE/cellular out-of-band access, Zero-touch provisioning (ZTP), Secure ZTP (RFC 8572), Virtual network labs, Pre-change validation, Serial console and break-glass access, Lab-to-production configuration pipelines
- [Timing & precision time (NTP, PTP)](https://claytoncyber.com/technologies/timing-ptp/): NTP servers and pools (RFC 5905), Network Time Security (RFC 8915), PTP IEEE 1588-2019, ITU-T G.8275.1 telecom profile, SMPTE ST 2059-2 broadcast profile, GNSS-disciplined grandmaster clocks, Boundary and transparent clocks, Hardware timestamping on Linux, Holdover oscillators, Offset and path-delay monitoring
- [DNS & DNSSEC](https://claytoncyber.com/technologies/dns-dnssec/): Authoritative DNS, Recursive resolvers, DNSSEC signing and key rollover, DNS over HTTPS (DoH), DNS over TLS (DoT), Anycast DNS, Split-horizon (internal and external) zones, Traffic steering and health checks, Response rate limiting, DNS monitoring and logging
- [Wireless: Wi-Fi 6E/7 & private 5G](https://claytoncyber.com/technologies/wireless-private-5g/): Wi-Fi 6E (IEEE 802.11ax), Wi-Fi 7 (IEEE 802.11be), 6 GHz and AFC planning, WPA3 and 802.1X, 802.11r/k/v roaming, Site surveys and RF planning, CBRS private LTE (FCC Part 96), Private 5G standalone cores, Neutral-host indoor cellular, Wireless controllers and cloud management, Open-source 5G cores and RAN for labs, Priority Access and General Authorized Access planning, AFC registration for standard-power 6 GHz
- [Structured cabling & fiber](https://claytoncyber.com/technologies/structured-cabling-fiber/): ANSI/TIA-568 horizontal and backbone cabling, Category 6A copper, OM3 / OM4 / OM5 multimode fiber, OS2 single-mode fiber, MPO/MTP trunks and polarity, Fiber splicing and termination, OTDR and insertion-loss testing, Copper certification, PoE (IEEE 802.3bt) power budgets, Labeling, pathways and documentation, ANSI/TIA-606 labeling and administration, Patch panel and patching standards
- [PKI, certificates & ACME](https://claytoncyber.com/technologies/pki-certificates/): Offline root and online issuing CAs, Certificate templates and auto-enrollment, ACME clients and servers (RFC 8555), cert-manager on Kubernetes, SCEP and network device enrollment, OCSP and CRL design, HSMs and PKCS #11, TPM key attestation, Short-lived certificates and mTLS, CA/Browser Forum lifetime schedule, Certificate inventory and expiry monitoring
- [Load balancers & application delivery](https://claytoncyber.com/technologies/load-balancers-adc/): Layer 4 and Layer 7 load balancing, Active and passive health checks, TLS termination, offload and re-encryption, Session persistence, Global server load balancing (GSLB), Blue-green and canary routing, Connection draining, WAF and rate limiting at the edge, Service mesh sidecars and ingress, High availability pairs and VRRP
- [Data center power, cooling & DCIM](https://claytoncyber.com/technologies/datacenter-power-dcim/): Double-conversion, line-interactive and standby UPS, Rack PDUs and metered outlets, A and B power feeds, Automatic transfer switches, Generators and fuel planning, Lithium-ion UPS batteries, Hot and cold aisle containment, Precision and in-row cooling, Environmental sensors and leak detection, Power and capacity monitoring, DCIM software (EcoStruxure IT), Micro and edge data centers, kW per rack budgeting, ASHRAE TC 9.9 thermal guidelines
- [Log pipelines, SIEM & data retention](https://claytoncyber.com/technologies/log-pipelines-siem-data/): Syslog (RFC 5424), OpenTelemetry Collector, Log parsing and normalization, Kafka buffering and fan-out, Hot, warm, cold and frozen tiers, Searchable snapshots on object storage, SIEM detection rules and hunting, Retention and legal hold policy, Pipeline health and dropped-event alerts
- [Post-quantum cryptography](https://claytoncyber.com/technologies/post-quantum-cryptography/): ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), Hybrid X25519MLKEM768 for TLS 1.3, Cryptographic inventory, Algorithm agility, Post-quantum certificates, liboqs prototypes, Harvest-now, decrypt-later risk assessment, Post-quantum signing for wallets
- [GPU servers & LLM inference serving](https://claytoncyber.com/technologies/gpu-inference-serving/): NVIDIA HGX B200, H200 and H100 servers, Tensor and pipeline parallelism, FP8 and INT4 quantization, Continuous batching and prefix caching, OpenAI-compatible inference APIs, Mixture-of-experts models, Model evaluation harnesses, GPU monitoring and capacity planning, Air-gapped model delivery
- [Quantitative finance & risk engines](https://claytoncyber.com/technologies/quant-finance-risk/): Yield-curve construction, Interest-rate risk (EVE and NII), Deposit and prepayment modeling, CECL and expected-loss analytics, XVA and exposure simulation, Python and Jupyter workflows, Public data pipelines, Model documentation and validation support, Backtesting and reconciliation
- [Rust, WebAssembly & Cloudflare edge](https://claytoncyber.com/technologies/rust-wasm-cloudflare-edge/): Rust services and command-line tools, Rust compiled to WebAssembly, workers-rs and wasm-bindgen, Cloudflare KV, R2, D1 and Durable Objects, Cloudflare WAF managed rules, Rate limiting, Edge caching and routing, Browser-side Wasm modules
- [Google Cloud & Workspace services](https://claytoncyber.com/technologies/google-cloud-services/): Cloud Storage with retention locks, Landing zones and VPC design, Cloud Interconnect, Chrome Enterprise, Cost controls and committed use, Datastream
- [Document OCR, local search & offline chat](https://claytoncyber.com/technologies/document-ocr-local-search-chat/): Mailroom scanning and searchable PDFs, Local full-text and vector search, Retrieval over private documents, Local summarization and deadline extraction, Self-hosted chat and file sharing, Air-gapped operation, Local mail and calendars, UPS power for the continuity kit, Offline legal and reference libraries, Continuity drills
