<h2>Key Takeaways</h2>
<ul>
<li>Three UK businesses, <a rel="nofollow" href="https://www.networksjournal.com/content/a1-pharmaceuticals-managed-detection-response-mfa">A1 Pharmaceuticals</a>, <a rel="nofollow" href="https://www.networksjournal.com/content/oxford-cancer-analytics-sophos-mdr-firewalls">Oxford Cancer Analytics</a> and <a rel="nofollow" href="https://www.networksjournal.com/content/neville-uk-managed-edr-siem-azure-migration">Neville UK</a>, all deployed Managed Detection and Response as their central cyber security investment, but each arrived at it from a completely different starting position: one after real financial damage, one as a foundation built in before any incident occurred, and one as the latest chapter in a decade-long relationship with no specific breach mentioned at all.</li>
<li>A1 Pharmaceuticals&#8217; investment was reactive in the most direct sense possible. The company suffered a ransomware attack that cost three days of business, then a coordinated Christmas-season breach that cost more than £50,000 and forced it to disconnect its external connectivity entirely. &#8220;Cyber security has to be taken seriously,&#8221; said Chris Dancer, the company&#8217;s Managing Director. &#8220;Thanks to the support of Arc and the insights from our past experiences, the changes we&#8217;ve made have genuinely paid off.&#8221;</li>
<li>Oxford Cancer Analytics, working with the same vendor, Arc, took the opposite path: building Sophos MDR, XGS firewalls and GPU-capable infrastructure in from the outset as a young healthcare technology company handling sensitive medical and scientific data, rather than responding to an incident after the fact. &#8220;Handling sensitive medical and scientific data requires absolute trust and, from day one, the Arc team provided the infrastructure and expertise we could rely on,&#8221; said Luke Hankey, the company&#8217;s Head of IT and Software.</li>
<li>Neville UK&#8217;s story is different again: a decade-long relationship with a different provider, Air IT Group, protecting around 300 users across a 24/7 global operation, with Managed Detection and Response and Managed SIEM layered onto an existing partnership rather than triggered by any single event this publication&#8217;s own case study names. &#8220;Air IT Group have shown to be the best partner we could have for many years,&#8221; said Brian Westfall, the company&#8217;s IT Manager.</li>
<li>Read together, the three cases show Managed Detection and Response isn&#8217;t one kind of purchase with one kind of trigger. It&#8217;s the same category of product solving three different organisational problems: recovering trust after real damage, building credibility before it&#8217;s tested, and sustaining a long, ongoing relationship. For a UK C-suite, the useful question when evaluating a similar investment isn&#8217;t which MDR provider to choose, it&#8217;s which of these three starting positions actually describes the organisation making the decision.</li>
</ul>
<p>Managed Detection and Response shows up as the headline technology in a lot of UK cyber security case studies, and it&#8217;s easy to read that repetition as evidence the product itself is the interesting part. Three case studies published on this site, at <a rel="nofollow" href="https://www.networksjournal.com/content/a1-pharmaceuticals-managed-detection-response-mfa">A1 Pharmaceuticals</a>, <a rel="nofollow" href="https://www.networksjournal.com/content/oxford-cancer-analytics-sophos-mdr-firewalls">Oxford Cancer Analytics</a> and <a rel="nofollow" href="https://www.networksjournal.com/content/neville-uk-managed-edr-siem-azure-migration">Neville UK</a>, suggest the more useful story is what each company was actually starting from when it bought the same category of product.</p>
<h2>A1 Pharmaceuticals: MDR bought after the damage was already done</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/a1-pharmaceuticals-managed-detection-response-mfa">A1 Pharmaceuticals</a>&#8216; path to Managed Detection and Response ran directly through two costly incidents. A ransomware attack cost the company three days of business, and a later, coordinated Christmas-season breach cost more than £50,000 and forced the company to disconnect its external connectivity entirely to contain it. That second incident deepened an existing cyber security partnership with Arc rather than starting a new one. &#8220;Cyber security has to be taken seriously,&#8221; said Chris Dancer, A1 Pharmaceuticals&#8217; Managing Director. &#8220;Thanks to the support of Arc and the insights from our past experiences, the changes we&#8217;ve made have genuinely paid off; we&#8217;ve stopped further attacks, protected our data and strengthened the business.&#8221; The resulting deployment combined Managed Detection and Response, multi-factor authentication across every system, upgraded Sophos firewall and antivirus protection, regular penetration testing, and bi-weekly staff cyber awareness emails backed by real-time monitoring. &#8220;I now make time for every cyber security conversation, because I know just how much it matters,&#8221; Dancer said, a direct statement about how the incidents changed his own attention to the subject, not just the company&#8217;s technical posture. The new defences have since caught a financial fraud attempt involving compromised credentials before any money moved, and flagged several other threats early enough to prevent disruption.</p>
<h2>Oxford Cancer Analytics: the same category of product, built in before there was anything to react to</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/oxford-cancer-analytics-sophos-mdr-firewalls">Oxford Cancer Analytics</a>, working with the same vendor, Arc, tells a structurally different story with the same underlying technology. As a young healthcare technology company handling sensitive medical and scientific data, OXcan needed secure, high-performance infrastructure that could support rapid expansion while maintaining a strong security posture from the start, not after an incident forced the issue. &#8220;Handling sensitive medical and scientific data requires absolute trust and, from day one, the Arc team provided the infrastructure and expertise we could rely on,&#8221; said Luke Hankey, OXcan&#8217;s Head of IT and Software. The build covered a managed environment for 19 users with endpoint protection and Sophos MDR, Sophos XGS firewalls across six network devices, and high-performance, GPU-capable servers to support machine learning workloads, alongside a migration to Mimecast for email with DMARC improvements. &#8220;Their proactive approach and well-designed solutions have played a key role in strengthening our overall security posture,&#8221; Hankey said. Nothing in OXcan&#8217;s own case study describes a breach, an attack, or a specific triggering event; the investment is framed entirely as groundwork laid ahead of scale, the inverse of A1 Pharmaceuticals&#8217; sequence with the same vendor.</p>
