The situation
A general insurer replacing a policy administration system. 1,900 tables, column names like FLG_7, and the people who designed it left in 2016.
Home / Use cases
Use cases
Real problems, and the way we actually solved them.
Six engagements, in detail: the situation, why it was hard, the architecture we built, and what changed. Including the parts that needed a human.
Data migration
Migrating a 14-year-old platform with no data dictionary
Why it was hard
The vendor quoted eighteen months, most of it manual archaeology. Nobody could say which tables were still written to, and a wrong mapping is a mispriced policy.
Architecture
Source through to cutover, with a human on anything below 85%.
Source PAS
Schema profiler
Mapping queue
Underwriter review
Target system
What we built
-
Automated schema archaeology.
Profiling every table for real usage, formats and relationships, rather than trusting the documentation that did not exist.
-
Confidence on every mapping.
High-confidence mappings ran unattended; anything below 85% queued for an underwriter, with the evidence attached.
-
Reconciliation as a gate.
Each migration run compared row counts and column checksums back to source. A mismatch stopped the run, it did not get logged.
-
Repeatable dry runs.
The whole migration ran nightly against production copies for six weeks before cutover.
Result
- 7 mo
- Instead of the quoted 18
- 100%
- Mappings with a reviewable trail
- 0
- Rollbacks at cutover
Infrastructure modernisation
Modernising an estate nobody had a complete map of
Why
The situation
A 400-server estate across two datacentres and three cloud accounts, grown by acquisition. Four teams each held part of the picture and none held all of it.
Hard
Why it was hard
Every migration plan stalled on the same question: if we move this, what breaks? The dependency list lived in people's heads, and two of those people had resigned.
Architecture
Discovery from traffic, then waves to the right target.
Netflow & configs
Dependency graph
Wave clusters
Public / private / stay
Cost per wave
What we built
-
Discovery before opinions.
Two weeks of agents reading netflow, configs and traces, so the dependency graph came from traffic rather than memory.
-
Waves, not a big bang.
Clustering grouped tightly coupled systems together, so each wave could move and be verified on its own.
-
The right target per workload.
Spiky and stateless went to public cloud; steady and regulated to private; a handful stayed put with a review date rather than a pretence.
-
A cost per wave, before approval.
Finance signed off on wave two knowing its monthly figure, not an estate-wide estimate.
Result
- 400
- Hosts mapped, none by hand
- 3
- Waves instead of one cutover
- 31%
- Lower run cost at wave three
Cybersecurity
A SOC drowning in alerts that were almost all noise
The situation
Four analysts receiving roughly 11,000 alerts a week across endpoint, identity and network tooling. Real incidents were in there. So was everything else.
Why it was hard
Analysts triaged the newest alerts and the backlog aged out silently. The two incidents that mattered that quarter were both found by someone outside the team.
Architecture
Enrich, correlate, auto-close with a reason — humans keep the decision.
Endpoint / identity / network
Enrichment
Incident timeline
Auto-close or escalate
Analyst decision
What we built
-
Context before classification.
Every alert was enriched with asset criticality, identity and recent change history, because the same alert means different things on a test box and a payment server.
-
Correlation into incidents.
Forty related alerts became one incident with a timeline, instead of forty tickets racing each other.
-
Auto-close with a stated reason.
Closures carried the reason and stayed auditable, so the team could challenge the logic rather than trust it.
-
Humans kept the decision.
The system ranks and escalates. It does not contain, isolate or block on its own.
Result
- 11k → 40
- Reaching an analyst weekly
- 94%
- Less time on triage
- Full
- Audit trail on every close
Document automation
Forty thousand scanned documents a month, keyed in by hand
Why
The situation
A lending operation receiving bank statements, KYC packs and income proofs as phone photographs and fax-quality scans. Eleven people doing data entry.
Hard
Why it was hard
Off-the-shelf OCR handled the clean 60% and silently guessed at the rest. A wrong income figure is a credit decision, so nothing could be trusted unreviewed.
Architecture
Confidence per field. One uncertain value, one human — not the whole page.
