Bartosz
Borowski

Phase 1 of a wider network modernisation programme. The goal was a solution genuinely fit for a fully cloud-based business: the incumbent Cisco Meraki estate was enterprise-grade infrastructure built for an on-premises world the business no longer operated in — significant overkill, and expensive with it. Led the end-to-end planning and delivery of a company-wide WiFi overhaul, replacing end-of-life Meraki access points with Ubiquiti UniFi U7 Pro Max (WiFi 7) APs across the main office and two remote sales centres.

Options Analysis & Business Case: Authored a full proposal covering options analysis, financial analysis, and a phased migration and implementation plan. After weighing enterprise alternatives against self-hosted options, UniFi offered the better balance of features and price — no recurring licensing fees, at the cost of a more hands-on management approach compared to Meraki's cloud-only model. Cloud management was still achieved via UniFi's own controller, and the cost-benefit analysis demonstrated a strong reduction in total cost of ownership over five years.

Delivery: Managed procurement via competitive tender, salvaged an existing Intel NUC to avoid additional hardware costs, and deployed Ubuntu 24.04 LTS as the UniFi Network Management Controller host. Configured secure remote access, UFW firewall rules, VLAN-based staff/guest SSID segmentation, and zero-touch AP adoption across all sites. Resolved PoE+ compatibility issues and firewall port conflicts without service disruption.

Outcome: Migration was seamless and transparent to end users with no reported service disruption. Beyond the immediate WiFi refresh, this phase proved the UniFi platform's viability and set the business up for a wider UniFi migration across the rest of the network estate, delivered in Phase 2. The new infrastructure ensures Cyber Essentials compliance, supports the forthcoming WiFi 7-enabled Device-as-a-Service refresh, and is expected to remain relevant until at least 2031.

Designed and delivered a full mobile device management solution for all corporate Apple devices — iPhones, iPads, and Macs — integrating Apple Business Manager (ABM) with Microsoft Intune to achieve Cyber Essentials compliance and replace an entirely unmanaged estate.

Key Challenge: A critical early challenge was recovering an ABM account originally set up by a former employee with no documentation or handover. This required engaging Apple Business Support, compiling legal proof of company ownership, and successfully regaining full administrative control of the account.

Technical Delivery: Configured the full technical stack across both platforms: MDM Push Certificate, ABM-Intune enrolment token, automated enrolment profiles with supervised and locked enrolment, VPP token for corporate app deployment, and dynamic Azure AD group architecture for automatic device targeting. Deployed Microsoft 365, Defender, Teams, and Adobe Acrobat company-wide alongside role-specific apps for sales teams.

Rollout: Delivered in two phases — an IT pilot (Phase 1) followed by a full business rollout (Phase 2), during which a more efficient wireless enrolment method using iOS Apple Configurator was identified, eliminating the need for physical USB connections. Managed migration of all users from personal iCloud accounts to corporate Managed Apple Accounts.

Phase 2 of the network modernisation programme. Started, as with Phase 1, by re-analysing the available options and running financial planning against the features each offered, before making the business case for replacing the company's ageing DrayTek router with a UniFi Enterprise Fortress Gateway — addressing critical security gaps including the inability to inspect encrypted HTTPS traffic and no intrusion detection capability.

Business Case: Authored a detailed project brief including a full threat landscape analysis, vendor comparison across Fortinet, SonicWall, Cisco Meraki, and UniFi, and cost justification — securing approval for a one-time investment with no recurring licensing, at a fraction of the cost of comparable enterprise alternatives over five years.

Phased Rollout: The main office was migrated first, executed out-of-hours within a planned two-hour maintenance window with full config backups, firmware preparation, colour-coded cable labelling, VLAN design, a step-by-step migration runbook, and a documented rollback strategy. Remote locations followed on UniFi equipment, and every site is now fully migrated onto the UniFi platform. Post-migration produced a full network topology diagram in Microsoft Visio.