<h2>Neville UK: the same product, arrived at through a decade of relationship rather than a single decision</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/neville-uk-managed-edr-siem-azure-migration">Neville UK PLC</a>, a family business running a 24/7 global operation with roughly 300 IT users, reached the same category of technology, Managed Detection and Response paired with a Managed SIEM, through a different route again: a decade-long IT partnership with Air IT Group, a different vendor from Arc, rather than a single event or a from-day-one build. The case study names no specific incident driving the decision, instead describing an ongoing need for continuous protection, proactive IT support and a stable foundation for the company&#8217;s wider technology investment, including a migration to Microsoft Azure delivered as part of the same engagement. &#8220;Air IT Group have shown to be the best partner we could have for many years,&#8221; said Brian Westfall, Neville UK&#8217;s IT Manager. &#8220;They provide 24/7 Managed IT Support as well a variety of Cyber Security Services and their deep understanding of our infrastructure and commitment to 24/7 monitoring gives us real peace of mind that we are protected.&#8221; &#8220;With Air we feel well and truly protected and supported,&#8221; Westfall added. &#8220;Anytime we need them, they&#8217;re there for us!&#8221; Where A1 Pharmaceuticals&#8217; quotes describe relief after damage and OXcan&#8217;s describe confidence built in advance, Neville UK&#8217;s describe something closer to accumulated trust over time, the product of a long relationship rather than a discrete before-and-after moment.</p>
<h2>What a UK C-suite should actually take from reading these three together</h2>
<p>Two of these three companies used the same vendor, Arc, and arrived at nearly identical technology, Managed Detection and Response layered with Sophos tooling, from opposite starting points: one recovering from real financial and operational damage, the other building the same defences in before anything had gone wrong. The third reached a comparable outcome, MDR and Managed SIEM, through neither a crisis nor a from-day-one build, but a decade of accumulated partnership with a different provider entirely. None of the three case studies describes MDR itself as the differentiator; each one&#8217;s own account centres on when and why the decision got made, not which specific product was chosen. For a UK C-suite weighing a similar investment, the practical lesson these three cases suggest is to be honest about which of these three positions actually describes the organisation, already damaged and rebuilding trust, early-stage and building credibility ahead of scale, or established and extending a long relationship, because that starting position, more than the product category itself, is what each of these three companies&#8217; own case studies actually describe as the reason the investment mattered.</p>


A1 Pharmaceuticals, Oxford Cancer Analytics and Neville UK: What ‘Managed Detection and Response’ Actually Means in Three Sectors

<h2>Key Takeaways</h2>
<ul>
<li>Four NHS trusts&#8217; published cyber security case studies look, from a distance, like four separate stories. Read closely, three of them, <a rel="nofollow" href="https://www.networksjournal.com/content/birmingham-community-healthcare-trust-cyberguard-siem-soc">Birmingham Community Healthcare</a>, <a rel="nofollow" href="https://www.networksjournal.com/content/wrightington-wigan-leigh-nhs-soc-cybersecurity">Wrightington, Wigan and Leigh</a>, and <a rel="nofollow" href="https://www.networksjournal.com/content/royal-orthopaedic-hospital-cyber-security-support">Royal Orthopaedic Hospital</a>, converge on the same vendor, the same underlying model, and, in two cases, the exact same documented reason for choosing it.</li>
<li>Birmingham Community Healthcare&#8217;s own account is explicit about the trigger: &#8220;Ever since WannaCry back in 2017, the Trust&#8217;s Board of Directors and I recognised we needed to up our game in regard to cyber security and give it the resource it demands,&#8221; said Gerard Kilgallon, the Trust&#8217;s Head of IT. Wavenet ran a proof of concept, then expanded into a full Security Information and Event Management deployment and CREST-approved penetration testing.</li>
<li>Wrightington, Wigan and Leigh didn&#8217;t arrive at the same vendor independently. This publication&#8217;s own case study states the Trust &#8220;looked to Wavenet after seeing the benefits CyberGuard had delivered for Birmingham Community Healthcare NHS Foundation Trust,&#8221; a directly documented reference chain between two NHS trusts, not an assumption. WWL added a UK-based, 24/7/365 Security Operations Centre and cited the same national pressure Birmingham Community Healthcare named: &#8220;Cyber attacks are increasing yearly, and because of that, so is the demand for security coverage,&#8221; said Alan Moss, the Trust&#8217;s IT Programme Manager.</li>
<li>Royal Orthopaedic Hospital&#8217;s case study describes a third, related layer of the same referral pattern: Wavenet&#8217;s existing relationship with Birmingham Women&#8217;s and Children&#8217;s NHS Foundation Trust, a fellow member of the same Integrated Care System, gave the hospital &#8220;further confidence in the relationship&#8221; before it signed on for 24/7/365 cloud-based cyber support.</li>
<li>Oxford University Hospitals&#8217; project, unlike the other three, has nothing to do with detecting or responding to attacks. Working with Telefónica Tech and Starlight Consulting rather than Wavenet, it built a Secure Data Environment governing how more than 30 billion health records can be safely accessed by researchers, a data governance and access-control problem, not a threat-detection one. For a UK C-suite, the useful distinction these four case studies draw isn&#8217;t &#8220;which vendor NHS trusts prefer.&#8221; It&#8217;s that &#8220;NHS cyber security&#8221; case studies actually describe two entirely different disciplines, defending infrastructure against attackers, and governing safe access to data, and only one of those two disciplines shows the peer-reference pattern visible across three of these four trusts.</li>
</ul>
<p>Four NHS organisations&#8217; published cyber security case studies sit in the same category on paper. Read together, they reveal something more specific than &#8220;the NHS is investing in cyber security&#8221;: three of the four trusts didn&#8217;t make their decision independently at all, they can be traced, in their own words, back to a single earlier deployment and a shared trigger, the 2017 WannaCry ransomware attack. The fourth solved a problem the other three never mention.</p>