- [Server hardware & datacenter builds](https://claytoncyber.com/technologies/servers-hardware-builds/): HPE ProLiant, DDR5 RDIMM population, NVMe U.2, U.3 and E3.S, EDSFF E1.S, BMC and IPMI, Firmware baselines, OCP-style hardware
- [Datacenter operations & colocation](https://claytoncyber.com/technologies/datacenter-operations-colocation/): Colocation selection and moves, Cross-connects and meet-me rooms, Remote hands and smart hands, MOPs and change windows, Asset tracking, A/B power feed cabling, Decommissioning and data sanitization
- [Kubernetes & service mesh](https://claytoncyber.com/technologies/kubernetes-service-mesh/): Helm and Kustomize, Gateway API, Hubble observability, Progressive delivery with Flagger
- [OT & ICS security](https://claytoncyber.com/technologies/ot-ics-security/): Purdue-style segmentation, Passive OT network monitoring, Secure remote access for vendors, OT asset inventory, OT incident response planning
- [AI agent security](https://claytoncyber.com/technologies/ai-agent-security/): Prompt injection testing, Agent identity and least-privilege scopes, MCP server review and sandboxing, Token audience validation, Agent audit trails, Agent registry and lifecycle, Tool-misuse and excessive-agency testing, Agent skill scanning

## Services
- [Cybersecurity](https://claytoncyber.com/services/cybersecurity/): We find out whether everything you run is safe from attackers, then we fix it.
- [Managed IT Services](https://claytoncyber.com/services/managed-it-services/): Your entire IT operation, run by engineers who have operated infrastructure for global enterprises.
- [Disaster Recovery Planning](https://claytoncyber.com/services/disaster-recovery/): Know how long you can be down, and prove you can come back before the day you must.
- [Clayton Secure](https://claytoncyber.com/services/clayton-secure/): One view of your entire cybersecurity program, in near real time.
- [Cloud Management](https://claytoncyber.com/services/cloud-management/): Cloud cost review and management, without compromising on quality or security.
- [Cyber Automation](https://claytoncyber.com/services/cyber-automation/): Custom AI agents that do repetitive work around the clock, with human review where it matters.
- [Super Intelligence](https://claytoncyber.com/services/super-intelligence/): American‑made Super Intelligence: AI your team can learn, trust and deploy.
- [Tailored Software](https://claytoncyber.com/services/tailored-software/): Software built around your business in weeks, and you own the code.
- [Datacenter & Colocation Builds](https://claytoncyber.com/services/datacenter-builds/): Cages, racks, power, cabling and servers, built by the people who will run them.

## Industries
- [Investment Advisers & Broker-Dealers](https://claytoncyber.com/industries/investment-advisers-and-broker-dealers/): We test whether an advisory firm's networks, laptops, data and vendors are safe from attackers, because examiners and clients both expect proof. Regulated operations are our specialty. We assess whether an investment firm's operations meet the requirements of the SEC and other governmental bodies, and we build what is missing.
- [Banks & Financial Institutions](https://claytoncyber.com/industries/banks-and-financial-institutions/): We are a cybersecurity company, and for banks that means testing every network, endpoint, web application and API to find out whether it is safe from attackers. Banks are measured against the highest security expectations of any industry. We test like attackers, report like auditors and help your team close the gaps.
- [Law Firms](https://claytoncyber.com/industries/law-firms/): We find out whether your attorneys' laptops, phones, email, document systems and client data are safe from attackers, and we fix what we find. Law firms hold exactly what attackers want: privileged communications, deal information and client identities. We protect them and keep your attorneys productive.
- [South Florida Businesses](https://claytoncyber.com/industries/south-florida-businesses/): We are a cybersecurity company, and for businesses in South Florida that means finding out whether your networks, devices, data and web presence are safe from attackers, then fixing it. We are based in Aventura and focus our managed services on South Florida, where our engineers can be on site. Hurricane season, multi-site offices and fast growth are part of our daily work.
- [Healthcare & Medical](https://claytoncyber.com/industries/healthcare-and-medical/): We find out whether patient records, medical devices, workstations and portals are safe from attackers, then fix what we find without interrupting care. Patient records are among the most sensitive data there is, and care cannot pause for an outage. We secure and run the technology of medical practices and the businesses that serve them.
- [Real Estate & Coworking](https://claytoncyber.com/industries/real-estate-and-coworking/): We test whether the payment flows, shared networks, tenant systems and websites of a property business are safe from attackers, and fix what we find. Property and workspace businesses move large payments and host many companies on shared networks. We protect the transactions and design the buildings' technology.
- [Technology & Startups](https://claytoncyber.com/industries/technology-and-startups/): We test whether your product, APIs, codebase, cloud accounts and laptops are safe from attackers, so customers and investors can trust what you ship. Fast-growing technology companies need security and IT that scale with them. We build the foundations early and keep cloud cost, access and customer trust under control.