Security Outcomes: The full UniFi rollout unlocked encrypted DNS (DoH/DoT), Intrusion Detection and Prevention (IDS/IPS) with daily signature updates, device and traffic identification, VLAN segmentation, rogue DHCP detection, dual PSU redundancy integrated with a new UPS, and split tunnelling via SD-WAN for remote sites.

Identity-Integrated Expansion: The platform was then extended with UniFi Fabric integrated with Entra ID, standardising and speeding up new-site deployment, plus a Zero-Touch VPN for secure, identity-based Azure SQL access — removing the need for manual VPN configuration or static per-user credentials.

Identified and made the business case for replacing Sophos Intercept X and Sophos Email Advanced with Microsoft Defender for Endpoint and Defender for Office 365, leveraging capabilities already included within existing Microsoft 365 Business Premium licences. Beyond the platform swap, the migration was used as the opportunity to deploy a suite of advanced Defender technologies aligned with Zero Trust and Microsoft best practices — capability the legacy platform didn't offer.

Business Case: Authored a cost-benefit analysis demonstrating a strong multi-year saving against a modest one-off implementation spend, eliminating recurring Sophos licensing costs entirely. Engaged BCN Group as an implementation partner to manage risk.

Endpoint Hardening (Defender for Endpoint): Deployed Attack Surface Reduction rules via an Intune Endpoint Security Configuration profile, alongside Tamper Protection, real-time scanning with cloud-delivered protection, and Network Protection. Staged rollout across IT test, pilot, and business-wide phases with formal acceptance criteria across eight security controls.

Risk-Based Conditional Access: Layered Microsoft Entra ID Conditional Access on top of Defender and Identity Protection signals, with dedicated User Risk and Sign-in Risk policies that automatically challenge or block access when a user's credentials or sign-in behaviour are flagged as risky — extending Zero Trust enforcement beyond device compliance into real-time identity risk.

Automated Investigation & Remediation (AIR): Enabled AIR via Defender XDR to automatically investigate and act on detected threats. Device tagging was applied through configuration profiles based on device use case and function, feeding into endpoint device groups configured with different degrees of auto-remediation — from fully automatic remediation on high-confidence, low-risk detections through to approval-required remediation on higher-impact device groups — balancing response speed against operational risk.

Vulnerability Management: Used Defender Vulnerability Management and Secure Score to drive missing-patch discovery across the endpoint estate, with third-party application patches remediated via Intune-managed Win32 app deployments. SmartScreen was enabled tenant-wide for real-time reputation scanning of websites and downloaded applications.

Email Security (Defender for Office 365): Coordinated DNS delegation for DKIM and DMARC configuration, managed company-wide communications during switchover, and deployed a tiered Standard/Strict anti-phishing and anti-spam protection model. Configured impersonation protection for high-value targets (senior management), custom anti-spam policies to action user-reported spam, and Tenant Allow/Block List (TABL) entries for known-bad senders and domains. Malicious email is automatically withdrawn post-delivery via Zero-hour Auto Purge (ZAP), with suspicious links and attachments detonated in a sandboxed preview environment before reaching the inbox. Validated full SPF/DKIM/DMARC alignment post-cutover on 6th January 2026 with no outages.

What started as a single PDF tool became an ongoing programme of purpose-built internal applications — hands-on scripting and app development used to close operational gaps and explore what's genuinely achievable without a software engineering team, external cost, or third-party data exposure. Two workstreams sit under this: a PDF tooling suite that replaced a paid Adobe workflow, and a more ambitious Subject Access Request (SAR) toolkit built to speed up a sensitive, ICO-regulated disclosure process.

PDF Tooling Suite: Built a Python desktop app (PyMuPDF, Pillow, Tkinter) that extracts individual pages from multi-page PDF construction drawing packages — browsing thumbnails, searching by keyword, and auto-detecting drawing titles from AutoCAD title blocks. Solved real formatting quirks along the way, including a Windows file-dialog limitation that hid SharePoint-mapped drives and inconsistent AutoCAD text ordering. Packaged and deployed silently via Intune, it fully replaced a high-volume Adobe Acrobat Pro workflow with no ongoing licensing.

