<h2>Key Takeaways</h2>
<ul>
<li>Niftylift, a Milton Keynes-based manufacturer of mobile elevating work platforms, and BBC Studios, running an on-premises environment of 1,000 virtual machines, both deployed <a rel="nofollow" href="https://www.networksjournal.com/ai">AI</a> for the same underlying reason: neither the factory floor nor the data centre had a workable way to find the root cause of routine problems fast enough, so specialist time kept getting pulled into work that shouldn&#8217;t have needed it.</li>
<li>The results are specific rather than vague. Niftylift&#8217;s conversational fault-diagnosis assistant, built by Aiimi, cut the time for an operator to get an answer from more than five minutes to under one, an 80 percent reduction, and nearly doubled the self-resolution rate for previously unknown issues, from 15 percent to 28 percent. BBC Studios&#8217; deployment of <a rel="nofollow" href="https://www.ibm.com/solutions/artificial-intelligence">IBM</a> Turbonomic, in one automated monthly maintenance run alone, reclaimed 228 GB of memory and 22 virtual CPUs that pandemic-era overprovisioning had left idle.</li>
<li>Both organisations kept a human decision point rather than removing it. Niftylift&#8217;s assistant escalates to specialist teams when it should, with training and audit trails built in; BBC Studios&#8217; team manually applied Turbonomic&#8217;s early resizing recommendations before trusting the system to automate them. That sequencing, human-verified first, automated second, is worth noticing rather than treating as incidental.</li>
<li>The pattern sits inside a real, named market category. IBM acquired Turbonomic Inc., founded in 2009, for a reported $1.5 billion in a deal that closed on 17 June 2021, positioning it inside what analysts call AIOps, applying machine learning to operational data to cut the time it takes to find and fix problems. Gartner itself reportedly moved to reframe the AIOps Platforms category as Event Intelligence Solutions in 2025, citing vendor overuse of the term, worth knowing before a board takes any vendor&#8217;s &#8220;AIOps&#8221; label at face value.</li>
<li>The cost of getting this wrong is not abstract for UK manufacturers specifically. A Fluke Corporation and Censuswide study of more than 600 senior decision-makers across the UK, US and Germany, released in October 2025, put UK unplanned downtime at up to £736 million a week, an average of £1.36 million an hour, with 68 percent of UK manufacturers reporting unplanned downtime in the past year.</li>
</ul>
<p>A factory floor in Milton Keynes and a broadcaster&#8217;s data centre have almost nothing in common operationally, but Niftylift and BBC Studios arrived at the same diagnosis of their own problem: too much specialist time was being spent finding out what was wrong, rather than fixing it. Both turned to AI-powered tools to close that gap, one on tablets handed to production operators, the other inside infrastructure most end users never see. Read together, the two cases say something more useful to a UK C-suite than either does alone, about where AI is currently earning its keep in operations, and where a human still needs to sign off.</p>
<h2>Niftylift: getting the answer to the point of work</h2>
<p>Niftylift, an off-highway equipment manufacturer, had production teams losing significant time to fault diagnosis. Operators had to leave their stations, log into a central database, and pick through multiple screens of poorly organised information just to identify a problem. The system demanded heavy manual filtering, and because frontline workers often couldn&#8217;t quickly find or trust an answer, routine issues were escalated unnecessarily to specialist teams, causing line downtime and pulling experts away from more complex work.</p>
<p>Aiimi built a conversational AI assistant integrated with Niftylift&#8217;s existing fault knowledge base and deployed it directly on operators&#8217; tablets. The assistant guides workers through diagnosis in plain language with targeted follow-up questions, bringing diagnostic capability to the point of work instead of a separate terminal, consolidates previously scattered fault data, and includes a feedback loop to flag outdated records along with training and audit trails to support proper escalation when it&#8217;s genuinely needed. &#8220;Replacing the old database with the Aiimi AI assistant has been a major enhancement to the Niftylift Fault Diagnosis Process. It has significantly improved how fault diagnosis data is accessed and applied, delivering faster, more accurate insights through a more intuitive interface,&#8221; said Marian-Toma Diaconescu, Senior Fault Diagnostics Engineer at Niftylift.</p>