- [Manufacturing & Industrial](https://claytoncyber.com/industries/manufacturing-and-industrial/): We find out whether your plant networks, control systems, workstations and supplier connections are safe from attackers, and fix what we find. Factories lose money when machines stop and when software gets in the way. We connect machines to live data, replace outdated systems with software you own, and secure the factory network.
- [Financial Technology](https://claytoncyber.com/industries/financial-technology/): We test whether your platform, APIs, codebase and cloud accounts are safe from attackers, and give assessors the evidence. Fintech companies move money and ship software at the same speed. We build the platforms underneath them, from Kubernetes and key management to the testing that shows an assessor what you built.
- [Education](https://claytoncyber.com/industries/education/): We find out whether your campus networks, student and staff devices, records and web systems are safe from attackers, and fix what we find. Schools and universities are open by design: thousands of personal devices, visitors, researchers and decades-old equipment. We build networks that stay open for learning and closed to attackers.
- [Media & Broadcast](https://claytoncyber.com/industries/media-and-broadcast/): We test whether the studio networks, playout systems, workstations and web platforms behind your signal are safe from attackers. Live media does not tolerate a second try. We design the networks behind studios and playout: timing, redundancy, capacity and the security that keeps the signal yours.
- [Logistics & Distribution](https://claytoncyber.com/industries/logistics-and-distribution/): We find out whether your warehouse networks, scanners, workstations, systems of record and partner connections are safe from attackers. A warehouse is a computer with forklifts. We connect scanners, sensors and robots to a system of record your company owns, and keep the network around them safe.
- [Hospitality & Travel](https://claytoncyber.com/industries/hospitality-and-travel/): We test whether guest networks, payment systems, property systems and booking sites are safe from attackers, and fix what we find. Guests expect fast Wi-Fi and a payment that just works. We build the networks behind hotels, resorts and ships: guest access, payment systems and the property systems that must stay out of reach.
- [Energy & Utilities](https://claytoncyber.com/industries/energy-and-utilities/): We find out whether your office and control networks, remote access and field devices are safe from attackers, under strict written scope. Control networks keep the lights on, and they were never designed to face the internet. We separate operations from the office, monitor what is there and keep the way in narrow and logged.
- [Insurance](https://claytoncyber.com/industries/insurance/): We test whether the systems that hold policyholder and claims data, including your portals and APIs, are safe from attackers, and fix what we find. Insurers hold health records, financial data and claims files for millions of policyholders. We run the controls, the monitoring and the evidence that regulators and boards expect to see.
- [Telecom & ISPs](https://claytoncyber.com/industries/telecom-and-isps/): We test whether your edge, subscriber systems, customer portals and APIs are safe from attackers, and fix what we find. A service provider is judged by its edge: routing, subscriber management, peering and the way it behaves under attack. Our engineers have built and operated those layers, and we protect the customer data that rides on them.
- [Government & Public Sector](https://claytoncyber.com/industries/government-and-public-sector/): We find out whether your networks, workstations, public websites and resident records are safe from attackers, and fix what we find. Counties and cities run dozens of services on thin budgets, with residents' records, public safety and utilities in the same building. We separate them, secure access and keep small teams in control.

## Insights
- [SEC Regulation S-P Amendments: A Practical Checklist for Investment Advisers and Broker-Dealers](https://claytoncyber.com/insights/sec-regulation-s-p-amendments-checklist/): Smaller entities had to comply with the amended Regulation S-P by June 3, 2026; larger entities by December 3, 2025. Here is what examiners will look for, and how to check your firm today.
- [The Florida Information Protection Act: A Breach-Response Checklist for Florida Businesses](https://claytoncyber.com/insights/florida-information-protection-act-breach-checklist/): Florida gives businesses 30 days to notify people affected by a data breach. Most companies only discover how little time that is during their first incident.
- [Local, Private or Frontier? How to Use AI Without Exposing Sensitive Data](https://claytoncyber.com/insights/private-ai-for-sensitive-data/): The question is not whether to use AI on sensitive work, but where each piece of work should run. A three-tier design answers it.
- [HIPAA Security Rule Checklist for Medical Practices and Business Associates](https://claytoncyber.com/insights/hipaa-security-rule-checklist/): The HIPAA Security Rule applies to every practice and vendor that touches electronic patient data. Here is what it requires today, the deadlines that apply after a breach, and where HHS's proposed overhaul stands.
- [Data Protection for U.S. Businesses With International Clients: Florida, California, GDPR and Brazil's LGPD](https://claytoncyber.com/insights/data-protection-us-businesses-international-clients/): A business based in Florida can still answer to regulators in California, Europe and Brazil. This guide explains when each law reaches you, what they have in common, and how to build one program instead of four.
- [SPF, DKIM and DMARC: Why Email Authentication Matters, and How a Resilient Exchange or Microsoft 365 Platform Is Run](https://claytoncyber.com/insights/email-authentication-spf-dkim-dmarc-resilient-exchange/): Email authentication has moved from best practice to a delivery requirement. This guide explains the three standards in plain terms, what the big mailbox providers expect, and what patching and failover look like on a well-run Exchange or Microsoft 365 platform.
- [Penetration Testing Explained for Executives: Scope, Reports and How Often to Test](https://claytoncyber.com/insights/penetration-testing-explained-for-executives/): A penetration test is a controlled attack that shows how a real adversary could get into your systems. This guide explains what you are buying, how to scope it, what a good report contains and how to decide how often to test.