Subject Access Request (SAR) Toolkit — The Challenge: A Subject Access Request requires every piece of a third party's personal data to be found and redacted from disclosed emails before release, while the requester's own information is correctly retained — a slow, entirely manual process with real legal consequences for any missed redaction. Set out to build tooling to speed this up without compromising accuracy, testing four different approaches before landing on a production process now expected to cut SAR turnaround time by ~75%.

Approach 1 — Rule-Based Detection: Built an automated tool combining an off-the-shelf AI language model (spaCy) with pattern matching to detect and redact names, emails, phone numbers, National Insurance numbers, and bank details from email disclosures, with a full audit trail of every redaction made. Testing exposed a real limitation of general-purpose AI text models: they regularly mistook ordinary email sign-offs like "Kind Regards" for a person's name — a precision problem that couldn't simply be tuned away.

Approach 2 — Local LLM Experimentation: To close that gap, experimented with running large language models entirely on local hardware — no case data ever leaving the building, a hard requirement given how sensitive SAR data is. Combined a fast AI detection model (GLiNER) with a locally-hosted chat model (Qwen2.5, served via Ollama) reasoning over full passages rather than isolated words, plus a self-learning names database that got smarter with every case processed. It meaningfully reduced errors — but not to zero, and a legal disclosure has no room for a missed redaction.

Production Approach — Supported Manual Review: Once full automation was judged too risky for a legal disclosure, pivoted to a purpose-built manual redaction app with true, irreversible redaction (not a visual overlay) and a streamlined draw-save-next workflow for fast operator throughput — alongside a companion tool that converts raw emails to PDF exactly matching Outlook's own print formatting, ready for disclosure. Together, this toolkit is expected to cut SAR processing time by ~75% while remaining fully compliant with ICO data-handling requirements.

AOC provides the Royal Armouries Museum with private WiFi infrastructure for events and the annual UKREiiF conference, where exhibitors purchase private connectivity for their stands. After receiving the initial scope from museum staff, personally identified that the network's bandwidth — not just its switch count — was the real bottleneck limiting the number of paid connections the museum could sell, reframing what had been scoped as a straightforward refresh into a full infrastructure redesign.

Scope & Delivery: Led the surveys, design, and project planning for a full 10G infrastructure upgrade across three independent buildings, managing DataFlow as a subcontractor for key fibre and cabling infrastructure work, against an immovable UKREiiF deadline that could not slip. The project involved coordinating new fibre line installs, building multiple pfSense-based firewalls and traffic shapers with 10G capability, and designing the switch architecture spanning the museum and surrounding areas.

Network Resilience & Scale: Redesigned the topology from a linear daisy-chain into a resilient switch-stack architecture, removing the single points of failure inherent in the previous design. Built out 100+ VLANs, each NAT'd to its own public IP with an independent bandwidth controller, configured across multiple pfSense-based firewalls — giving every exhibitor stand genuinely isolated, rate-limited connectivity rather than a shared, best-effort pool.

Problem-Solving Under Pressure: A number of unexpected challenges emerged during delivery; each was resolved promptly, either by redesigning the affected part of the infrastructure or renegotiating delivery costs with museum stakeholders where additional work was identified as necessary — keeping the project on track against a conference date that could not move.

Outcome: Delivered on time with no delays and no outages to the wider museum staff or public WiFi during implementation. Revenue generated from the improvements significantly exceeded initial forecasts, strengthening trust between AOC and key museum stakeholders and establishing AOC as a top-tier contractor for future work.

An ongoing modernisation programme across Duchy Homes that has, in total, delivered over 60 projects — some small, some large — overhauling the entire IT stack: networking, the Microsoft 365 environment, and cybersecurity. The programme has simultaneously reduced IT expenditure by ~20%+, with further reductions expected as it continues.

