We work best with companies where technology runs the work. Each page below covers one of those industries and names the software, the rules and the figures that belong to it.
Six industries, and the specific question each page answers
Each one comes at the same three questions from inside your own industry: where the risk sits, where your people lose time, and how your spend compares with firms doing the same work.
Robotics
ROS 2 ships with none of its DDS security features switched on, and the project's own design documentation says so. Turning them on means standing up certificate authorities, which is a project with an owner and a schedule. The page also covers the Universal Robots controller advisory published in May 2026 and the questions a medical device or defense buyer asks before signing.
A sequencer or a mass spectrometer arrives with a computer attached, and that computer is usually the oldest thing in the building. The instrument vendor signed off on one configuration and no other. The page covers protecting a machine you are not free to change. It goes on to what Part 11 asks of your records, and what a regulator expects to find in your agreement with an IT provider.
A SOLIDWORKS PDM vault is a SQL Server database with a separate file archive behind it, and treating it as a folder is how firms damage one. The license server is the other machine that stops an entire floor at once. Both have a supported fix, and the page gives Dassault's and Autodesk's published wording for each.
Autodesk classes file-based worksharing through a VPN as an unsupported workflow that can corrupt a central model. Most firms discover that on a deadline week. The published wording is quoted in full. Bluebeam Studio and where its data sits gets the same treatment, and so does the question your liability carrier has started asking about AI.
Bank details change over the life of a job, so a request to change them raises nobody's eyebrow. That is what makes funds transfer fraud work in construction. The page also covers jobsite connectivity that outlives one project, and the thirty-day window Procore gives you to pull your data out.
Strategic theft, where somebody takes a load with credentials and never touches a lock, grew far faster between 2022 and 2024 than cargo theft as a whole, and California recorded more incidents in 2025 than any other state. The page walks the accounts a thief uses, from the email mailbox to the load board to the tracking portal.
Four controls we set up the same way whatever you make
These four do not change with your industry. We set them up the same way for every partner, because between them they carry more risk than anything industry-specific does.
Monitoring that runs when nobody is there
Monitoring does not keep office hours, so a failure at two in the morning is on the record before anyone arrives. A security alert reaches an analyst who is on duty at that hour and who does something about it. Our help desk itself is staffed on weekdays, from 5 in the morning to 6 in the evening Pacific, and we say so plainly rather than let you assume otherwise. How the monitoring works.
Backups somebody has restored from
A backup nobody has restored from is a plan, not a capability. We test restores on a schedule and tell you how long yours took, which is the number your insurer and your largest client will both eventually ask for. Ransomware and disaster recovery.
Multifactor on anything that moves money or work
Mailboxes, the finance system, the load board, the model repository, the remote access. More cyber insurance claims come from funds transfer fraud than from anything else, and the way in is almost always a mailbox somebody else can open.
Somebody to answer the questionnaire
Client security exhibits, insurance renewals and buyer reviews all arrive with a deadline and a form. We read it, test what it asks for, close what we can and hand back dated evidence you can attach. Cyber insurance readiness.
Proof, not promises
9 to 1
Dean Lewis Associates: nine servers became one, and 25 to 30 thousand dollars a year stopped going out the door.
11 to 2
V&A Consulting Engineers: eleven servers became two, the files went into Egnyte, and the savings ran into tens of thousands once hardware, maintenance, backup and downtime were counted together.
Backup in a bag
Child Truck Line: backups left the building by car every evening, and a server nobody could reach put the operation on hold for hours several times a month. What replaced it.
Common questions
Before you pick a page
We are not in any of these six industries. Is there any point reading on?
Yes, and the honest test is short. If nobody outside your company publishes requirements about how your work must be done, an industry page would tell you nothing a services page does not. Partners of ours in every sector get the same four controls described above, and those four carry most of the risk. Read the monitoring and recovery pages instead, and if a client contract or an insurer starts asking you questions we can take that on directly.
We are more than one of these. Which page applies?
Read the one that carries your hardest obligation, then skim the other. A design-build contractor should start with construction and take the model behavior from architecture. A robotics company shipping a regulated device should start with robotics for the product and take the records and validation material from biotech. Nothing in one page contradicts another, because we split them by what you owe somebody rather than by job title.
Do you actually support the software we run, or is that marketing?
We name products, and where a vendor has published something awkward we quote it instead of working around it. We keep the environment those products depend on healthy. We do not train your staff to use them, and every page says which of the two it is talking about. If you run something we have not worked with, ask before you sign anything. A firm that guesses at your line-of-business system invites a question it will fail in month two.
Do we have to change everything at once?
No. Two controls come first because they change your worst day: multifactor, and a restore somebody has actually completed and timed. Both can be done inside a few weeks without touching how anybody works. Storage moves, instrument segmentation and platform migrations come after, planned around your project calendar or your validation schedule. We have never needed a client to stop working for us to start.
Where do you work?
We support partners across the United States, and the places we know best are the ones we have worked in longest: Northern California, Portland and Vancouver in Washington. Our office is in Newark, California. Most of the work happens remotely, and we come on site when the problem is physical, which in these industries means a lab, a plant floor, a warehouse or a jobsite trailer.
What happens in a fifteen-minute call?
Mostly we listen. Fifteen minutes is enough to understand the business and what you are trying to get done over the next year or two, and not much more than that, which is deliberate. Technology spending that is not pointed at your objectives is only cost, so the objectives have to come first. What follows is the specific part, and it tends to land on three things. Risk you are carrying without having priced it. Time your people lose to technology that gets in their way. The gap between what all of this costs you and what comparable firms in your industry pay. If we cannot see room to move on at least one of those, we will tell you and not send a proposal.
Not sure which of these is yours?
Fifteen minutes is usually enough to point at the weakest part of your setup.