- [Local AI vs Frontier APIs: Cost, Privacy and Governance of Running Open-Weight Models on Your Own GPUs](https://claytoncyber.com/insights/local-ai-open-weight-models-vs-frontier-apis/): Running AI models on your own hardware keeps data inside your walls and makes costs predictable, but it shifts security, maintenance and quality risk to you. Frontier APIs offer the strongest models with none of that burden, but your data leaves your network. This guide shows how to decide, workload by workload.
- [Ransomware Readiness and Incident Response: A Checklist Based on the CISA #StopRansomware Guide](https://claytoncyber.com/insights/ransomware-readiness-and-incident-response-checklist/): The joint CISA, FBI, NSA and MS-ISAC #StopRansomware Guide splits the work in two: what to do before an attack and what to do during one. Here is how a small or mid-size firm can turn it into a plan it can actually run.
- [MFA and Passkeys for Businesses: What NIST SP 800-63B-4 and FIDO2 Mean for Your Logins](https://claytoncyber.com/insights/mfa-and-passkeys-for-businesses/): Not all multi-factor authentication stops the same attacks. NIST finalized SP 800-63B-4 in July 2025, and CISA calls phishing-resistant MFA the gold standard. Here is how to choose, where passkeys fit, and how to roll them out without locking out your staff.
- [Backups That Actually Restore: 3-2-1, Immutability, Restore Tests and Hurricane Season for Coastal Firms](https://claytoncyber.com/insights/backups-that-restore-3-2-1-immutability-hurricane-season/): Most firms have backups. Fewer have a backup they have restored, protected from a stolen admin login, and stored outside the flood zone. This guide covers the 3-2-1 rule and its modern extension, immutable storage, restore testing, recovery targets, and a hurricane-season plan for any coastal or hurricane-exposed US firm, with Florida as the main example.
- [Replacing Legacy Business Software with Custom Software: When It Pays and How to Test the Idea in Two Weeks](https://claytoncyber.com/insights/replace-legacy-business-software-with-custom-software/): Per-user licenses grow with headcount, and a product built for everyone fits no one exactly. Sometimes it pays to build your own. Here is how to run the numbers, what can go wrong, who should own the code, and how to prove the idea with a two-week prototype.
- [Business Email Compromise and Wire Fraud: How Law Firms and Real-Estate Closings Get Hit, and How to Stop It](https://claytoncyber.com/insights/business-email-compromise-wire-fraud-law-firms-real-estate-closings/): Business email compromise is the second-costliest crime in the FBI's 2025 report, and real-estate closings are among its favorite settings. This article uses FBI and FinCEN data to explain how the fraud works, what law firms and title agents should change, and what to do in the first hour after a wrong wire.
- [HIPAA and the Cloud: Business Associate Agreements for Microsoft 365, Google Workspace and Amazon Web Services (AWS), and What Else You Must Do](https://claytoncyber.com/insights/hipaa-and-the-cloud-baas-microsoft-365-google-workspace-aws/): Using a large cloud provider does not make you HIPAA compliant, and neither does signing its business associate agreement. This guide explains what the BAAs from Microsoft, Google and Amazon Web Services (AWS) actually cover, what HHS has said about cloud providers, and the configuration and risk-analysis work that stays with you.
- [ABA Formal Opinion 512 and AI for Law Firms: Confidentiality, Competence, Fees and Supervision, With Florida Bar Opinion 24-1](https://claytoncyber.com/insights/aba-formal-opinion-512-ai-law-firms-florida-bar-24-1/): Two ethics opinions now frame how lawyers may use generative AI: the ABA's Formal Opinion 512 (July 2024) and the Florida Bar's Opinion 24-1 (January 2024). Neither bans the tools. Both ask lawyers to verify output, protect client information, bill honestly and supervise. This article turns them into a firm policy and a tool-selection checklist.
- [OT and ICS Security for Manufacturers: A Practical Guide Based on NIST SP 800-82 Rev. 3 and CISA Guidance](https://claytoncyber.com/insights/ot-ics-security-for-manufacturers-nist-800-82-cisa/): Plant-floor systems were built for uptime and safety, not for the internet. NIST SP 800-82 Rev. 3 and CISA's 2025 joint guidance give manufacturers a clear order of work: get controllers off the internet, change default passwords, lock down remote access, separate IT from OT, and keep the ability to run by hand.
- [Zero Trust for Mid-Size Firms: A Practical Path Using NIST SP 800-207 and the CISA Zero Trust Maturity Model](https://claytoncyber.com/insights/zero-trust-for-mid-size-firms-nist-800-207-cisa-maturity-model/): Zero trust is not a product you buy. NIST SP 800-207 defines it as a set of principles, and CISA's Zero Trust Maturity Model gives a staged way to apply them. This article translates both for a mid-size firm with limited staff and a mix of cloud and office systems.
- [Cyber Insurance Readiness: What Underwriters Ask About MFA, EDR and Backups, and How to Prepare](https://claytoncyber.com/insights/cyber-insurance-readiness-mfa-edr-backups-what-underwriters-ask/): Insurers do not guess at your security. They ask. Published application forms from two large carriers show which controls matter most: MFA, endpoint detection, tested and protected backups, privileged access, patching and a tested incident response plan. This article walks through the questions and how to answer them truthfully.
- [Windows 10 End of Support and Microsoft 365 Hardening: What to Do Now, With CISA SCuBA Baselines](https://claytoncyber.com/insights/windows-10-end-of-support-and-microsoft-365-hardening/): Microsoft ended support for Windows 10 on October 14, 2025. Paid Extended Security Updates can bridge up to three years, but they are a stopgap. This article explains the dates, the Windows 11 hardware rules, the effect on Microsoft 365 Apps, and a short hardening list based on CISA's free SCuBA baselines.