<h2>Birmingham Community Healthcare: the trust that started the chain</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/birmingham-community-healthcare-trust-cyberguard-siem-soc">Birmingham Community Healthcare NHS Foundation Trust</a>, which delivers more than 100 clinical services across 200 hospitals, health centres and clinics, traces its cyber security investment directly to a single event. &#8220;Ever since WannaCry back in 2017, the Trust&#8217;s Board of Directors and I recognised we needed to up our game in regard to cyber security and give it the resource it demands,&#8221; said Gerard Kilgallon, the Trust&#8217;s Head of IT. The Trust&#8217;s disparate workforce and IT landscape, combined with limited internal cyber security expertise, had made a coherent strategy difficult to build while the IT team&#8217;s priority remained keeping clinical services running. Wavenet ran a proof of concept for its CyberGuard solution over several weeks, alongside setting up a Critical Incident Response Service so a Security Operations Centre could investigate and remediate threats at source. &#8220;The proof of concept went as well as it possibly could have, the process of integrating new systems and protocols was managed seamlessly,&#8221; Kilgallon said. Wavenet&#8217;s role has since expanded to a full Security Information and Event Management deployment and CREST-approved internal and external penetration testing, giving the Trust what its own case study describes as constant threat detection through the Security Operations Centre.</p>
<h2>Wrightington, Wigan and Leigh: a documented reference, not a coincidence</h2>
<p>What makes <a rel="nofollow" href="https://www.networksjournal.com/content/wrightington-wigan-leigh-nhs-soc-cybersecurity">Wrightington, Wigan and Leigh Teaching Hospitals NHS Foundation Trust&#8217;s</a> case study worth reading directly against Birmingham Community Healthcare&#8217;s is that the connection between them isn&#8217;t inferred, it&#8217;s stated. WWL, a medium-sized Trust supporting 7,000 active IT users across the Wigan borough and Greater Manchester, &#8220;looked to Wavenet after seeing the benefits CyberGuard had delivered for Birmingham Community Healthcare NHS Foundation Trust,&#8221; according to this publication&#8217;s own account. Facing the same post-WannaCry threat landscape and a national NHS cyber security skills shortage, WWL combined a Managed Detect and Respond solution with Microsoft Azure Sentinel as its SIEM system, monitored 24/7/365 from a UK Security Operations Centre, and ran a three-month trial with weekly review meetings before committing to a full partnership. &#8220;Cyber security is an ever-evolving challenge and partnering with Wavenet put us in the best position to protect ourselves,&#8221; said Malcolm Gandy, WWL&#8217;s Chief Information Officer. Alan Moss, the Trust&#8217;s IT Programme Manager, named the same pressure Birmingham Community Healthcare&#8217;s own case study describes: &#8220;Cyber attacks are increasing yearly, and because of that, so is the demand for security coverage.&#8221;</p>
<h2>Royal Orthopaedic Hospital: the third link in the same chain</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/royal-orthopaedic-hospital-cyber-security-support">The Royal Orthopaedic Hospital NHS Foundation Trust</a>, one of the largest specialist orthopaedic units in Europe, extends the same pattern a step further. As part of the NHS Integrated Care System covering Birmingham and Solihull, whose shared processes aren&#8217;t always suited to fast implementation, ROH needed to replace an on-premise security setup and traditional service desk cover that didn&#8217;t extend to out-of-hours cyber alerts. It, too, chose Wavenet, moving to a cloud-based cyber security service with 24/7/365 support, standardised alert handling and a formal internal IT service management system built around weekly checkpoints. The Trust&#8217;s own case study is specific about why the choice felt lower-risk than it might otherwise have: Wavenet&#8217;s existing work with Birmingham Women&#8217;s and Children&#8217;s NHS Foundation Trust, a fellow member of the same Integrated Care System, gave ROH &#8220;further confidence in the relationship.&#8221; &#8220;Wavenet consistently outperformed, outpriced, and out serviced other providers,&#8221; said Chris Page, ROH&#8217;s Cyber Security Consultant. &#8220;We were looking for the best service and value for money, that offered the best protection to the widest number of threats that we both knew and didn&#8217;t know about.&#8221;</p>
<h2>Oxford University Hospitals: a fourth NHS trust, and a completely different problem</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/oxford-university-hospitals-secure-data-environment-telefonica-tech">Oxford University Hospitals NHS Foundation Trust&#8217;s</a> case study sits in the same &#8220;NHS cyber security&#8221; category as the other three on this publication&#8217;s own tagging, and describes something with almost no overlap in substance. Working with Telefónica Tech and Starlight Consulting rather than Wavenet, OUH built the Thames Valley and Surrey Secure Data Environment, unifying more than 30 billion health records covering a population of 4.3 million people into a single, secure research platform. The problem it solved wasn&#8217;t detecting or responding to attackers; it was governance, giving researchers safe, ethical, de-identified access to data that traditional processes had made slow and fragmented to obtain, sometimes taking years to establish, across dozens of NHS organisations each running bespoke research approval processes. The team stood up the initial environment and began onboarding data sources within six weeks, building in joint controllership agreements with NHS partners, an airlock process controlling what data can leave the environment, and a patient and public access review committee. More than 35 research projects are now live, with over 100 approved researchers accessing the platform. &#8220;Every day, vast amounts of health data are collected, but much of its potential remains untapped, not just because of time constraints, but because traditional systems made it difficult for anyone to access and use this information effectively,&#8221; said Professor Jim Davies, the environment&#8217;s Chief Technical Officer. Nothing in Oxford University Hospitals&#8217; case study references WannaCry, a Security Operations Centre, or any of the threat-detection language that runs through the other three trusts&#8217; accounts, because it was never solving that problem.</p>
<h2>What a UK C-suite should actually take from reading these four together</h2>