<p>The reported numbers are specific: time to get an answer dropped from more than five minutes to under one, an 80 percent reduction, while the self-resolution rate for previously unknown issues nearly doubled, from 15 to 28 percent, protecting specialist capacity and trending downtime lower week on week. What&#8217;s worth reading carefully in that description is what didn&#8217;t change. The assistant doesn&#8217;t replace the specialist escalation path, it makes escalation more selective, reserved for issues that genuinely need it rather than ones a frontline operator could resolve with better access to existing knowledge. Niftylift, founded in 1985 and based in Milton Keynes, manufactures mobile elevating work platforms and access equipment, and reportedly exports more than three-quarters of what it makes, a reminder that this is a real UK manufacturer with production-line economics at stake, not a lab pilot.</p>
<h2>BBC Studios: finding the root cause inside 1,000 machines</h2>
<p>When Porsche Waddell joined BBC Studios as Server and Storage Manager in 2014, he inherited a lean team and an on-premises environment running at over 95 percent capacity, plagued by frequent application performance issues that its existing tools could not diagnose. Without a way to identify root causes, Waddell&#8217;s team was stuck reacting to complaints from end users across an environment of 1,000 virtual machines, with little time left to work on anything strategic. BBC Studios needed a way to simultaneously control costs and assure application performance, so it turned to the IBM Turbonomic Application Resource Management solution. &#8220;Deploying IBM Turbonomic was a turning point for us in understanding what the issue was and working through it. It helped us out a lot,&#8221; Waddell said.</p>
<p>Turbonomic quickly surfaced a storage caching issue at the root of most of the team&#8217;s performance problems, and its automation let virtual machines migrate to whichever server and storage nodes would best meet performance needs, predicting the impact of each recommended action before it was executed. The team began by manually applying Turbonomic&#8217;s resizing recommendations, cutting end-user complaints and downtime, before automating scheduled resizing on its most critical applications. A second challenge emerged during the pandemic, when the shift to remote work led application owners to overprovision new machines for the sake of expedience, without time to reassess allocations as pressures mounted. Once things stabilised, BBC Studios set up a monthly maintenance window during which Turbonomic automatically resized overprovisioned workloads, reclaiming 228 GB of memory and 22 virtual CPUs in a single month. &#8220;Because we are able to rely on IBM Turbonomic&#8217;s AI-powered automation to assure application performance 24&#215;7, our team can now focus their efforts on pursuing strategic initiatives rather than fighting fires,&#8221; Waddell said. BBC Studios is now migrating onto broader infrastructure-as-a-service platforms and plans to bring Turbonomic with it.</p>
<p>Turbonomic itself is worth placing in context rather than taking as a generic &#8220;AI tool.&#8221; It began as Turbonomic Inc., founded in 2009, before IBM announced its intent to acquire the company on 29 April 2021 and closed the deal on 17 June 2021, reported at roughly $1.5 billion. Before the acquisition, Turbonomic had itself acquired SevOne, a network performance monitoring company, and ParkMyCloud, a cloud cost management tool, both in 2019, which is part of why the product now spans performance assurance and cost control rather than doing only one or the other. That lineage matters for a C-suite evaluating any similarly branded tool: the capability BBC Studios relied on is the product of several specialist acquisitions consolidated into one platform, not a single AI model trained from scratch for this purpose.</p>
<h2>The category both of these sit inside, and a caveat worth knowing</h2>
<p>Both deployments sit inside what the industry, and Gartner specifically, has labelled AIOps, the application of machine learning to operational data in order to find root causes and cut the time it takes to resolve incidents. It&#8217;s a real, analyst-defined category rather than marketing language invented by any single vendor. That said, there&#8217;s a caveat a UK board should hold onto before accepting any vendor&#8217;s &#8220;AIOps&#8221; claim uncritically: Gartner reportedly moved in 2025 to reframe its AIOps Platforms category as Event Intelligence Solutions, reportedly in response to what commentary described as overuse and dilution of the AIOps label across the vendor market. The underlying capability BBC Studios uses, root-cause identification and automated resource optimisation, is real and well-evidenced in this case study; the label attached to it in vendor marketing is less stable than the technology itself, and worth checking rather than assuming when evaluating a similar tool.</p>