Key Initiatives: Apple ABM & Intune integration for iOS/iPadOS lifecycle management; WiFi modernisation from Meraki to UniFi across all sites (Phases 1 & 2); NUC and shared device Intune enrolment; Windows 11 upgrade programme; leased line cost optimisation (50% reduction); UniFi Enterprise Fortress Gateway deployment for IDS/IPS and Layer 7 inspection; Sophos→Defender endpoint and email migration; UPS installation for resilience; device refresh via competitive tender; phishing-resistant MFA for administrators; managed iOS web clip applications; meeting room device Intune management; enhanced anti-spam policies; tenant-wide Conditional Access expansion; printer OAuth migration; and platform-specific Defender policies.

Privileged Access Model Overhaul: Redesigned the privileged access model across both end-user and kiosk devices, moving from a legacy local-administrator model to identity-based, centrally managed elevation — removing standing local admin rights while preserving IT's ability to elevate on demand.

Automated Deployment at Scale: Built multiple automatic Windows Autopilot deployment profiles, driven by Group Tags, Device Categories, Dynamic Groups, and Scope Tags — automatically routing new devices to the correct policy, app, and administrative scope at enrolment with no manual profile assignment.

Outcomes: Microsoft 365 Secure Scores have reached over 90%, up from a ~55% baseline. IT-related costs have been reduced by ~20%+ through software licensing consolidation and managed connectivity optimisation, with further reductions expected. Security posture, resilience, and manageability have all improved materially, positioning Duchy Homes on modern, supportable platforms aligned with Microsoft and industry best practices.

Led a full review, tender, and migration of the company's Microsoft 365 backup platform, replacing a legacy Datto (Backupify) service that had not been reviewed since 2021 and carried a significant disaster-recovery gap: no backup or recovery capability for Microsoft Entra ID, the identity layer underpinning authentication, Conditional Access, and access to every M365 and SSO-connected service.

Supplier Tender & Selection: Ran a formal market tender, evaluating proposals against a weighted scoring model covering cost, Entra ID backup, restore capability, security and access control, auditability, platform usability, and strategic fit for in-house management. Keepit was selected as the strongest overall option — the only fully-capable platform offering Entra ID backup, cross-tenant restore, full action audit logging, and SSO, at a materially lower ongoing cost than the incumbent platform.

Migration Strategy: Backup platforms cannot transfer historical recovery points between vendors — proprietary snapshot formats mean a new platform always starts from a fresh baseline. To avoid losing access to pre-migration recovery data, designed a phased "reduced archive" migration: Keepit was deployed and run in parallel with the legacy platform for several months of overlapping coverage, a full historical snapshot was exported for safekeeping, and a minimal set of business-critical mailboxes were retained on reduced legacy licensing as a long-term archive — balancing cost reduction against continuity of historical recovery.

Secure Implementation: Deployed with a Zero Trust-aligned administrative model: a dedicated backup service account secured with phishing-resistant MFA and passkey authentication, Conditional Access requiring a compliant device for any access, and SAML SSO via Entra ID restricted to a controlled admin group. A break-glass account outside the SSO dependency chain was retained for emergency access. Version history retention was tuned to balance recovery flexibility against Microsoft Graph API throttling and storage growth.

Outcome: Cutover completed with zero errors across a multi-terabyte protected dataset spanning Exchange Online, SharePoint Online, OneDrive, and Microsoft Teams, validated through sample restore testing. Entra ID backup, cross-tenant restore, and Secure Shares are now live — the latter allowing read-only access to backed-up business data even during a Microsoft 365 service outage, directly closing the disaster-recovery gap the project set out to fix.

An in-house Zero Trust framework built end-to-end around three questions, aligned with Microsoft's best-practice guidance: who are you (identity), how are you (device compliance), and where are you (location) — delivered through MFA, device compliance policies, and Conditional Access. The entire stack was reworked around these three layers, with Conditional Access requiring all three to be satisfied simultaneously; if any one fails, access is restricted to the M365 tenant and to every SaaS platform that relies on SSO.

Who Are You — Identity: Multi-factor authentication enforced across the tenant, with phishing-resistant MFA layered onto administrative accounts, forming the first of the three required signals.

