Customers · 5 stories
Specific estates. Specific nights. Numbers we checked.
Every story below names the workload, the timestamp and what was still wrong after we finished. Where a customer would have been fine without us, we say so — and Quantar's 14 gigabytes did leave.
- Logistics
- Retail banking
- Biotechnology
- E-commerce
- Local government
Featured · Northwind Freight
A CI token left the building. It came back forty-one seconds later.
A deploy token leaked into a public build log at 02:11. Aegis paged Northwind's on-call at 02:12, with the ASN, the calling identity and the four API calls it had already made.
- 41sLeak to page
- 4API calls before containment
- 71%Fewer pages per week
Read the story
Helix Bank Retail banking Enterprise
Six weeks of audit evidence, rebuilt as a four-day export
Helix needed every security-relevant event to stay inside the EU, and needed to prove it to a regulator. The proof used to take a team of four six weeks. It now takes one person four days.
- 4 daysAudit evidence pack
- 100%Events never leaving the EU
Read the story
Quantar Genomics Biotechnology Business
2.3 terabytes were queued to leave. Fourteen got out.
A compromised research notebook started staging a genome archive to an external bucket. Egress baselining caught it inside two minutes, at 14 GB of a 2.3 TB transfer.
- 14 GBExfiltrated before cut-off
- 1m 48sFirst byte to containment
Read the story
Vexel Commerce E-commerce Enterprise
9.2 billion events in peak week, and a quieter on-call than in July
Vexel's traffic multiplies by eleven in the last week of November. Their alert volume used to multiply with it. Correlation broke that link — peak week 2025 was their quietest on-call of the year.
- 9.2BEvents in peak week
- -58%Pages during peak week
Read the story
Meridian Public Works Local government Team
Two people, forty-one services, and nobody to outsource to
Meridian's entire security function is two people who also run the platform. They did not need a SOC. They needed the six alerts a week that were actually worth reading.
- 6Pages per week
- 2People on the security team
Read the story
Every figure on these pages came out of the customer's own console and was checked by the named person before publication. Where a number moved for reasons that were not us — a team growing, a migration, a policy change — the story says so. Three customers asked us to remove a detail; we removed all three and noted the gap rather than replacing them with something flattering.
If you want to speak to a reference directly, ask on the demo call. We will introduce you to a customer in your sector and leave the call.
Your estate next
Bring the awkward question to the first call.
The one about the thing you know is misconfigured, or the identity nobody will take responsibility for. Those calls are more useful than the polished ones.