Bartosz
Borowski

Phase 1 of a wider network modernisation programme. The goal was a solution genuinely fit for a fully cloud-based business: the incumbent Cisco Meraki estate was enterprise-grade infrastructure built for an on-premises world the business no longer operated in — significant overkill, and expensive with it. Led the end-to-end planning and delivery of a company-wide WiFi overhaul, replacing end-of-life Meraki access points with Ubiquiti UniFi U7 Pro Max (WiFi 7) APs across the main office and two remote sales centres.

Options Analysis & Business Case: Authored a full proposal covering options analysis, financial analysis, and a phased migration and implementation plan. After weighing enterprise alternatives against self-hosted options, UniFi offered the better balance of features and price — no recurring licensing fees, at the cost of a more hands-on management approach compared to Meraki's cloud-only model. Cloud management was still achieved via UniFi's own controller, and the cost-benefit analysis demonstrated projected savings of approximately £5,000 over five years.

Delivery: Managed procurement via competitive tender, salvaged an existing Intel NUC to avoid additional hardware costs, and deployed Ubuntu 24.04 LTS as the UniFi Network Management Controller host. Configured secure remote access, UFW firewall rules, VLAN-based staff/guest SSID segmentation, and zero-touch AP adoption across all sites. Resolved PoE+ compatibility issues and firewall port conflicts without service disruption.

Outcome: Migration was seamless and transparent to end users with no reported service disruption. Beyond the immediate WiFi refresh, this phase proved the UniFi platform's viability and set the business up for a wider UniFi migration across the rest of the network estate, delivered in Phase 2. The new infrastructure ensures Cyber Essentials compliance, supports the forthcoming WiFi 7-enabled Device-as-a-Service refresh, and is expected to remain relevant until at least 2031.

Designed and delivered a full mobile device management solution for all corporate Apple devices — iPhones, iPads, and Macs — integrating Apple Business Manager (ABM) with Microsoft Intune to achieve Cyber Essentials compliance and replace an entirely unmanaged estate.

Key Challenge: A critical early challenge was recovering an ABM account originally set up by a former employee with no documentation or handover. This required engaging Apple Business Support, compiling legal proof of company ownership, and successfully regaining full administrative control of the account.

Technical Delivery: Configured the full technical stack across both platforms: MDM Push Certificate, ABM-Intune enrolment token, automated enrolment profiles with supervised and locked enrolment, VPP token for corporate app deployment, and dynamic Azure AD group architecture for automatic device targeting. Deployed Microsoft 365, Defender, Teams, and Adobe Acrobat company-wide alongside role-specific apps for sales teams.

Rollout: Delivered in two phases — an IT pilot (Phase 1) followed by a full business rollout (Phase 2), during which a more efficient wireless enrolment method using iOS Apple Configurator was identified, eliminating the need for physical USB connections. Managed migration of all users from personal iCloud accounts to corporate Managed Apple Accounts.

Phase 2 of the network modernisation programme. Started, as with Phase 1, by re-analysing the available options and running financial planning against the features each offered, before making the business case for replacing the company's ageing DrayTek router with a UniFi Enterprise Fortress Gateway — addressing critical security gaps including the inability to inspect encrypted HTTPS traffic and no intrusion detection capability.

Business Case: Authored a detailed project brief including a full threat landscape analysis, vendor comparison across Fortinet, SonicWall, Cisco Meraki, and UniFi, and cost justification — securing approval for a one-time £1,617 investment with no recurring licensing, against enterprise alternatives costing £13,000–£34,000 over five years.

Phased Rollout: The main office was migrated first, executed out-of-hours within a planned two-hour maintenance window with full config backups, firmware preparation, colour-coded cable labelling, VLAN design, a step-by-step migration runbook, and a documented rollback strategy. Remote locations followed on UniFi equipment, and every site is now fully migrated onto the UniFi platform. Post-migration produced a full network topology diagram in Microsoft Visio.