<p>On the factory floor, the equivalent trend has its own name: industrial copilots, AI assistants embedded at the point of work rather than replacing the worker outright. Siemens launched its Industrial Copilot, built with Microsoft, in July 2024, and Niftylift&#8217;s Aiimi-built assistant fits the same pattern, guidance and knowledge access delivered directly to the person doing the job. A 2024 to 2025 survey by Rootstock Software found that 53 percent of manufacturers said they preferred copilot-style tools that assist a human operator, against 22 percent who preferred fully autonomous agents that act without a human in the loop, a preference that lines up with how Niftylift&#8217;s own assistant was actually built, guiding and escalating rather than deciding alone.</p>
<h2>Why the human checkpoint isn&#8217;t incidental</h2>
<p>Neither company removed the human decision point, and there are real, current reasons a UK C-suite should treat that as good practice rather than caution for its own sake. ISO/IEC 42001, the first international AI management system standard, published in December 2023, treats human oversight as a governance requirement rather than an optional safeguard, and a follow-on standard specifically addressing human oversight and controllability is reportedly in development. In the UK specifically, the Health and Safety Executive, alongside Automate UK and the Manufacturing Technology Centre, launched a joint programme on 10 June 2026 to develop workplace guidance for collaborative robots and AI-embedded robotics, an acknowledgement that existing workplace safety frameworks weren&#8217;t written with this kind of AI in mind. Niftylift&#8217;s assistant keeps an escalation path with training and audit trails for exactly the situations a frontline worker shouldn&#8217;t resolve alone; BBC Studios&#8217; team proved the automation manually before trusting it to run unattended. Both are small, unglamorous design choices, and both are the reason these deployments read as genuine operational improvements rather than a story about a single dramatic AI success.</p>
<h2>What a UK C-suite should take from both</h2>
<p>Set against the scale of the problem these tools are aimed at, both results look more meaningful than a headline percentage alone would suggest. The Fluke Corporation and Censuswide study of senior decision-makers across the UK, US and Germany, published in October 2025, found UK unplanned downtime costing up to £736 million a week nationally, an average of £1.36 million an hour, with 68 percent of UK manufacturers reporting an unplanned downtime event in the past year. Niftylift&#8217;s 80 percent reduction in diagnosis time isn&#8217;t just a tidy internal metric against that backdrop, it&#8217;s a direct lever against exactly the kind of cost that study describes. BBC Studios&#8217; reclaimed capacity is a smaller, less dramatic number in isolation, 228 gigabytes and 22 virtual CPUs in one month, but it&#8217;s evidence of a team that stopped firefighting and started running its infrastructure deliberately, which is precisely the outcome a board should be looking for when it approves an AI operations budget: not a single spectacular result, but a system that keeps finding smaller ones, month after month, without needing a person to go looking for them first.</p>


Fault Diagnosis on the Factory Floor

<h2>Key Takeaways</h2>
<ul>
<li>Nationwide Building Society, the UK&#8217;s second-largest mortgage provider and the world&#8217;s largest building society, serving more than 16 million members, built an <a rel="nofollow" href="https://www.networksjournal.com/ai">AI</a> Centre of Expertise with <a rel="nofollow" href="https://www.ibm.com/solutions/artificial-intelligence">IBM</a> Consulting and Microsoft Azure <a rel="nofollow" href="https://openai.com/solutions/">OpenAI</a> Service before running a single measured use case through it, governance first, evidence later.</li>
<li>The case study itself contains no quantified outcome at all, only a description of the governance structure and a statement that contract management, quality assurance and operational reporting use cases are, in the case study&#8217;s own present-continuous phrasing, still &#8220;developing, testing, piloting and deploying.&#8221; That&#8217;s worth reading precisely: as of this case study, Nationwide had built the scaffolding, not yet published the results.</li>
<li>A genuinely useful, more recent number does exist beyond the case study: Nationwide has reported using Azure OpenAI to help generate customer letters, cutting average response time from 45 minutes to 10 to 15 minutes, a real, specific figure. Separately, reporting on Nationwide&#8217;s wider rollout of Microsoft AI tools to roughly 16,000 staff notes the society itself says broader return on investment remains difficult to quantify, an honest admission worth crediting rather than glossing over.</li>
<li>Nationwide&#8217;s AI Centre of Expertise, an operations team, a cross-functional council and a delivery function, is a recognisable, repeatable IBM Consulting pattern, structurally similar to what IBM has built with Banco do Brasil and at Lockheed Martin, not a bespoke invention specific to Nationwide. Worth knowing for any board evaluating a similar engagement with the same vendor.</li>