<p>The instructive finding here isn&#8217;t that NHS trusts are investing in cyber security, every large UK institution is. It&#8217;s that three of these four trusts&#8217; decisions can be traced through a documented chain rather than treated as four independent choices: Birmingham Community Healthcare built the original CyberGuard deployment in response to WannaCry, Wrightington, Wigan and Leigh explicitly chose the same vendor after seeing what it delivered there, and Royal Orthopaedic Hospital drew confidence from Wavenet&#8217;s separate work with a fellow Integrated Care System member. That&#8217;s a real, citable pattern of peer reference inside a single sector, not a coincidence of three trusts reaching for the same category of tool. Oxford University Hospitals&#8217; case study is the useful control: tagged the same way, published in the same category, but solving a governance and access problem with an entirely different vendor and no trace of the same reference chain. For a UK C-suite evaluating its own cyber security investment, the practical lesson from all four together is that a vendor&#8217;s track record inside your own sector, not just its general reputation, is doing real, documented work in how similar organisations actually choose, and that &#8220;cyber security&#8221; as a category still needs breaking apart into what specific problem, attack detection or data governance, is actually being solved before any of these four trusts&#8217; results can be read as a template.</p>


Three NHS Trusts Chose the Same Cyber Security Vendor for the Same Reason. A Fourth Solved a Completely Different Problem

<h2>Key Takeaways</h2>
<ul>
<li>Leeds Rhinos, a professional rugby league club founded in 1870, rebuilt its IT infrastructure around Microsoft Teams and SharePoint to enable flexible, remote working across the organisation.</li>
<li>The project was led by managed IT provider Zenzero, and was designed for future scalability rather than as a reaction to a single failure or deadline.</li>
<li>Rob Oates, the club&#8217;s Managing Director, described the process as running without friction: &#8220;It couldn&#8217;t have run smoother.&#8221;</li>
<li>The nearest comparison in this publication&#8217;s archive is Age UK Ealing, a charity that moved onto the same Microsoft 365 stack, but under the forcing deadline of Windows 7&#8217;s end of support.</li>
<li>Read together, the two cases show the same collaboration stack solving two different problems: Leeds Rhinos modernised ahead of need, Age UK Ealing modernised because it had run out of runway.</li>
</ul>
<h2>TLDR</h2>
<ul>
<li>Leeds Rhinos needed to move away from outdated, restrictive IT systems that were limiting how flexibly staff could work and how easily teams could collaborate across the club&#8217;s various sites. Zenzero rebuilt the club&#8217;s infrastructure around Microsoft Teams for communication and SharePoint for document management, with an explicit brief to make the environment modern, flexible and ready to scale as the club grows.</li>
<li>The published case study doesn&#8217;t attach a percentage or a pound figure to the result, which is unusual for this publication&#8217;s archive of IT modernisation stories. What it does report is qualitative but specific: staff can now collaborate and access business resources from any location, and the club&#8217;s Managing Director, Rob Oates, called the entire process frictionless.</li>
<li>Age UK Ealing, a UK charity covered previously on this site, ran a comparable migration onto Microsoft&#8217;s collaboration stack, but for a different reason: its Windows 7 desktops and on-premise server were running out of vendor support, not out of headroom. The charity added multi-factor authentication, device management through Intune, and went on to achieve Cyber Essentials accreditation, layers the Leeds Rhinos case study doesn&#8217;t mention.</li>
<li>Set side by side, the two projects make the same underlying point from opposite directions: a UK organisation moving onto Teams and SharePoint isn&#8217;t really buying software, it&#8217;s buying the ability to work from anywhere without rebuilding the business case every time circumstances change, whether that change is a growth ambition or a support deadline.</li>
</ul>
<p>Professional sports clubs don&#8217;t usually make the case-study pages of managed IT providers, which is what makes <a rel="nofollow" href="https://zenzero.co.uk/case-studies/leeds-rhinos-case-study-2">Leeds Rhinos&#8217;</a> published account of its own IT rebuild worth reading closely. The club, founded in 1870 and based in Leeds, West Yorkshire, runs a rugby league operation alongside a significant community development programme, both of which depend on staff being able to work and collaborate away from a single fixed office. That&#8217;s the problem the club&#8217;s IT modernisation was built to solve.</p>
<h2>The problem: infrastructure that couldn&#8217;t keep up</h2>
<p>According to the case study, Leeds Rhinos&#8217; existing systems were outdated and restrictive. They limited how flexibly staff could work, made remote collaboration across the club&#8217;s various sites and departments harder than it needed to be, and slowed down access to the business resources people needed day to day. The club wanted an environment that could support flexible, remote working; seamless collaboration between teams; instant access to core resources; and, importantly, room to scale as the organisation&#8217;s needs evolved. None of that was possible on the infrastructure the club was running.</p>
<h2>The solution: Microsoft Teams and SharePoint, built for scale</h2>
<p>Zenzero, the managed IT provider that ran the project, focused the rebuild around two core pieces of the Microsoft 365 stack. <strong>Microsoft Teams</strong> became the club&#8217;s unified communication and collaboration layer, replacing whatever mix of email, phone and ad hoc tools staff had been relying on to coordinate across locations. <strong>SharePoint</strong> became the document management and information-sharing backbone, giving staff a single place to store, find and share files instead of scattered local copies. Around those two products, Zenzero designed what the case study describes as a modern, flexible and scalable IT environment, built specifically so the club wouldn&#8217;t have to repeat the exercise the next time its business needs changed.</p>
<p>The published account is light on implementation detail; it doesn&#8217;t break down a migration timeline, a device rollout, or a security layer the way some IT case studies do. What it emphasises instead is the outcome: staff can now collaborate and reach business resources from any location, productivity and operational efficiency have improved, and the club says it&#8217;s better positioned to compete and grow in what the case study calls a &#8220;digital-first business environment.&#8221; Rob Oates, Leeds Rhinos&#8217; Managing Director, summed up the experience of the project itself rather than just its output: &#8220;We have been delighted with the outcome. We have been delighted with the process. It couldn&#8217;t have run smoother.&#8221;</p>
<h2>How it compares: Age UK Ealing&#8217;s Microsoft 365 migration</h2>