Security Outcomes: The full UniFi rollout unlocked encrypted DNS (DoH/DoT), Intrusion Detection and Prevention (IDS/IPS) with daily signature updates, device and traffic identification, VLAN segmentation, rogue DHCP detection, dual PSU redundancy integrated with a new UPS, and split tunnelling via SD-WAN for remote sites.

Identity-Integrated Expansion: The platform was then extended with UniFi Fabric integrated with Entra ID, standardising and speeding up new-site deployment, plus a Zero-Touch VPN for secure, identity-based Azure SQL access — removing the need for manual VPN configuration or static per-user credentials.

Identified and made the business case for replacing Sophos Intercept X and Sophos Email Advanced with Microsoft Defender for Endpoint and Defender for Office 365, leveraging capabilities already included within existing Microsoft 365 Business Premium licences. Beyond the platform swap, the migration was used as the opportunity to deploy a suite of advanced Defender technologies aligned with Zero Trust and Microsoft best practices — capability the legacy platform didn't offer.

Business Case: Authored a cost-benefit analysis demonstrating projected savings of ~£15,500 over three years, with a one-off implementation spend of ~£2,500, eliminating ~£6,000 in annual recurring Sophos licensing costs. Engaged BCN Group as an implementation partner to manage risk.

Endpoint Hardening (Defender for Endpoint): Deployed Attack Surface Reduction rules via an Intune Endpoint Security Configuration profile, alongside Tamper Protection, real-time scanning with cloud-delivered protection, and Network Protection. Staged rollout across IT test, pilot, and business-wide phases with formal acceptance criteria across eight security controls.

Risk-Based Conditional Access: Layered Microsoft Entra ID Conditional Access on top of Defender and Identity Protection signals, with dedicated User Risk and Sign-in Risk policies that automatically challenge or block access when a user's credentials or sign-in behaviour are flagged as risky — extending Zero Trust enforcement beyond device compliance into real-time identity risk.

Automated Investigation & Remediation (AIR): Enabled AIR via Defender XDR to automatically investigate and act on detected threats. Device tagging was applied through configuration profiles based on device use case and function, feeding into endpoint device groups configured with different degrees of auto-remediation — from fully automatic remediation on high-confidence, low-risk detections through to approval-required remediation on higher-impact device groups — balancing response speed against operational risk.

Vulnerability Management: Used Defender Vulnerability Management and Secure Score to drive missing-patch discovery across the endpoint estate, with third-party application patches remediated via Intune-managed Win32 app deployments. SmartScreen was enabled tenant-wide for real-time reputation scanning of websites and downloaded applications.

Email Security (Defender for Office 365): Coordinated DNS delegation for DKIM and DMARC configuration, managed company-wide communications during switchover, and deployed a tiered Standard/Strict anti-phishing and anti-spam protection model. Configured impersonation protection for high-value targets (senior management), custom anti-spam policies to action user-reported spam, and Tenant Allow/Block List (TABL) entries for known-bad senders and domains. Malicious email is automatically withdrawn post-delivery via Zero-hour Auto Purge (ZAP), with suspicious links and attachments detonated in a sandboxed preview environment before reaching the inbox. Validated full SPF/DKIM/DMARC alignment post-cutover on 6th January 2026 with no outages.

Identified that a significant portion of Adobe Acrobat Pro licences were being consumed by a single, simple workflow — extracting individual pages from multi-page PDF construction drawing packages — and built a purpose-built internal Windows desktop application to eliminate it, using AI-assisted development to close the gap in my own coding background, with no external development cost or dependency.

The Application: Built in Python using open-source libraries (PyMuPDF, Pillow, Tkinter), the DH Stamp Plan Extractor provides a graphical interface for browsing PDF thumbnails, selecting pages manually or via keyword search, automatically extracting drawing titles from AutoCAD title blocks, and saving individual pages as standalone PDFs.