How Are You — Device Compliance: Over 25 platform-specific compliance policies designed and built in-house, covering both corporate and BYOD devices across Android, iOS, Windows, and macOS. Controls span endpoint security configuration, password and PIN policy, Windows Hello for Business enforcement, Microsoft Defender device risk level, device/storage encryption, and more. A custom compliance notification workflow — including a grace period on low-risk policies — gives users and IT time to self-remediate before enforcement escalates, replacing a notification-only model with one built around user empowerment.

Where Are You — Location: Known-location Conditional Access is enforced through static public IP addresses at managed sites, with split tunnelling deployed at locations constrained by dynamic IPs or CGNAT — ensuring a reliable location signal regardless of the underlying ISP connectivity.

Enforcement: Conditional Access policies gate access to Microsoft 365 and every SSO-integrated SaaS platform on the combined validity of all three layers, replacing what had been fragmented, partially-enforced controls with a single coherent framework aligned end-to-end with Microsoft Zero Trust guidance.

A self-built SFF (Small Form Factor) home server that has been running continuously since 2021. Built from scratch with hardware carefully selected for the specific demands of 4K Dolby Vision and HDR video transcoding — the key requirement being Intel QuickSync hardware acceleration, which allows high-bitrate 4K streams to be transcoded in real time without taxing the CPU.

Software & OS: The server runs the current Ubuntu LTS release — always upgraded to the latest long-term support version to ensure ongoing security patches and kernel support throughout the hardware's lifetime. Plex Media Server runs as a background service managing the media library and handling all local and remote playback requests. Windows devices on the local network can access the media library directly via Samba shares, providing a seamless file-transfer experience without any additional software required.

Maintenance & Efficiency: The server is configured for largely autonomous operation. Unattended-upgrades handles automatic OS and security patching. Scheduled overnight reboots allow maintenance windows to be applied without manual intervention, and HDD spindown add-ons reduce power draw during idle periods — keeping running costs low over time.

Remote Access & Security: Remote access is handled entirely via a Cloudflare Tunnel — there are no open ports on the home router. The cloudflared daemon maintains a persistent outbound connection to Cloudflare's edge through which all remote Plex traffic is routed. SSH access is available but restricted to a limited number of local devices via Ubuntu UFW firewall rules, with no remote SSH exposure.

A self-hosted Home Assistant installation that serves as the central automation hub for the home — powered by Claude API for energy analysis, forecasting, and recommendations. The system is built around maximising solar self-consumption, autonomous energy arbitrage, and optimising battery and grid usage to maximise return on investment from the installed energy systems.

Active Integrations: SolisCloud API (solar inverter & battery), Intelligent Octopus Go (smart overnight EV charging tariff), Octopus Saving Sessions (demand flexibility events), Octopus Free Energy Sessions (bonus free-energy windows), AxleVPP (event-based grid support battery dispatch), MyEnergi Zappi API (EV charger control), Tesla Fleet API (vehicle state & charging), Solar Forecast API (next-day generation predictions), Google API, Zigbee2MQTT (local Zigbee device control), and Thread/Google Home integration for smart devices.

Automations & AI: All logic is built in self-written YAML automations that run entirely locally. These automations coordinate charging schedules, battery dispatch, export decisions, grid support event participation, and EV charging windows based on real-time solar output, tariff pricing, weather forecasts, and battery state of charge. Claude API is integrated to provide natural language energy analysis, summarise daily performance, and surface recommendations — adding an AI reasoning layer on top of the raw sensor data.

Remote Access & Security: Home Assistant is accessible remotely via a Cloudflare Tunnel with Zero Trust policies enforced — no ports open, identity-gated access at Cloudflare's edge. SSH access to the host is restricted to a limited number of local devices via Ubuntu UFW firewall rules.

A self-managed home network built on Ubiquiti UniFi hardware centred on a UDR7 router, providing the reliable and controllable foundation on which Plex, Home Assistant, and all Cloudflare Tunnels run. The network operates on a static public IP address, which simplifies tunnel connectivity and ensures consistent routing for all outbound services.

