STORIES · 62 OUTCOMES
What clients brought us, and what changed
Every story follows the same order: the problem, why it mattered, what we did and the result. Clients are described by category, not by name.
One story from each dimension
A cloud environment with no disaster-recovery plan was rebuilt from code in about 40 minutes
Mock CMMC audit traces most failed objectives to one undocumented decision: where the regulated data lives
Five-week AI proof of concept routes customer requirement updates to their owners, then goes to production
All stories
Eleven printer platforms, one deadline: testing one device per family got the certification evidence in time
Contractor asks for a security scorecard and learns it has nothing to score
Contractor cuts internal critical vulnerabilities from 76 to 12 with a fractional CISO and a one-page dashboard
Before launching a product that holds customer portfolios, a data provider had it attacked first
Market-data provider goes from full compromise in four hours to two findings across four years of benchmarking
A 24-finding assessment became a costed 12-month roadmap the contractor actually executed
A mid-rollout check-up turned a stalled personal-phone debate into a working pilot
Contractor gets a working SIEM across two firewall brands, cloud and job-site WiFi with no analyst
After the same account was phished twice in a year, a small consulting firm stopped trusting passwords alone
Data center operator learns its security gap is process, not products, and finds a path to CIS IG2 without new tools
Distributor turns a cyber insurance application into an evidence-backed audit of its own controls
Four years after its first insurance audit, a distributor re-verifies its controls for a tougher ransomware application
Distributor cuts its phishing failure rate from 26 percent to under 1 percent in eight monthly campaigns
Engineering firm turns a paper classification policy into labels every employee sees
A three-month vCISO trial that started with 13 policies became a two-year security program
Growing distributor learns its whole operation depends on one IT person
The network was locked down, so the testers went through overlooked devices
Biotech learns its AI rollout is only as safe as the access decisions nobody was making
Acquisitive industrial company learns its biggest security gap is that no one owns security
Manufacturer learns it detects attackers well but lets them in too easily
Software firm that secured its flagship product finds half its own corporate controls unimplemented
Health-data software company turns one secure-development assessment into two customer-facing attestations
Real estate developer raises its protection grade from D to A- across three penetration tests
Utility fixes a pen-test report by changing how everyone signs in
Utility's office printer turns out to be the front door to domain administrator
Real estate firm's zero-trust rebuild holds up under attack, but its building systems do not
Three modest flaws added up to an admin-portal takeover path at a pet-care startup
MSP finds it gives away security services competitors charge for, and flaws in its own tenants
Every email-security layer worked as designed, and the phish still got through
Bank-software vendor tests its rewrite three times during development and ships with zero high-severity findings
Small software vendor runs a bank-grade security program for three years without a security hire
Insurtech fixes a platform-wide session-takeover flaw before its re-test, then locks in an annual security cadence
Law firm makes a stolen password useless by requiring the device, not just the user, to be known
A cloud environment with no disaster-recovery plan was rebuilt from code in about 40 minutes
Distributor rehearses a vendor-payment fraud attack and rewrites its first containment step the same day
Fiber provider retires seven unsupported firewalls by proving every rule dead before deleting it
A fiber provider starts unwinding three inherited networks and a manual failover
Lender learns within days that two backdoors were planted but never used
Distribution cooperative turns untested continuity beliefs into tabletop-tested recovery plans in eight months
Law firm's backups pass the audit, but the administrator accounts around them turn out to be the weak link
Aerospace startup gets a 12-month IT plan that lets it scale without hiring an IT department
Construction firm replaces a troubled VPN with a single-tunnel design and gets its remote applications working again
Financial-services company folds an acquired SaaS business into its Microsoft tenant with Vizius as technical lead
The compliant enclave was sound, but the production machines connecting to it kept falling out of compliance
A defense supplier had the controls but not the paperwork; scoring first showed where the points were
Service teams kept attaching regulated files to the CRM, so the CRM was made to hand them to the enclave
Data center operator discovers its audit scope stopped where its biggest risks began
Construction firm maps how work really flows and finds CMMC Level 1 comes down to five habits
Manufacturer finds export-controlled data in ordinary email and fixes it without re-tooling the whole company
Manufacturer heading for ISO 27001 learns its controls exist but almost none can be proven
Manufacturer's U.S. site learns its biggest CMMC gap is who runs its IT, not which controls it has
Contractor turns its mobile device settings into CMMC Level 1 evidence by mapping each one to a control
Mock CMMC audit traces most failed objectives to one undocumented decision: where the regulated data lives
Post-merger data sovereignty: protect the file, not the network, when segmentation is impossible
Contractor asks where to start with AI and learns its real problem is re-keying data between systems
Industrial services company turns an AI vision into working payroll and reporting automation
A fractional chief AI officer turned a forty-site company's AI ideas into a program that delivered
Manufacturer keeps its AI program in-house, renting the judgment and then the hands
Five-week AI proof of concept routes customer requirement updates to their owners, then goes to production
Benefits company drops a capacity tier after cutting peak refresh memory from over 25 GB to about 11 GB
Engineering team turns 'we should do something with AI' into costed use cases and a governance model
In their words
Clients' own words, shared with their permission. Some chose to name their company.
Vizius has been a great partner for 3D Systems. Their team took the time to learn and understand our diverse business and IT needs, while adapting their solutions to our company priorities. The professionalism and execution of the entire Vizius team have been outstanding. We look forward to continuing our partnership with Vizius on future projects.
Walter RoweSVP, Chief Information Officer, 3D SystemsAs a part of our ongoing focus on objective quality and value, Vizius helped us with a thorough analysis of our security practice. Both what we practice internally as well as those we provide for our customers. We found their expertise and perspective both valuable and practical and feel confident in recommending their services to our customers and partners.
Chris SaahFounder & Chief Customer Officer, TecFac Business Services GroupVizius joined CRAG, a leading MSSP/MSP, to directly interact with their clients, leading hands-on sessions that translated core AI concepts into practical use-cases. The result was a shared understanding of where AI fits, quicker path from idea to pilot and more concrete understanding of what AI can and can't do.
Brad HamlettPrincipal, CRAGRecognize your own situation?
Tell a Principal Engineer which story sounds like you. Thirty minutes, no slide deck.
Talk to a Principal Engineer
Prefer email? Send us a note instead.