Technical Challenges Solved: The standard Tkinter file dialog does not load Windows shell namespace extensions, making ZeeDrive-mapped SharePoint locations invisible — resolved by replacing the dialog with direct Windows Common Dialog API calls via ctypes. AutoCAD PDFs write text layer-by-layer rather than in visual reading order, causing title block extraction to interleave labels with values — resolved with a two-strategy title parser combining phrase-line matching and a hardened label-skip list.

Deployment & Outcome: Packaged using PyInstaller and deployed silently via Intune as a Win32 app. Delivering ~£1,750 in annual savings with no ongoing licensing or vendor dependency.

AOC provides the Royal Armouries Museum with private WiFi infrastructure for events and the annual UKREiiF conference, where exhibitors purchase private connectivity for their stands. As the conference scale grew, bottlenecks in the existing infrastructure were limiting the number of paid connections available.

Scope: Led analysis, design, and implementation of a full network infrastructure upgrade to support 10G speeds across three independent buildings. The project involved coordinating new fibre line installs with an external contractor, building multiple pfSense-based firewalls and traffic shapers with 10G capability, and designing a 7-switch stack spanning the museum and surrounding areas.

Scale & Outcome: The network was designed to serve approximately 3,000 concurrent clients at peak during UKREiiF. Delivered on time with no delays and no outages to the wider museum staff or public WiFi during the implementation phase. The investment yielded positive financial return after UKREiiF, establishing AOC as a top-tier contractor with key museum stakeholders.

An ongoing modernisation programme across Duchy Homes that has, in total, delivered over 60 projects — some small, some large — overhauling the entire IT stack: networking, the Microsoft 365 environment, and cybersecurity. The programme has simultaneously reduced IT expenditure by ~20%+, with further reductions expected as it continues.

Key Initiatives: Apple ABM & Intune integration for iOS/iPadOS lifecycle management; WiFi modernisation from Meraki to UniFi across all sites (Phases 1 & 2); NUC and shared device Intune enrolment; Windows 11 upgrade programme; leased line cost optimisation (50% reduction); UniFi Enterprise Fortress Gateway deployment for IDS/IPS and Layer 7 inspection; Sophos→Defender endpoint and email migration; UPS installation for resilience; device refresh via competitive tender; phishing-resistant MFA for administrators; managed iOS web clip applications; meeting room device Intune management; enhanced anti-spam policies; tenant-wide Conditional Access expansion; printer OAuth migration; and platform-specific Defender policies.

Privileged Access Model Overhaul: Redesigned the privileged access model across both end-user and kiosk devices, moving from a legacy local-administrator model to identity-based, centrally managed elevation — removing standing local admin rights while preserving IT's ability to elevate on demand.

Automated Deployment at Scale: Built multiple automatic Windows Autopilot deployment profiles, driven by Group Tags, Device Categories, Dynamic Groups, and Scope Tags — automatically routing new devices to the correct policy, app, and administrative scope at enrolment with no manual profile assignment.

Outcomes: Microsoft 365 Secure Scores have reached over 90%, up from a ~55% baseline. IT-related costs have been reduced by ~20%+ through software licensing consolidation and managed connectivity optimisation, with further reductions expected. Security posture, resilience, and manageability have all improved materially, positioning Duchy Homes on modern, supportable platforms aligned with Microsoft and industry best practices.

Led a full review, tender, and migration of the company's Microsoft 365 backup platform, replacing a legacy Datto (Backupify) service that had not been reviewed since 2021 and carried a significant disaster-recovery gap: no backup or recovery capability for Microsoft Entra ID, the identity layer underpinning authentication, Conditional Access, and access to every M365 and SSO-connected service.

Supplier Tender & Selection: Ran a formal market tender, evaluating proposals against a weighted scoring model covering cost, Entra ID backup, restore capability, security and access control, auditability, platform usability, and strategic fit for in-house management. Keepit was selected as the strongest overall option — the only fully-capable platform offering Entra ID backup, cross-tenant restore, full action audit logging, and SSO, at a materially lower ongoing cost than the incumbent platform.