Scan intake
Field extraction
Confidence gate
Cropped review
Posting + training loop
What we built
-
Confidence per field, not per document.
One uncertain balance sends one field to a human. The other fourteen fields on that page still post automatically.
-
Reviewers see the crop.
The reviewer gets the cropped image region and the proposed value, not the whole document. Three seconds, not three minutes.
-
The threshold is the risk team's to set.
They moved it twice in the first month. That is the correct amount of control to hand over.
-
Corrections close the loop.
Every human correction is labelled training data, so the low-confidence pile shrinks month over month.
Result
- 11 → 3
- People on data entry
- 83%
- Fields posting unattended
- 0
- Unreviewed low-confidence values
Predictive maintenance
Predicting failures on assets with no reliable network
The situation
Rotating equipment across remote compressor stations. Vibration and thermal data existed, but it was collected monthly on a laptop by a technician on site.
Why it was hard
Any cloud-based approach assumed a connection the sites did not have. The previous pilot stopped producing alerts for nine days before anyone noticed the link was down.
Architecture
Scoring on the asset. The link is for reporting, not decisions.
Sensors on asset
Edge box
Local 7-day buffer
Crew-tuned thresholds
Report when linked
What we built
-
Detection runs on the asset.
The edge box scores anomalies locally. The network carries reporting, not decisions.
-
A buffer sized to the worst outage.
Seven days of local retention, because the honest answer to how long links stay down was five.
-
Loud failure, not silent.
If the edge box stops scoring, that is itself an alert. The previous pilot's nine quiet days were the real defect.
-
The crew tuned the rules.
Technicians set thresholds for their own machines, because they knew which vibration signature was normal for a 1998 unit.
Result
- 38
- Stations, one deployment
- 7 days
- Of outage survived unchanged
- 4
- Failures caught before shutdown
Legacy modernisation
Changing a system nobody was willing to touch
Why
The situation
A pricing engine written in 2009, 240,000 lines, no tests and no specification. It worked. Every proposed change was deferred because the risk was unknowable.
Hard
Why it was hard
You cannot safely refactor code you cannot describe, and you cannot test behaviour nobody has written down. The business had routed around it for four years.
Architecture
Pin current behaviour first. Then change one module at a time.
Production traffic
Characterisation tests
Behaviour document
Module refactor
Signed release
What we built
-
Documented the behaviour, not the intent.
What the code actually does under real inputs, including the three edge cases that turned out to be load-bearing.
-
Characterisation tests from production traffic.
Ninety days of real inputs and outputs became 11,400 test cases that pin current behaviour exactly.
-
Refactored one module at a time.
With the net in place, a rewrite became a reviewable diff rather than a leap.
-
Two deliberate behaviour changes.
Two tests were updated on purpose, with a signed note explaining why. Everything else stayed byte-identical.
Result
- 11,400
- Cases pinning behaviour
- 2
- Intentional changes, both documented
- 6 wk
- To the first safe release
Also asked
Others we are asked for most.
Shorter write-ups on request — or ask about one that is not here.
Internal knowledge assistant
Grounded answers over your own policies and runbooks, with the citation attached.
Visual quality inspection
Every unit checked on the line instead of one in fifty, with defect classes your team retrains.
Demand and capacity forecasting
Forecasts that carry their own confidence interval, so planners know when to ignore them.
Contact-centre deflection
Routing and drafting, with the hard conversations still going to a person.
Spend and licence rationalisation
Finding what you pay for twice across an estate that grew by acquisition.
Compliance evidence collection
Controls evidence gathered continuously rather than assembled in a panic each audit.
Where it starts
Every one of these started the same way.
Not with a model. With two weeks working out whether the problem was worth solving, and what a wrong answer would cost.
Where does the data live?
Residency and ownership shape the architecture more than the model does.
What does a wrong answer cost?
That gap sets where the human sits.
Who runs it on Tuesday?
Most projects fail after launch, not during it.
Bring us the one you have been deferring.
The problem everyone agrees is real and nobody has scoped. Those are the ones worth a discovery.