- [Bank and Credit Union Cyber Incident Reporting: The 36-Hour and 72-Hour Rules, and What to Prepare](https://claytoncyber.com/insights/bank-credit-union-cyber-incident-reporting-36-hour-72-hour-rules/): Federally supervised banks must notify their regulator of a serious computer-security incident within 36 hours of determining it happened. Federally insured credit unions have 72 hours from a reasonable belief. The two rules differ in trigger, scope and wording. This article explains both from the primary sources, covers bank service provider duties, and lists what to prepare before an incident.
- [Vendor and Third-Party Risk for Mid-Size Firms: The 2023 Interagency Guidance, NIST SP 800-161 and CSF 2.0](https://claytoncyber.com/insights/vendor-third-party-risk-management-mid-size-firms-interagency-guidance-nist/): Most firms now run on vendors: email, payments, hosting, line-of-business software, managed IT. Regulators and NIST agree on the shape of a sensible program. Know your vendors, rank them by criticality, check them before you sign, put security terms in the contract, watch them, and plan the exit. This article maps those steps to the 2023 bank guidance, NIST SP 800-161 Rev. 1 and CSF 2.0, and notes that the bank agencies proposed replacing their guidance in September 2026.
- [PCI DSS 4.0.1 for Small Merchants: What Changed, What Is Now Required, and How to Cut Scope](https://claytoncyber.com/insights/pci-dss-4-0-1-small-merchants-future-dated-requirements-saq/): PCI DSS v4.0.1 is the only active version of the card-security standard. The requirements that were best practices until March 31, 2025 are now mandatory in every assessment. For a small merchant the work depends on the Self-Assessment Questionnaire that applies. This article explains the version history, the changes that reach small businesses, what the SAQ types mean, and how to reduce what you must protect.
- [BYOD and Remote-Work Security: A Practical Policy Built on NIST SP 800-46, SP 800-124 and CISA Guidance](https://claytoncyber.com/insights/byod-remote-work-security-nist-800-46-800-124-cisa/): Staff work from home, from hotels and from their own phones. The risk is not the place. It is the device you do not control and the network between it and your data. NIST and CISA give a clear way to decide who gets access to what, from which device, and how to take it back.
- [HIPAA-Compliant Email: When You Must Encrypt, When Patients Can Opt Out, and What to Put in Writing](https://claytoncyber.com/insights/hipaa-compliant-email-encryption-patients-business-associates/): HIPAA does not ban email, and it does not say the word "mandatory" about email encryption today. It asks you to assess the risk, protect messages in transit, and decide in writing. This article explains what the rule requires, how patient preferences fit in, and a workable email policy for a medical or dental practice.
- [Separating Global Networks: VRFs, VLANs and VXLAN-EVPN Across Datacenters](https://claytoncyber.com/insights/vrfs-vlans-vxlan-evpn-separating-global-networks-across-datacenters/): A multinational rarely wants one flat network. It wants many separate ones: one per region, business unit or regulated workload, sharing the same cables, optics and datacenters. This article explains the building blocks in the order you meet them: VLANs, QinQ, VRFs, VXLAN and EVPN, and what changes when the segments must stretch between datacenters.
- [BGP at the Edge with BIRD 2: RPKI, Communities and Fast Failover](https://claytoncyber.com/insights/bgp-at-the-edge-with-bird-2-rpki-communities-bfd-failover/): BGP (RFC 4271) decides how your network is reached from the internet and how it reaches everyone else. BIRD 2 is an open-source routing daemon that does the job on ordinary Linux or BSD servers. This article covers the pieces a sound edge needs: filters from RFC 7454, RPKI origin validation, communities, BFD for quick failure detection, and what BGPsec does and does not do.
- [Surviving a Flood: XDP, FlowSpec and Scrubbing for DDoS](https://claytoncyber.com/insights/surviving-a-ddos-flood-xdp-flowspec-rtbh-scrubbing/): A distributed denial-of-service attack is a capacity problem first and a clever-filtering problem second. No single tool survives every flood. This article explains the layers used in practice: stop spoofing at the edge, drop junk early with XDP on your own servers, push narrow filters to the network with BGP FlowSpec, blackhole as a last resort and send the rest through a scrubbing service.
- [WireGuard vs IPsec for Site-to-Site Meshes](https://claytoncyber.com/insights/wireguard-vs-ipsec-site-to-site-mesh-ikev2-esp/): Both WireGuard and IPsec can join offices, datacenters and clouds with encrypted tunnels. They make very different trade-offs. WireGuard is small, fixed in its choices and easy to reason about. IPsec is a large family of standards with certificates, negotiation and wide interoperability. This article compares them where it matters for a mesh: how tunnels are set up, how keys are managed, how NAT and roaming behave, and how each fits routing.
- [SFP+, SFP28, QSFP28 and QSFP-DD: Choosing Optics and Fiber for 10 to 400 Gb/s](https://claytoncyber.com/insights/sfp-sfp28-qsfp28-qsfp-dd-optics-fiber-10-to-400-gbps/): The pluggable module in a switch port decides how fast the link runs, what fiber it needs and how far it reaches. The names look alike and the rules are not. This article walks the ladder from 10 to 400 Gb/s: the module families, the IEEE 802.3 port types behind them, what multimode (OM3, OM4) and single-mode (OS2) fiber can carry, when a copper cable or active optical cable is the better answer, how breakout works, and where 400ZR coherent optics fit.