Migration Strategy: Backup platforms cannot transfer historical recovery points between vendors — proprietary snapshot formats mean a new platform always starts from a fresh baseline. To avoid losing access to pre-migration recovery data, designed a phased "reduced archive" migration: Keepit was deployed and run in parallel with the legacy platform for several months of overlapping coverage, a full historical snapshot was exported for safekeeping, and a minimal set of business-critical mailboxes were retained on reduced legacy licensing as a long-term archive — balancing cost reduction against continuity of historical recovery.

Secure Implementation: Deployed with a Zero Trust-aligned administrative model: a dedicated backup service account secured with phishing-resistant MFA and passkey authentication, Conditional Access requiring a compliant device for any access, and SAML SSO via Entra ID restricted to a controlled admin group. A break-glass account outside the SSO dependency chain was retained for emergency access. Version history retention was tuned to balance recovery flexibility against Microsoft Graph API throttling and storage growth.

Outcome: Cutover completed with zero errors across a multi-terabyte protected dataset spanning Exchange Online, SharePoint Online, OneDrive, and Microsoft Teams, validated through sample restore testing. Entra ID backup, cross-tenant restore, and Secure Shares are now live — the latter allowing read-only access to backed-up business data even during a Microsoft 365 service outage, directly closing the disaster-recovery gap the project set out to fix.

An in-house Zero Trust framework built end-to-end around three questions, aligned with Microsoft's best-practice guidance: who are you (identity), how are you (device compliance), and where are you (location) — delivered through MFA, device compliance policies, and Conditional Access. The entire stack was reworked around these three layers, with Conditional Access requiring all three to be satisfied simultaneously; if any one fails, access is restricted to the M365 tenant and to every SaaS platform that relies on SSO.

Who Are You — Identity: Multi-factor authentication enforced across the tenant, with phishing-resistant MFA layered onto administrative accounts, forming the first of the three required signals.

How Are You — Device Compliance: Over 25 platform-specific compliance policies designed and built in-house, covering both corporate and BYOD devices across Android, iOS, Windows, and macOS. Controls span endpoint security configuration, password and PIN policy, Windows Hello for Business enforcement, Microsoft Defender device risk level, device/storage encryption, and more. A custom compliance notification workflow — including a grace period on low-risk policies — gives users and IT time to self-remediate before enforcement escalates, replacing a notification-only model with one built around user empowerment.

Where Are You — Location: Known-location Conditional Access is enforced through static public IP addresses at managed sites, with split tunnelling deployed at locations constrained by dynamic IPs or CGNAT — ensuring a reliable location signal regardless of the underlying ISP connectivity.

Enforcement: Conditional Access policies gate access to Microsoft 365 and every SSO-integrated SaaS platform on the combined validity of all three layers, replacing what had been fragmented, partially-enforced controls with a single coherent framework aligned end-to-end with Microsoft Zero Trust guidance.

A self-built SFF (Small Form Factor) home server that has been running continuously since 2021. Built from scratch with hardware carefully selected for the specific demands of 4K Dolby Vision and HDR video transcoding — the key requirement being Intel QuickSync hardware acceleration, which allows high-bitrate 4K streams to be transcoded in real time without taxing the CPU.

Software & OS: The server runs the current Ubuntu LTS release — always upgraded to the latest long-term support version to ensure ongoing security patches and kernel support throughout the hardware's lifetime. Plex Media Server runs as a background service managing the media library and handling all local and remote playback requests. Windows devices on the local network can access the media library directly via Samba shares, providing a seamless file-transfer experience without any additional software required.

Maintenance & Efficiency: The server is configured for largely autonomous operation. Unattended-upgrades handles automatic OS and security patching. Scheduled overnight reboots allow maintenance windows to be applied without manual intervention, and HDD spindown add-ons reduce power draw during idle periods — keeping running costs low over time.