<p>The clearest comparison in this publication&#8217;s own archive is <a rel="nofollow" href="https://www.networksjournal.com/content/age-uk-ealing-windows-10-microsoft-365-migration-qlic">Age UK Ealing</a>, a UK charity that migrated onto much of the same Microsoft ecosystem, but under a very different kind of pressure. Age UK Ealing was running Windows 7 desktops alongside an on-premise Windows SBS 2008 server, both approaching Microsoft&#8217;s end-of-support cutoff in January 2020. Its IT partner, Qlic, replaced the desktops with Windows 10 laptops fitted with hot-desk docking, migrated the on-premise Exchange server to Microsoft 365 Exchange, and moved file storage into SharePoint Online and OneDrive, the same document-collaboration product Zenzero built into Leeds Rhinos&#8217; rebuild. Reg Parkinson, Age UK Ealing&#8217;s Head of Business Development, described a similarly smooth commissioning process: &#8220;Qlic invested enough time and effort to understand our needs and were receptive, flexible, transparent, and swift during our commissioning process.&#8221;</p>
<p>What sets the two projects apart is the reason each one happened. Leeds Rhinos&#8217; migration reads as proactive: the case study frames it around future scalability and competitiveness rather than an external deadline. Age UK Ealing&#8217;s migration was reactive, forced by Windows 7 and SBS 2008 both running out of vendor support, a deadline with a fixed date attached rather than a general ambition to modernise. Age UK Ealing&#8217;s case study also names a security layer that Leeds Rhinos&#8217; doesn&#8217;t: <strong>Azure Active Directory</strong> paired with <strong>Microsoft Intune</strong> for centralised device management, multi-factor authentication added specifically for security, and <strong>Datto Backupify</strong> plus <strong>SysPeace Server Protection</strong> for backup and intrusion detection. The charity went on to achieve Cyber Essentials accreditation, the UK government-backed cyber security certification, on the back of the migration; that accreditation and the security tooling behind it aren&#8217;t mentioned anywhere in the Leeds Rhinos account.</p>
<p>There&#8217;s a plausible, if unstated, reason for that gap: a rugby club&#8217;s IT estate and a charity&#8217;s IT estate carry different risk profiles, and Age UK Ealing&#8217;s timing, landing its Microsoft 365 migration just before the COVID-19 pandemic forced UK staff home, made resilience and continuity a more immediate, visible concern than it may have been for a sports club rebuilding ahead of need rather than in response to a crisis. It&#8217;s also possible the Leeds Rhinos case study simply wasn&#8217;t written to cover security tooling in the same depth. Either way, a reader shouldn&#8217;t assume the absence of a detail in one published case study means the underlying project skipped it.</p>
<h2>What it proves</h2>
<p>Read on its own, the Leeds Rhinos case study is a fairly ordinary account of a UK organisation moving its communication and document management onto Microsoft&#8217;s collaboration stack. Read next to Age UK Ealing&#8217;s, it becomes a more useful data point: the same underlying products, Teams, SharePoint and the wider Microsoft 365 ecosystem, are being deployed by very differently sized and differently pressured UK organisations for what amounts to the same reason, the ability to work and collaborate from anywhere without rebuilding the case for it later. One organisation bought that flexibility ahead of needing it. The other bought it because an end-of-support deadline left no other option. Both, in their own words, would do it again.</p>


How Leeds Rhinos Rebuilt Its IT Around Microsoft Teams and SharePoint

<h2>Key Takeaways</h2>
<ul>
<li>Barclays, HSBC and Standard Chartered, three of the UK&#8217;s largest banking groups, have all built AI-driven fraud and financial-crime detection systems, but the quality and independence of what each has actually disclosed about those systems varies enormously, and a UK C-suite comparing them should notice the gap in evidence as much as the technology itself.</li>
<li>HSBC&#8217;s is the best-documented of the three. A dated, on-the-record press release from Google Cloud, quoting HSBC&#8217;s own Group Head of Financial Crime Risk and Compliance, states that its AML AI system detects 2 to 4 times more true positive risk than HSBC&#8217;s previous approach, while cutting alert volumes by more than 60% and reducing processing time for billions of transactions from several weeks to a few days. HSBC also won Celent&#8217;s Model Risk Manager of the Year award in 2023 after deploying it, a genuine third-party validation rather than a vendor&#8217;s own claim.</li>
<li>Barclays&#8217; account, published as a named customer story by database vendor Aerospike, is about infrastructure performance rather than AI accuracy specifically: its fraud platform now handles more than 10 million transactions a day, four times its previous throughput, at under 100 milliseconds latency for 99.99% of requests, an 80% latency reduction, while the underlying fraud dataset grew from 3 terabytes to more than 30 terabytes in three years without a system redesign. Those are real, named-executive-attributed figures about the data layer that makes Barclays&#8217; fraud models workable at scale, not a disclosed accuracy or false-positive figure for the models themselves.</li>
<li>Standard Chartered was the earliest mover of the three, becoming the first global bank to deploy AI vendor Silent Eight&#8217;s platform in its sanctions compliance operations in July 2018, confirmed in Standard Chartered&#8217;s own press release. But that release contains no performance figures at all. The widely cited claim that Silent Eight&#8217;s platform cuts manual investigation time by up to 70% is the vendor&#8217;s own general marketing figure, not one Standard Chartered has itself confirmed applies to its deployment, and it&#8217;s worth reading with that distinction in mind. Standard Chartered&#8217;s venture arm, SC Ventures, also invested in Silent Eight&#8217;s 2019 funding round, making the bank both a customer and a financial backer of its own AI supplier.</li>
<li>None of this means Standard Chartered&#8217;s or Barclays&#8217; systems work less well than HSBC&#8217;s, only that HSBC has published independently verifiable outcomes and the other two, so far, largely haven&#8217;t. For a UK C-suite benchmarking its own fraud AI investment, the more useful comparison isn&#8217;t which bank&#8217;s number sounds most impressive. It&#8217;s which bank&#8217;s claims are actually checkable, and HSBC is currently the only one of the three that clears that bar.</li>
</ul>
<p>Ask three UK banking groups how their AI fraud detection performs, and you&#8217;ll get three very different kinds of answer:</p>
<p>One with a dated press release, a named executive and an independent industry award behind it.</p>