- [Microsegmentation: From VLANs and Firewall Zones to Identity-Based Policy](https://claytoncyber.com/insights/microsegmentation-vlans-firewall-zones-identity-based-policy/): Segmentation limits how far an intruder can travel after the first foothold. Most networks start with VLANs and a perimeter firewall, which is a coarse form of the idea. Microsegmentation narrows the boundary to a single workload and writes the rules in terms of what the workload is and who is calling it, not which subnet it sits in. This article follows the path from VLANs and zones to identity-based policy, using NIST SP 800-207, NIST SP 800-125B and the CISA Zero Trust Maturity Model, and explains where each step pays off and where it hurts.
- [Anycast DNS and Edge Load Balancing: BGP, Health Checks and DDoS Absorption](https://claytoncyber.com/insights/anycast-dns-and-edge-load-balancing-bgp-health-checks-ddos/): Anycast announces the same IP address from many places and lets internet routing deliver each client to a nearby site. It is how the DNS root servers and most large content networks stay fast and hard to knock over. This article explains how anycast works with BGP, what RFC 4786 and RFC 7094 recommend, how health checks pull a failing site out of service, why anycast absorbs floods, and where it does not fit, notably long-lived TCP connections.
- [NetFlow, sFlow and IPFIX for Security Monitoring: Detection and Sampling Trade-offs](https://claytoncyber.com/insights/netflow-sflow-ipfix-security-monitoring-detection-sampling/): Flow records say who talked to whom, when, on which ports and how much, without storing the content. That is enough to catch scans, data theft, command-and-control beacons, floods and policy violations. NetFlow v9, sFlow and IPFIX are the three formats you will meet. This article explains how each works, what the RFCs say, which detections flow data supports well, and how sampling changes what you can see.
- [MPLS, SD-WAN or EVPN: Choosing a Backbone for a Multi-Site Company](https://claytoncyber.com/insights/mpls-sd-wan-or-evpn-choosing-a-backbone-for-a-multi-site-company/): A company with several offices, data centers and clouds has to decide how those sites talk to each other. Three families of answer dominate: a provider's MPLS VPN, an SD-WAN overlay running over ordinary internet and carrier links, and an EVPN-based fabric that the company runs itself. They are not three brands of the same thing. They sit at different layers and solve different problems. This article explains what each one is, what the standards say, where each fits and how a mid-size firm can choose without buying more than it needs.
- [TLS Certificates and PKI Lifecycle: Automation Before the 47-Day Era](https://claytoncyber.com/insights/tls-certificates-pki-lifecycle-automation-before-47-day-certificates/): Public TLS certificates are about to get much shorter lives. Under CA/Browser Forum ballot SC-081, the maximum validity of a publicly trusted certificate drops from 398 days to 200 days on 15 March 2026, to 100 days on 15 March 2027 and to 47 days on 15 March 2029. A company that renews certificates by hand once a year will be renewing them roughly eight times a year by 2029, and ten-day reuse of domain validation data makes manual renewal fragile. This article explains the schedule, what ACME (RFC 8555) automates, how to inventory and monitor certificates, and where an internal PKI and hardware-protected roots fit.
- [Network Time for Security and Trading: NTP, NTS and PTP](https://claytoncyber.com/insights/network-time-for-security-and-trading-ntp-nts-ptp/): Time is a dependency that most networks never examine until something breaks. Logs from different systems cannot be correlated if clocks disagree, Kerberos and TLS fail when clocks drift, and financial firms must prove their clocks were accurate when a trade was recorded. Three protocols cover the range: NTP for general purposes, NTS to authenticate it, and PTP for sub-microsecond needs. This article explains how each works, what the U.S. and European regulators actually require of trading firms, and how to build and monitor a time service you can defend.
- [DNS Security: DNSSEC, Response Policy Zones and Encrypted DNS](https://claytoncyber.com/insights/dns-security-dnssec-response-policy-zones-encrypted-dns/): DNS turns names into addresses, and nearly every connection starts with it. That makes it both a target and a control point. Four different tools get discussed together as if they were one: DNSSEC, which proves answers are genuine; response policy zones, which let your resolver refuse known-bad answers; encrypted DNS, which hides queries from the path; and protective DNS services. They solve different problems. This article explains what each does and does not do, where they conflict, and a layered setup for a mid-size company.
- [Post-Quantum Encryption in Practice: Hybrid ML-KEM and X25519, FIPS 203](https://claytoncyber.com/insights/post-quantum-encryption-in-practice-hybrid-ml-kem-x25519-fips-203/): A large enough quantum computer would break the public-key cryptography that protects today's connections, and traffic recorded now could be decrypted later. In August 2024 NIST finalized the first post-quantum key-establishment standard, FIPS 203, called ML-KEM. In TLS the practical answer is a hybrid: combine ML-KEM with a classical X25519 exchange so that the connection stays safe if either holds. This article explains the standard, the hybrid design as published in an IETF RFC, what it costs, and how a company should inventory and migrate without panic.
- [Can the Internet Be Switched Off in the US, and How Would a Business Keep Working?](https://claytoncyber.com/insights/can-the-internet-be-switched-off-in-the-us-how-a-business-keeps-working/): A question that surfaces after every major outage or crisis: could the U.S. government turn the internet off, and what would a company do if it did? The honest answer has two parts. The law gives a President broad emergency powers over communications, and nobody has tested how far they reach over the modern internet. And the more likely causes of a long outage are hurricanes, cable cuts, cloud failures and attacks on a provider, not a decree. This article reads the statute, explains why a total shutdown is practically hard, and describes how any business, with a law office as one worked example, keeps its core work running when connectivity is gone.