Remote Access & Security: Remote access is handled entirely via a Cloudflare Tunnel — there are no open ports on the home router. The cloudflared daemon maintains a persistent outbound connection to Cloudflare's edge through which all remote Plex traffic is routed. SSH access is available but restricted to a limited number of local devices via Ubuntu UFW firewall rules, with no remote SSH exposure.

A self-hosted Home Assistant installation that serves as the central automation hub for the home — powered by Claude API for energy analysis, forecasting, and recommendations. The system is built around maximising solar self-consumption, autonomous energy arbitrage, and optimising battery and grid usage to maximise return on investment from the installed energy systems.

Active Integrations: SolisCloud API (solar inverter & battery), Intelligent Octopus Go (smart overnight EV charging tariff), Octopus Saving Sessions (demand flexibility events), Octopus Free Energy Sessions (bonus free-energy windows), AxleVPP (event-based grid support battery dispatch), MyEnergi Zappi API (EV charger control), Tesla Fleet API (vehicle state & charging), Solar Forecast API (next-day generation predictions), Google API, Zigbee2MQTT (local Zigbee device control), and Thread/Google Home integration for smart devices.

Automations & AI: All logic is built in self-written YAML automations that run entirely locally. These automations coordinate charging schedules, battery dispatch, export decisions, grid support event participation, and EV charging windows based on real-time solar output, tariff pricing, weather forecasts, and battery state of charge. Claude API is integrated to provide natural language energy analysis, summarise daily performance, and surface recommendations — adding an AI reasoning layer on top of the raw sensor data.

Remote Access & Security: Home Assistant is accessible remotely via a Cloudflare Tunnel with Zero Trust policies enforced — no ports open, identity-gated access at Cloudflare's edge. SSH access to the host is restricted to a limited number of local devices via Ubuntu UFW firewall rules.

A self-managed home network built on Ubiquiti UniFi hardware centred on a UDR7 router, providing the reliable and controllable foundation on which Plex, Home Assistant, and all Cloudflare Tunnels run. The network operates on a static public IP address, which simplifies tunnel connectivity and ensures consistent routing for all outbound services.

Architecture: The network runs as a flat network without VLAN segmentation — a deliberate choice for the home environment where complexity is managed differently than in an enterprise context. Security is instead enforced through Zero Trust firewall rules that control traffic flows based on identity and destination rather than network segment, combined with Cloudflare Tunnels that eliminate the need for any inbound port exposure.

Management via UniFi Site Manager: The network is managed through UniFi Site Manager — Ubiquiti's self-managed cloud platform, included at no additional cost with UniFi hardware. Site Manager provides centralised visibility, remote access, and configuration management without introducing a third-party cloud dependency or recurring subscription. It represents strong value for money and mirrors the type of centralised management approach used in professional deployments. SSH access to network devices is available to a limited number of local devices only, controlled via UFW on the connected Ubuntu hosts.

Remote access to home lab services has gone through three distinct generations, each driven by a better understanding of the security trade-offs involved — evolving from a quick free solution into a properly engineered zero-exposure architecture.

Generation 1 — DuckDNS: Started with DuckDNS as a free dynamic DNS solution, with ports forwarded on the home router to reach Plex and Home Assistant. Simple and effective to set up, but required open inbound ports on the public IP — a direct attack surface that became increasingly uncomfortable as the services matured.

Generation 2 — Own Domain on Cloudflare: Migrated to a personal domain hosted on Cloudflare DNS, with Cloudflare acting as a proxy in front of the services. This added TLS termination and hid the origin IP, but inbound ports were still open on the router — traffic was just better obscured.

Generation 3 — Cloudflare Tunnels (Current): The current setup uses Cloudflare Tunnels exclusively. The cloudflared daemon on the home server maintains persistent outbound connections to Cloudflare's edge — there are no open ports on the router at all. All inbound traffic for Plex and Home Assistant routes through Cloudflare, with Zero Trust access policies enforcing identity verification before any request reaches the tunnel. The result is a genuinely zero-exposure architecture: no open ports, no origin IP visibility, and identity-gated access at the edge.