Zero Trust Network Engineering for a Cold-Chain Operator
Refrigeration controls fenced off from the office network, facility by facility, with no product lost to a cutover.
Client name withheld by agreement- Client
- Temperature-controlled warehousing operator, 64 facilities
- Region
- Fort Worth, Texas and the Midwest
- Year
- 2026 · Ongoing
- Duration
- 36 weeks
- Scope
- 64 facilities · 5,000 refrigeration controllers · Azure and AWS
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A temperature-controlled warehousing operator runs 64 facilities that store food and pharmaceuticals for national brands. Five thousand refrigeration controllers sat on the same flat network as office PCs, guest Wi-Fi and the warehouse management system.
A ransomware infection that reached the controllers could spoil millions of dollars of product in hours. Facilities run every hour of every day, and no one would accept a change that risked a temperature excursion.
What we did
The approach, step by step.
- 01
Controllers and their dependencies inventoried
Passive discovery identified every refrigeration controller, sensor gateway and the handful of systems each one genuinely needs to talk to.
- 02
Zones built facility by facility
Office, warehouse operations and refrigeration control were separated into enforced zones in planned waves, with on-site rollback for every cutover.
- 03
Remote access through identity
Vendor and technician access moved from shared VPN accounts to identity-based, recorded sessions limited to the equipment each person maintains.
- 04
Cloud connections controlled
Traffic between facilities, Azure and AWS now passes through policy enforcement points with logging the security team can query.
- 05
Every wave tested
Network penetration tests after each wave confirmed that a compromised office device could no longer reach refrigeration control.
Outcomes
What changed, in numbers.
- 64
- facilities in the segmentation program
- 5,000
- refrigeration controllers isolated from office networks
- 0
- temperature excursions caused by cutovers
- 100%
- of completed waves verified by testing
We rebuilt the network under live freezers and never lost a pallet.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Denver, Colorado · 15 weeks
AI, Cloud & Digital Trust · 2025SOC 2 Type II for a Legal E-Discovery PlatformAn unqualified Type II report covering Security and Confidentiality, delivered before the Am Law 100 renewal cycle.
-
Seattle, Washington · 22 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Contact-Center AI ProviderVoice agents that can no longer be talked into reading back card numbers, and an AI management system heading for certification.
-
Houston, Texas · 24 weeks
AI, Cloud & Digital Trust · 2024Cloud Security Platform for a Genomics LaboratoryPetabytes of patient genomes locked behind one set of guardrails, with no slowdown in sequencing turnaround.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.