- [Private 5G (CBRS) vs Wi-Fi 6E and Wi-Fi 7 on the Factory Floor](https://claytoncyber.com/insights/private-5g-cbrs-vs-wi-fi-6e-7-on-the-factory-floor/): Plants are adding autonomous mobile robots, vision inspection, handheld scanners and sensors, and they all need wireless that does not drop. Two families compete: Wi-Fi in the 6 GHz band, known as Wi-Fi 6E and Wi-Fi 7, and private 5G on CBRS spectrum in the United States. They are not rivals for every job. This article explains the CBRS rules in 47 CFR Part 96, the architectural differences that matter on a factory floor, and a practical way to decide, including the common answer of using both.
- [Running Open-Weight LLMs on Premises for Regulated Firms](https://claytoncyber.com/insights/running-open-weight-llms-on-premises-for-regulated-firms/): Many financial firms want the benefits of a large language model without sending customer information to someone else's servers. Open-weight models make that possible, and a modern GPU server can hold a very large one. But running a model yourself does not remove the rules. It moves the work. This article walks through the controls the GLBA Safeguards Rule (16 CFR Part 314) already asks for, how the NIST AI Risk Management Framework and the OWASP Top 10 for LLM Applications 2025 add to them, what the interagency third-party guidance still means when the hardware is in your own rack, and how to size a GPU system from public specifications.
- [Hurricane-Proofing IT by Moving to the Cloud: A Florida Playbook](https://claytoncyber.com/insights/hurricane-proofing-it-by-moving-to-the-cloud-a-florida-playbook/): A server room on the Gulf or Atlantic coast, Florida above all, has two kinds of risk in storm season: the building and the grid. A hurricane can flood the room, cut the power for days and close the roads staff need to reach it. Moving workloads to a public cloud removes the first risk only if the design is right, and it adds new ones. This playbook explains the Atlantic hurricane season as NOAA describes it, how Ready.gov frames business continuity and IT recovery, what Florida Statutes section 501.171 asks of a business that holds personal information, and how Google Cloud regions and zones work, with a step-by-step plan for the move.
- [Bringing ALM and CECL In-House: Models, Data and Model Risk](https://claytoncyber.com/insights/bringing-alm-and-cecl-in-house-models-data-and-model-risk/): Many community and regional banks send loan and deposit data to an outside vendor each quarter and receive reports on interest rate risk and expected credit losses. Some now ask whether to run those models themselves. This article explains the regulatory frame: the interagency advisory on interest rate risk management from 2010, the credit loss standard (ASC 326, known as CECL) as the agencies describe it, and the Federal Reserve and OCC guidance on model risk management (SR 11-7). It then covers public data sources, open-source tools such as QuantLib and the Open Source Risk Engine, and the parts that are hard: behavioral assumptions, validation and governance.
- [Building a Colocation Footprint from an Empty Cage: Power, Cooling, Cabling and Server Burn-In](https://claytoncyber.com/insights/building-a-colocation-footprint-from-an-empty-cage-power-cooling-cabling-and-server-burn-in/): An empty cage in a colocation facility is a blank page, and the choices made in the first few weeks decide how the footprint behaves for years. This article walks through the whole life of a deployment: choosing the facility, laying out the cage, planning power in kilowatts per rack with A and B feeds, managing airflow with hot and cold aisle containment, running structured cabling with proper labeling, building and burning in servers, writing method-of-procedure documents for remote hands, and finally retiring equipment with media sanitization that follows NIST SP 800-88 Rev. 2.
- [Securing AI Agents: The OWASP Agentic Top 10 in Plain English](https://claytoncyber.com/insights/securing-ai-agents-owasp-agentic-top-10-plain-english/): An AI agent does not just answer questions. It reads your files, calls your tools and takes actions with the access you give it. In December 2025 the OWASP GenAI Security Project published a Top 10 list of the risks that come with that, numbered ASI01 to ASI10. This article walks through each of the ten in plain English, explains what each one means for a mid-size company, and lists the controls that reduce the risk. It also points to the OWASP LLM Top 10 for 2025 and to the joint government guidance, Careful Adoption of Agentic AI Services, released by the United States and its Five Eyes partners in spring 2026.
- [MCP Servers: What to Check Before You Connect an AI Agent to Your Systems](https://claytoncyber.com/insights/mcp-servers-what-to-check-before-connecting-an-ai-agent-to-your-systems/): The Model Context Protocol (MCP) is the common plug that lets an AI agent use tools and data: your file store, your ticket system, your database. Connecting one is easy. Connecting one safely depends on how the server handles sign-in, tokens and permissions. This article walks through the authorization rules in the current MCP specification, revision 2026-07-28, in plain language, turns them into a checklist you can use before approving a server, and then covers the other half of the problem: giving each agent an identity of its own, with a named human sponsor, using Microsoft Entra Agent ID as one example and NIST's agent identity project as the direction of travel.
- [AI Rules in Florida in 2026: What Actually Applies to Your Business](https://claytoncyber.com/insights/ai-rules-in-florida-in-2026-what-actually-applies/): Headlines in 2026 said Florida was about to pass an Artificial Intelligence Bill of Rights. It did not. Two versions of the bill, SB 482 and SB 2-D, passed the Senate and then died in the House. That leaves a business owner with a fair question: so what rules do apply when we use AI? This article separates the proposals from the law. It covers the Florida Information Protection Act, which governs most Florida businesses that lose personal data; the Florida Digital Bill of Rights, which reaches only very large companies; the one AI-specific statute we found that was enacted, Brooke's Law; the Florida Bar's baseline for lawyers; and the federal sector rules that already apply to regulated firms.