<p>One told through a database vendor&#8217;s customer story, rich with named-executive infrastructure numbers but silent on the fraud model&#8217;s actual accuracy, and one confirmed only in outline, its most-quoted performance figure belonging to the vendor rather than the bank.</p>
<p>All three are real deployments. Only one of them is genuinely easy to independently verify.</p>
<h2>HSBC: the best-documented of the three</h2>
<p>HSBC&#8217;s system, built on Google Cloud&#8217;s AML AI product and internally named Dynamic Risk Assessment, is the most thoroughly disclosed of the three banks&#8217; AI financial-crime systems.</p>
<p>According to a <a href="https://www.googlecloudpresscorner.com/2023-06-21-Google-Cloud-Launches-AI-Powered-Anti-Money-Laundering-Product-for-Financial-Institutions?ref=lucinity.ghost.io" target="_blank" rel="nofollow noopener">press release Google Cloud published</a> on 21 June 2023, the system detects 2 to 4 times more true positive risk than HSBC&#8217;s prior transaction-monitoring approach, while cutting overall alert volumes, the flagged transactions that then require a human analyst&#8217;s time, by more than 60%.</p>
<p>HSBC monitors around 4 billion transactions a year across its customer base, and Google Cloud&#8217;s release says the system cut the batch processing time needed to analyse billions of transactions across millions of accounts from several weeks down to a few days. &#8220;Google&#8217;s models are already demonstrating the tremendous potential of machine learning to transform anti-financial crime efforts in the industry at large,&#8221; said Jennifer Calvery, HSBC&#8217;s Group Head of Financial Crime Risk and Compliance, in the release.</p>
<p>HSBC went on to receive <a href="https://www.celent.com/en/awards" target="_blank" rel="nofollow noopener">Celent&#8217;s Model Risk Manager</a> of the Year award in 2023 after adopting the system as its primary transaction-monitoring approach in key markets, an independent industry recognition that sits alongside, rather than merely repeating, the bank&#8217;s own figures.</p>
<h2>Barclays: real numbers, but about the data layer, not the model</h2>
<p>Barclays&#8217; publicly available account of its fraud AI comes from a different kind of source: a named customer case study published by Aerospike, the real-time database vendor whose technology underpins Barclays&#8217; fraud platform.</p>
<p>Dheeraj Mudgil, Barclays&#8217; VP Enterprise Fraud Architect, is quoted directly: the platform gave Barclays &#8220;quick access to large datasets with one hop to the data from the client and the predictability we needed for our fraud platform.&#8221; The figures in that case study are concrete and specific: Barclays&#8217; fraud platform now processes more than 10 million transactions a day, four times the throughput of its previous system, at under 100 milliseconds&#8217; latency for 99.99% of transactions, an 80% reduction in latency compared with the prior architecture.</p>
<p>The underlying fraud dataset grew from 3 terabytes to more than 30 terabytes over three years without requiring a redesign of the system&#8217;s architecture or caching layer. Aerospike&#8217;s case study says the resulting consolidation reduced stand-in processing and improved fraud outcomes by lowering both false positives and false negatives, though it gives no specific percentage for either.</p>
<p>What&#8217;s worth being precise about is what this case study actually is: a real-time data infrastructure story, told by the database company that supplies that infrastructure, about the plumbing that lets Barclays&#8217; fraud detection models run fast enough and on enough data to be useful at scale. It says nothing, in the material available, about how accurate Barclays&#8217; actual fraud-detection models are, what algorithms they use, or how their outputs compare with the system they replaced. That&#8217;s a materially different, narrower kind of evidence than HSBC&#8217;s, even though both are, in their own ways, genuine and specific.</p>
<h2>Standard Chartered: first to deploy, least to disclose</h2>
<p>Standard Chartered has the longest track record of the three. On 9 July 2018, the bank announced it had become the first global financial institution to deploy AI vendor Silent Eight&#8217;s platform, which applies machine learning and natural language processing to sanctions and watchlist name-screening, matching customer names against watchlists using fuzzy logic and learning from the historical decisions of Standard Chartered&#8217;s own analysts. &#8220;I am very pleased with this investment which is contributing significantly to the Bank&#8217;s innovation agenda,&#8221; said Markus Schulz, Standard Chartered&#8217;s Global Head of FCC Controls, in the announcement, adding that the tool was meant to &#8220;empower our teams to make more effective and efficient decisions, complementing the core monitoring and screening platforms that we have already established.&#8221; Standard Chartered&#8217;s own press release contains no performance figures at all, no time saving, no accuracy improvement, no volume figure.</p>
<p>The number most often attached to this story, that Silent Eight&#8217;s platform cuts manual investigation time by up to 70%, comes from Silent Eight&#8217;s own marketing material, not from a Standard Chartered disclosure confirming that figure applies to its specific deployment. That distinction matters and is worth stating plainly rather than letting the two blur together, the way most retellings of this story do. There&#8217;s also a governance detail worth a UK C-suite&#8217;s attention: Standard Chartered&#8217;s corporate venture arm, SC Ventures, participated in Silent Eight&#8217;s $6.2 million Series A funding round in November 2019, more than a year after the original deployment. That makes Standard Chartered simultaneously a customer of and a financial stakeholder in the company supplying part of its financial-crime AI, a relationship that isn&#8217;t inherently improper, corporate venture arms invest in vendors they use fairly often, but is exactly the kind of detail a board should want surfaced and understood, not left implicit.</p>
<h2>What a UK C-suite should actually take from this</h2>