Architecture: The network runs as a flat network without VLAN segmentation — a deliberate choice for the home environment where complexity is managed differently than in an enterprise context. Security is instead enforced through Zero Trust firewall rules that control traffic flows based on identity and destination rather than network segment, combined with Cloudflare Tunnels that eliminate the need for any inbound port exposure.

Management via UniFi Site Manager: The network is managed through UniFi Site Manager — Ubiquiti's self-managed cloud platform, included at no additional cost with UniFi hardware. Site Manager provides centralised visibility, remote access, and configuration management without introducing a third-party cloud dependency or recurring subscription. It represents strong value for money and mirrors the type of centralised management approach used in professional deployments. SSH access to network devices is available to a limited number of local devices only, controlled via UFW on the connected Ubuntu hosts.

Remote access to home lab services has gone through three distinct generations, each driven by a better understanding of the security trade-offs involved — evolving from a quick free solution into a properly engineered zero-exposure architecture.

Generation 1 — DuckDNS: Started with DuckDNS as a free dynamic DNS solution, with ports forwarded on the home router to reach Plex and Home Assistant. Simple and effective to set up, but required open inbound ports on the public IP — a direct attack surface that became increasingly uncomfortable as the services matured.

Generation 2 — Own Domain on Cloudflare: Migrated to a personal domain hosted on Cloudflare DNS, with Cloudflare acting as a proxy in front of the services. This added TLS termination and hid the origin IP, but inbound ports were still open on the router — traffic was just better obscured.

Generation 3 — Cloudflare Tunnels (Current): The current setup uses Cloudflare Tunnels exclusively. The cloudflared daemon on the home server maintains persistent outbound connections to Cloudflare's edge — there are no open ports on the router at all. All inbound traffic for Plex and Home Assistant routes through Cloudflare, with Zero Trust access policies enforcing identity verification before any request reaches the tunnel. The result is a genuinely zero-exposure architecture: no open ports, no origin IP visibility, and identity-gated access at the edge.

A self-designed smart heating system built to fix a problem most "smart" TRVs never solve: they decide whether to call for heat using temperature readings alone, with no awareness of whether their own valve is actually open. Small, normal calibration variation between a TRV's temperature sensor and its valve mechanism means the boiler frequently keeps firing on a room whose valve has already physically closed — wasted heat, wasted gas, no benefit. Built on Google Nest, Zigbee smart TRVs, and a network of temperature/humidity sensors, all coordinated through a Home Assistant server running 30+ custom automations.

The Problem — Closing the Calibration Gap: Standard TRVs expose only a target temperature to the smart home layer; they never report whether the physical valve itself is open or closed. In practice, every TRV calibrates slightly differently, so a room can read "still cold" and keep calling for heat for several minutes after its valve has fully closed — the boiler keeps circulating hot water to a radiator that's no longer accepting any. Identified this gap through direct monitoring of valve state vs. reported temperature across the home, and built automations that check actual TRV valve position before allowing a room to request heat.

Automations & Control: Over 30 custom Home Assistant automations coordinate the system: valve-state-aware heat calls per room, geofencing via Google Nest/Home Assistant to pre-heat ahead of arrival and set back automatically when everyone's away, occupancy- and usage-pattern-based scheduling built from real-world historical data rather than fixed timers, and demand aggregation logic that only calls the boiler on when at least one valve in the relevant zone is genuinely open.

Sensors & Hardware: Zigbee-based smart TRVs provide per-radiator control and valve-state reporting, paired with dedicated temperature/humidity sensors in key rooms to decouple "room comfort" readings from the TRV's own on-valve sensor — giving the automations a more accurate picture of actual comfort versus valve behaviour. Google Nest provides whole-home thermostat control and the geofencing signal that drives arrival/departure automations.

Outcome: Based on energy consumption forecasting and before/after usage analysis, the system has reduced heating-related costs by 15%+, while improving actual comfort — rooms reach and hold target temperature more reliably — and reducing emissions from cutting unnecessary boiler run-time.