- [Deepfake-Proof Payments: Callback Verification That Holds Up](https://claytoncyber.com/insights/deepfake-proof-payments-callback-verification-that-holds-up/): A payment request that arrives by email, voice or even live video can no longer prove who sent it. The FBI warns that criminals use generative AI to clone voices and to run real-time video calls with fake executives. FinCEN has issued a formal alert on deepfake media. The control that survives all of this is not better detection. It is a procedure that never trusts the channel the request came in on: call back a number you already hold, require a second approver, write down what happened, and rehearse it. This article describes what that procedure looks like, where it breaks in practice, how to test it, and what the FBI, FinCEN and New York's financial regulator actually say.
- [What Insurers and Auditors Now Ask About Your AI](https://claytoncyber.com/insights/what-insurers-and-auditors-now-ask-about-your-ai/): Questions about AI are arriving in insurance renewals, vendor questionnaires and examinations. They tend to cluster around six things: a list of the AI you use, what each agent is allowed to do, what gets logged, where a human must approve, what testing has been done, and who is responsible. This article shows where those six come from. It draws on the Cloud Security Alliance's AI Controls Matrix, ISO/IEC 42001, the NIST AI Risk Management Framework and FINRA's 2026 Regulatory Oversight Report, and it describes what each one actually says. It also covers a change in general liability insurance forms that many businesses have not noticed. It is a map of the questions, not a compliance verdict.
- [Monitoring AI Agents in Microsoft 365: What You Can and Cannot See](https://claytoncyber.com/insights/monitoring-ai-agents-in-microsoft-365-what-you-can-and-cannot-see/): Many businesses already have AI agents running in Microsoft 365: Copilot, agents built in Copilot Studio, and agents that staff connect to company data. The question security teams ask is simple: what can we see them doing? The honest answer has layers. Microsoft Purview audit records show who interacted with Copilot and which files and sites it touched. Microsoft Entra records agent sign-ins. Since July 1, 2026, agent discovery, posture and threat detection in Microsoft Defender for Copilot Studio and Foundry agents require a Microsoft Agent 365 license. And some things are not visible at all, such as the prompt text in an audit record, the model version behind a Microsoft 365 Copilot answer, or what a local tool server on a laptop is doing. This article, based on Microsoft Learn pages read on November 8, 2026, sets out each layer and each gap.
- [Server Burn-In and Acceptance Testing Before Production](https://claytoncyber.com/insights/server-burn-in-and-acceptance-testing-before-production/): A new server that boots is not a server that is ready. Parts fail early more often than they fail in the middle of their life, and a fault found in the rack costs far less than one found during a customer outage. Burn-in is the planned stress of every subsystem before the machine takes real work, and acceptance testing is the written decision that it passed. This article walks through memory testing with MemTest86, CPU and system stress with stress-ng, storage tests with fio, GPU diagnostics with NVIDIA DCGM, firmware baselines and inventory through the DMTF Redfish standard, and the acceptance criteria and records worth keeping. It is based on tool documentation we read on November 8, 2026.
- [Structured Cabling That Survives the Next Refresh](https://claytoncyber.com/insights/structured-cabling-that-survives-the-next-refresh/): Servers and switches are replaced every few years. Cabling stays in the walls, trays and racks much longer, and it is the part nobody wants to touch during an outage. Cabling that survives the next refresh is labeled so a stranger can read it, documented so the records match the racks, laid so fiber is not bent past its limit, and patched with rules that people actually follow. This article covers labeling and administration under TIA-606 at a high level, MPO trunks and the three polarity methods, bend radius and service loops, patching discipline, and the documentation that keeps all of it true. It is based on pages we read on November 8, 2026, and gives no distances because those depend on standards we could not read and on your cable's datasheet.
- [Copilot Readiness: Fix Oversharing Before You Turn It On](https://claytoncyber.com/insights/copilot-readiness-fix-oversharing-before-you-turn-it-on/): Microsoft 365 Copilot answers from content the signed-in user can already reach. That is a safety feature and a warning at once: if a file is open to the whole company by mistake, Copilot makes it easy to find. Oversharing was always a risk. AI turns a hidden risk into one that a casual question can surface. Microsoft's own documentation says generative AI amplifies the problem of oversharing. This article explains how to find and fix oversharing before Copilot is switched on: sensitivity labels, SharePoint data access governance reports, Data Security Posture Management risk assessments, Restricted Content Discovery as a temporary brake, the retiring Restricted SharePoint Search, and the permission clean-up that actually removes the exposure. It is based on Microsoft Learn pages read on November 8, 2026.
- [Proving what you sent: immutable email archives with Amazon S3 Object Lock and AWS KMS](https://claytoncyber.com/insights/proving-what-you-sent-immutable-email-archives-s3-object-lock-aws-kms/): A saved copy of an email is not proof. To show years later what was sent, you need storage nobody can delete and a cryptographic record made at capture time. This article compares Amazon S3 Object Lock modes, AWS KMS options (SSE-KMS only, HMAC keys, asymmetric signing keys), supporting records such as S3 checksums and AWS CloudTrail, how to capture mail with Amazon SES or Microsoft 365 journaling, and how to verify it all later.

## Contact
- [Track record](https://claytoncyber.com/experience/)
- [Free security assessment](https://claytoncyber.com/assessment/)
- [Contact](https://claytoncyber.com/contact/)