<p>All three of these are genuine, multi-year AI deployments at major UK banking groups, and none of the gaps described here are evidence that Barclays&#8217; or Standard Chartered&#8217;s systems perform worse than HSBC&#8217;s. What differs, starkly, is the quality of publicly available evidence behind each one. HSBC&#8217;s account comes with a dated release, a named senior compliance executive, specific before-and-after figures, and an independent industry award. Barclays&#8217; comes with real, named-executive-attributed numbers, but about data infrastructure throughput rather than fraud-model accuracy, published by the vendor supplying that infrastructure. Standard Chartered&#8217;s comes with a confirmed deployment date and a named executive&#8217;s general endorsement, but its most-cited performance figure belongs to the vendor&#8217;s marketing, not the bank&#8217;s own disclosure. For a board benchmarking its own AI fraud investment against any of the three, the useful exercise isn&#8217;t ranking whose numbers sound biggest. It&#8217;s asking, of your own programme, whether the evidence you&#8217;d eventually publish about it would meet the HSBC standard, an independently checkable, dated, specifically-attributed outcome, or whether it would look more like the other two: real, but resting on someone else&#8217;s word.</p>


Fraud Detection AI at Barclays, HSBC and Standard Chartered: Only One of Them Has Actually Proven It Works

<h2>Key Takeaways</h2>
<ul>
<li>Six UK universities&#8217; published infrastructure case studies, at <a rel="nofollow" href="https://www.networksjournal.com/content/university-of-leicester-backup-storage-consolidation">Leicester</a>, <a rel="nofollow" href="https://www.networksjournal.com/content/royal-holloway-university-hpe-dhci-refresh">Royal Holloway</a>, <a rel="nofollow" href="https://www.networksjournal.com/content/birmingham-city-university-work-area-recovery-centre">Birmingham City</a> and <a rel="nofollow" href="https://www.networksjournal.com/content/cranfield-university-nutanix-hci-original-deployment">Cranfield</a>, share a pattern: none of them modernised proactively. Every one of the four was forced into the decision by something external, a departing member of staff, a lease running out, a building earmarked for redevelopment, or a seasonal capacity crunch, and the modernisation followed as a consequence, not a strategic choice made in isolation.</li>
<li>At the University of Leicester, that trigger was fear rather than a specific failure. Systems Specialist Mark Penny described a backup architecture where losing a single media server could have knocked out backup and restore access &#8220;for potentially weeks,&#8221; a risk that never actually materialised but drove the university to replace ten individual media servers with <a rel="nofollow" href="https://www.networksjournal.com/content/university-of-leicester-backup-storage-consolidation">a shared Cloudian object storage platform</a>, cutting rack space in half.</li>
<li>A second Leicester project shows the same institution hitting the identical pattern twice. The university&#8217;s <a rel="nofollow" href="https://www.networksjournal.com/content/university-of-leicester-high-availability-storage-failover">load balancers</a> had been &#8220;built years earlier on open-source software by technicians who had since left the university,&#8221; Penny said, leaving a system nobody still on staff fully understood. The replacement wasn&#8217;t a strategic upgrade; it was a response to institutional memory walking out the door.</li>
<li>Royal Holloway and Cranfield were both driven by harder deadlines. Royal Holloway&#8217;s legacy hardware carried &#8220;various legacy dependencies&#8221; that made routine support difficult while raising energy costs, and it moved to <a rel="nofollow" href="https://www.networksjournal.com/content/royal-holloway-university-hpe-dhci-refresh">HPE dHCI under a consumption-based GreenLake model</a>, cutting its data centre footprint 75% and energy use more than 72%. Cranfield&#8217;s original decision came from hardware, licence and support contracts approaching renewal at the same time one of its two data centre buildings was scheduled for redevelopment, forcing the question rather than inviting it.</li>
<li>For a UK C-suite, the useful pattern across these four case studies isn&#8217;t which vendor or platform they chose, Cloudian, HPE, Nutanix, all appear once. It&#8217;s that each institution&#8217;s own account describes the trigger as external and largely outside its control, and that the resulting projects still delivered large, measured gains, 50% space savings, 75% footprint reduction, 80% less time spent on infrastructure management, once forced. The lesson isn&#8217;t to wait for a crisis. It&#8217;s that a board reviewing its own infrastructure roadmap should ask which of its systems are quietly waiting on the same kind of external trigger, a departing engineer, an expiring lease, a contract renewal, rather than assuming it will choose the moment itself.</li>
</ul>
<p>Read individually, these are six unremarkable-sounding infrastructure stories: a university replaces some servers, another moves to the cloud, a third builds a backup site. Read together, four of them, at Leicester, Royal Holloway, Cranfield and Birmingham City, tell an identical story about why the decision actually got made, and it&#8217;s rarely the reason the resulting case study headline suggests. The other two, Oxford and Kingston, are useful precisely because they don&#8217;t fit the pattern, and the difference is worth naming.</p>
<h2>Leicester, twice: what happens when the person who built it leaves</h2>
<p>The <a rel="nofollow" href="https://www.networksjournal.com/content/university-of-leicester-backup-storage-consolidation">University of Leicester&#8217;s</a> first infrastructure overhaul wasn&#8217;t triggered by a failure. It was triggered by the university recognising how bad a plausible failure would be. Under its previous architecture, ten media servers each individually maintained backup and index data on SAN-based hardware; losing any one of them could have meant weeks without backup or restore access for the devices it served. &#8220;We wouldn&#8217;t be able to continue backing up data, access backups or conduct restores until we replaced the hardware and spun up the system again, a process which could have taken weeks. Fortunately, we never faced this situation, but we knew we had to make a change,&#8221; said Mark Penny, the university&#8217;s Systems Specialist. Leicester replaced the setup with Cloudian HyperStore object storage across 12 HPE Apollo servers, cutting the rack space needed for 2.5 petabytes of usable storage from 48U to 24U, a 50% saving, chosen over an open-source alternative and a more expensive commercial rival partly because Penny could install and test it himself on a laptop in 15 minutes.</p>
<p>The university&#8217;s <a rel="nofollow" href="https://www.networksjournal.com/content/university-of-leicester-high-availability-storage-failover">second, related project</a> shows the same forcing pattern playing out again, almost immediately after the first. Having replaced the storage layer, Leicester still needed load balancers reliable enough to keep it running, and its existing ones were &#8220;home-grown, built years earlier on open-source software by technicians who had since left the university,&#8221; in this publication&#8217;s own account, leaving a system nobody currently on staff could confidently maintain. Penny ran a proof of concept with Cloudian&#8217;s HyperBalance appliances and didn&#8217;t look further: &#8220;We were impressed by how easy it was to set up the load balancer solution and get going&#8230; We didn&#8217;t look at anything else.&#8221; The result now balances traffic across 15 HPE Apollo servers, handling 3.3 gigabytes of storage per second at peak without measurable performance loss. Two separate Leicester projects, two separate forcing events, neither one a proactive strategic decision made on the university&#8217;s own timetable.</p>
