Case Studies: Real Engagements, Real Results

A mid-size Southern California law firm ran everything on-premises — file servers, domain controllers, billing and accounting applications. Then Southern California's grid instability turned into a pattern: every half-day outage meant attorneys locked out of case files and billable hours walking out the door. When the wildfires triggered a week-long regional outage, the firm's entire operation was on the line.

First, the bridge: eTop sourced and deployed a generator that same week, keeping the firm operational through the crisis. Then, the fix: a phased migration to Microsoft Azure — files first, then application servers and identity, validating each phase — with the firm's legal billing and accounting systems preserved exactly as attorneys knew them. Security modernized along the way: Zero Trust remote access replacing VPN, consolidated Microsoft Defender, cloud disaster recovery.

• Core infrastructure now runs beyond the reach of local power failures
• Attorneys reach case files from court, home, or office — no VPN headaches
• A firm-wide migration with no disruptive cutover — billing never stopped
• The modernized monitoring later caught and contained a sophisticated phishing attack within minutes

On an ordinary January afternoon, ransomware made its move on a workstation at an Inland Empire manufacturer: an encoded PowerShell command attempting token manipulation and secondary process execution. No suspicious attachment, no malware file sitting on disk — the exact attack pattern traditional antivirus misses, because there's no known-bad file to match.

The layered defense did its job, layer by layer. Behavioral detection identified the activity as ransomware staging and blocked execution before encryption started. Within minutes, 24/7 monitoring automatically isolated the host from the network — policy, not heroics. A critical incident report was triaged in seconds, and a senior engineer approved a formal remediation plan the same hour: credentials rotated, perimeter and endpoint logs audited, environment verified clean.

• Ransomware blocked at execution — zero files encrypted
• Compromised host automatically isolated from the network within minutes
• Structured remediation completed and verified the same day
• Production never stopped — most of the company never knew it happened

A Southern California manufacturer lives on vendor email — invoices, remittance advice, payment details. That's exactly the traffic business email compromise (BEC) attackers want to sit inside. During routine monitoring, eTop's identity-monitoring stack flagged hidden inbox rules in a staff mailbox, built to intercept and bury payment-remittance emails from a major vendor — the classic staging pattern for diverting payments to attacker accounts.

The rules were disabled and the account secured the same day, before any payment moved. Then the whole pipeline got hardened: spam filtering re-tuned (moving roughly 6,000 additional junk messages a month out of inboxes), quarantine locked so confirmed phishing can't be self-released, and domain authentication strengthened so the company's own identity can't be spoofed. When attackers returned two months later with an adversary-in-the-middle attack, the monitoring caught that too.

• Two distinct email-compromise attempts caught before money moved
• Roughly 6,000 fewer junk messages reaching inboxes every month
• Email authentication hardened across company domains
• 24/7 monitoring that has proven itself twice against real adversaries

A mid-size Southern California engineering firm needed its aging core server replaced — right as the AI boom sent enterprise storage prices climbing 5–10% per week and stretched lead times past 90 days. eTop spec'd the right build and said the uncomfortable part out loud: prices had nearly doubled since fall, and we wouldn't cut the spec to hide it. The firm's operations team then did what good operators do — took our spec to the manufacturer directly and found it cheaper.

We didn't defend the markup. We reviewed the direct quote line by line, confirmed it met the environment's needs — and then upgraded it, swapping the storage to higher-performance NVMe drives that made the direct purchase better than our original quote. The firm ordered direct, with our blessing; eTop kept the work that actually needs an IT partner: deployment, migration, validation, and management. We also root-caused a year-old CAD crash problem (a deterministic profile-initialization fault — not the hardware) and rebuilt the deployment so it can't recur.

• Server purchased at the best available price — advice untied from markup
• New workstation fleet onboarded to a verified security and management standard
• Mission-critical CAD software stabilized with a documented root cause, not a shrug
• Entire fleet moved to Windows 11 ahead of Microsoft's end-of-support deadline

A Southern California construction company signed with eTop needing a full transition — new server, network, Microsoft 365, and security stack — while the previous provider's tooling was still on every machine and the business kept estimating, building, and billing. This is the scenario that keeps owners with the wrong provider for years: the fear that switching means chaos.

A project plan, not an act of faith. When the server's delivery date slipped, the client heard about it immediately — and everything that didn't depend on the server started anyway: network configuration, Microsoft 365 planning, and endpoint preparation ran in parallel. Discovery caught the previous provider's remote-management agents still running — including tooling nobody could account for — and every legacy agent was catalogued and removed. The phone cutover was deliberately held until the carrier confirmed timing, instead of forcing a date and breaking phones.

• Operations ran throughout the transition — no chaos, no dead air
• Previous provider's agents fully catalogued and removed from every endpoint
• Parallel workstreams with named owners instead of a single waiting line
• Monitoring and automation configured before go-live, not bolted on after

A Southern California dealership — sales floor, service bays, parts counter, and back office on one network — had outgrown the legacy server-and-group-policy model: files on mapped drives, device settings that only applied when machines talked to the domain, and per-machine print and kiosk setups maintained by hand across roughly 75 endpoints. As a dealer handling consumer financing data, FTC Safeguards Rule expectations loomed over all of it.

Audit first, then migrate. eTop ran a full four-way endpoint audit — every machine cross-referenced across the service desk, deployment, remote access, and security monitoring platforms — clearing out ghost records and surfacing coverage gaps before anything moved. Then the phased shift: department files and home directories to SharePoint and OneDrive (with every mapping verified before cutover), device management to cloud-based Intune policy — including kiosk mode for shared floor machines and universal print — and endpoint security consolidated under Microsoft Defender.

• Every endpoint verified across four management platforms before migration
• Files reachable securely from any managed device — no file-server dependency
• Kiosk, print, and security policy enforced from the cloud, not per-machine
• Access controls and monitoring the dealership can demonstrate for FTC Safeguards and insurers