CASE STUDY · MANAGED SASE
Migrating a hybrid workforce to managed SASE in under 60 days.
- 55 daysMigration completed in 55 days
- 32%VPN-related tickets down 32%
01 · PROJECT OVERVIEW
The client and the brief.
An anonymised mid-market company with 350 users across 5 sites. Name withheld under confidentiality.
Discovery, a pilot, a phased rollout and stabilisation.
- 1VPN performance problems and rising support tickets.
- 2Remote staff routed all traffic through one VPN concentrator, which struggled at peak times.
- 3Video calls dropped, file access crawled, and people began to disconnect from the VPN to get work done, which created risk of its own.
- 4The IT team was overloaded with tickets and wanted a fix with a clear end date.
02 · WHAT WENT WRONG
What went wrong, and how we fixed it.
Every engagement hits problems. These were the ones that mattered here, and what we changed so they did not come back.
- PROBLEM 01One finance application used a fixed source IP for a supplier's allow-list
When traffic moved to the new edge, the source address changed and the supplier connection broke on the first morning of that wave. We rolled that group back within the hour, arranged a dedicated egress address with the supplier and added "allow-listed third parties" to our discovery checklist. The wave resumed two days later.
- PROBLEM 02The wave resumed two days later
- PROBLEM 03A second hurdle came at the smallest site
Its internet link was a single consumer-grade line with frequent drops, and the new client reconnected slowly each time. Users blamed the new service. We added a second link at that site, tuned the reconnect behaviour and showed the site manager a simple graph of link drops that proved the cause.
- PROBLEM 04After that the complaints stopped
03 · THE PROCESS
How we ran it.
The migration finished in 55 days and followed five phases with a weekly call and a shared status page.
- 01Step 1
Discovery: inventory of sites, users, apps and traffic. We found which apps needed private access and which were already on the internet.
- 02Step 2
Design: policy groups by role, and a wave plan by site and team.
- 03Step 3
Pilot: the IT team and a small group of volunteers ran on the new service for about a week. We fixed profile issues and wrote the guides.
- 04Step 4
Phased rollout: site by site, with a briefing before each wave and a help channel during it.
- 05Step 5
Stabilisation: policy tuning against real traffic, then VPN usage review and shutdown planning.
04 · RESULTS
What changed.
Measured against the way the work ran before the engagement began.
- NOW 01
New apps are published through zero trust access, not by opening network ranges.
- NOW 02
Policy changes follow a short change process and are reviewed monthly.
- NOW 03
The IT team reads a monthly report of tickets, blocked threats and slow apps.
- NOW 04
The VPN concentrator is no longer the default answer to remote access.
- 55 days
Migration completed in 55 days
- 32%
VPN-related tickets down 32%
05 · WHAT WE BUILT
How it works.
- ZTNA for internal apps: each user can reach only the apps their role allows, not the whole network.
- Secure web gateway and firewall-as-a-service for internet traffic, with consistent policy at home and in the office.
- SD-WAN links at the five sites, with local breakout for cloud traffic.
- Single sign-on and multi-factor authentication tied to the existing identity provider.
- Device posture checks before access to sensitive apps.
- Logging to a central view for the monitoring team.
06 · QUICK ANSWERS
The short version.
- What problem did the client have?
- VPN performance problems and rising support tickets. Remote staff routed all traffic through one VPN concentrator, which struggled at peak times. Video calls dropped, file access crawled, and people began to disconnect from the VPN to get work done, which created risk of its own. The IT team was overloaded with tickets and wanted a fix with a clear end date.
- What did Brandsmashers build?
- Discovery, a pilot, a phased rollout and stabilisation.
- How was the work run?
- The migration finished in 55 days and followed five phases with a weekly call and a shared status page.
- What were the results?
- Migration completed in 55 days; VPN-related tickets down 32%.
YOUR TURN
Have a similar requirement?
Tell us what is stuck. We will come back with a plan and matched, pre-vetted engineers.