<h2>Royal Holloway and Cranfield: deadlines set by leases and buildings, not by IT strategy</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/royal-holloway-university-hpe-dhci-refresh">Royal Holloway University of London&#8217;s</a> legacy infrastructure had accumulated &#8220;generations of hardware with various legacy dependencies,&#8221; making day-to-day management harder than it needed to be while a large data centre footprint drove rising energy costs, in the university&#8217;s own description of the problem. Working with Wavenet and HPE, Royal Holloway replaced it with a virtual infrastructure platform under HPE&#8217;s consumption-based GreenLake model, cutting its data centre footprint by 75%, its VMware socket count by 85%, and its energy use by more than 72%. &#8220;A modern, world-class university needs server infrastructure future-proofed for the cloud age,&#8221; said Zoë Faiz, the university&#8217;s Assistant IT Director.</p>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/cranfield-university-nutanix-hci-original-deployment">Cranfield University&#8217;s</a> original decision had an even more concrete deadline attached. Its intensive IT needs had been running on two ageing data centres built on traditional three-tier server architecture, with hardware, software licences and support contracts approaching renewal at the same time one of the two buildings was scheduled for redevelopment. &#8220;We took this opportunity to look at the whole infrastructure stack and all the overheads the servers brought from a management point of view,&#8221; said Edward Poll, Cranfield&#8217;s Head of IT Infrastructure. Working with CDW, the university moved to a Nutanix hyperconverged platform, chosen specifically for its flexibility to incorporate VMware and adapt to future financial and technical change. Cranfield&#8217;s relationship with that same setup continued into a <a rel="nofollow" href="https://www.networksjournal.com/content/cranfield-university-nutanix-hci-refresh-2024">2024 technology refresh</a>, this time on a rolling four-year cycle the university maintains deliberately rather than reactively, completed in four weeks with no user downtime and sustaining the 80% reduction in infrastructure management time the original deployment had already delivered.</p>
<h2>Birmingham City University: the trigger was a calendar, not a crisis</h2>
<p><a rel="nofollow" href="https://www.networksjournal.com/content/birmingham-city-university-work-area-recovery-centre">Birmingham City University&#8217;s</a> version of this pattern is the clearest example that the forcing event doesn&#8217;t have to be a technology failure at all. BCU&#8217;s largest annual opportunity to fill course places is its clearing period, a predictable, recurring calendar event that nonetheless required robust infrastructure to handle a surge in student applications without downtime. The university had previously used a seasonal hot-standby facility from Wavenet, staffed for 200 contact centre workers during clearing, and chose to convert it into a permanent, year-round work area recovery centre securing around half a petabyte of data across 400 virtual machines. &#8220;Having Wavenet as our partner means everything,&#8221; said Matt Peers, BCU&#8217;s Senior Project Manager. &#8220;The inclusion of work area recovery is essential for continuous and trusted connections during clearing.&#8221; The initial engagement led to a five-year contract, and the trigger, in this case, was entirely predictable and recurring rather than an emergency, which is itself a useful variant of the same underlying pattern: a known, calendared pressure point forcing a decision that a general sense of &#8220;we should modernise&#8221; never quite had.</p>
<h2>Oxford and Kingston: the same broad category, and neither one fits</h2>
<p>Two other university Microsoft 365 case studies this publication has covered, at <a rel="nofollow" href="https://www.networksjournal.com/content/university-of-oxford-microsoft-365-governance-architecture">the University of Oxford</a> and <a rel="nofollow" href="https://www.networksjournal.com/content/kingston-university-microsoft-365-data-migration">Kingston University</a>, sit under the same general &#8220;university IT overhaul&#8221; umbrella as the four above, and deliberately don&#8217;t share the forcing-event pattern. Oxford&#8217;s Microsoft 365 governance project was driven by an organisational reality, a decentralised federation of 39 colleges needing local autonomy within a coherent central structure, not a departing engineer or an expiring lease. Kingston&#8217;s data migration was driven by data volume and disruption risk, a genuinely large, ongoing logistics problem rather than a single triggering event. Neither university&#8217;s own account describes a forced hand the way Leicester&#8217;s, Royal Holloway&#8217;s, Cranfield&#8217;s or Birmingham City&#8217;s do. That&#8217;s a useful negative case: not every university IT project in this publication&#8217;s archive was reactive, which makes the four that were stand out more clearly as a real pattern rather than something true of university IT projects generally.</p>
<h2>What a UK C-suite should actually take from reading these six together</h2>
<p>The pattern worth taking from this isn&#8217;t that reactive infrastructure decisions turn out badly, all four forced projects here delivered large, specifically measured improvements once undertaken. It&#8217;s that four separate UK universities&#8217; own published accounts each independently describe the same structure: a real, often quantifiable improvement that only happened because something external forced the timing, a person leaving, a lease or contract expiring, a building being redeveloped, a calendared seasonal peak. None of the four case studies describe an infrastructure team identifying the opportunity on its own initiative ahead of that trigger. For a UK board reviewing its own technology estate, the practical question these six case studies together suggest isn&#8217;t whether to modernise, it&#8217;s which systems are currently being kept running only because nothing has yet forced the decision, the equivalent of Leicester&#8217;s departed technicians&#8217; home-grown load balancer, quietly working until the person who understood it was no longer there to ask.</p>


Latest