<li>The Bank of England and FCA&#8217;s most recent joint survey found 75% of UK financial firms already using AI, up from 58% in 2022, with governance structures now standard practice across the sector. Nationwide&#8217;s approach is in line with where UK financial services already is, not meaningfully ahead of it.</li>
</ul>
<p>There&#8217;s a specific discipline worth applying to any case study that describes governance in detail and results not at all: read it as a status update, not a conclusion. Nationwide Building Society&#8217;s AI Centre of Expertise is a genuinely well-built piece of institutional scaffolding. It&#8217;s also, on the evidence of the case study alone, a structure without a published outcome yet attached to it, and the more interesting story is what&#8217;s actually emerged since.</p>
<h2>What Nationwide actually built</h2>
<p>Nationwide Building Society, the UK&#8217;s second-largest mortgage provider and the world&#8217;s largest building society, serves more than 16 million members and wanted to explore how generative AI could improve the experience it offers them. Moving from isolated AI experiments to organisation-wide deployment meant building the risk management, governance and operational frameworks first, not just the technology. &#8220;We are very excited to embark on our gen AI journey, like the rest of the world we have been captivated by the technology and the possibilities,&#8221; said Suresh Viswanathan, Chief Operating Officer at Nationwide. With support from IBM Consulting and powered by Microsoft Azure OpenAI Service, Nationwide established a society-wide AI strategy and operating model, anchored by a new AI Centre of Expertise. The centre combines an operations team running the AI lifecycle, a cross-functional council evaluating use cases, and a delivery function building solutions with large language models and enterprise data, alongside clear technical patterns and delivery principles for safely adopting AI. &#8220;It is where all the important functions with the Society come together, like Legal, Procurement, Technology, Security, Partner ecosystem, to provide one place where we can discuss and approve AI initiatives,&#8221; said Nitin Kulkarni, CIO of Data Platform at Nationwide&#8217;s AI Centre of Expertise. With that foundation in place, Nationwide is now developing, testing, piloting and deploying generative AI across use cases including contract management, quality assurance and operational reporting, using the technology to help colleagues process customer queries more quickly so they can focus more of their time on complex issues that need a human touch.</p>
<h2>Governance without a number attached, and what filled that gap since</h2>
<p>Read the case study closely and there&#8217;s a genuine gap worth naming: not a single quantified outcome appears anywhere in it. Every sentence describes structure, an operations team, a council, a delivery function, technical patterns, and the actual AI work is described only in the present continuous tense, &#8220;developing, testing, piloting and deploying,&#8221; rather than as something finished and measured. That&#8217;s not a criticism of Nationwide&#8217;s approach, building governance before scaling deployment is a defensible sequencing choice this publication has covered favourably elsewhere. It does mean a reader shouldn&#8217;t mistake a well-described governance structure for a demonstrated business outcome; the case study, read on its own terms, is evidence of the first and silent on the second.</p>
<p>What&#8217;s genuinely useful is that the gap has been partly filled since, by reporting beyond this specific case study. Nationwide has separately said it used Azure OpenAI to help generate customer letters, cutting average response time from 45 minutes down to 10 to 15 minutes, a real, specific, creditable number. But it&#8217;s worth pairing that with the fuller picture: coverage of Nationwide&#8217;s wider rollout of Microsoft AI tools to roughly 16,000 staff has reported the society&#8217;s own acknowledgement that broader return on investment remains difficult to quantify. That&#8217;s a genuinely honest position for a large institution to hold publicly, most vendor-driven case studies don&#8217;t concede exactly this, and it&#8217;s worth crediting Nationwide for the admission rather than reading it as a weakness. The accurate summary, taken together, is one strong, specific, measured win inside a much larger programme whose overall return the society itself says it can&#8217;t yet size.</p>
<h2>A mutual answerable to members, not shareholders, worth noting as context</h2>
<p>One structural detail worth a UK C-suite sitting with, though it&#8217;s the article&#8217;s own analytical framing rather than something Nationwide or IBM has stated explicitly: Nationwide is a mutual, member-owned rather than shareholder-owned, which means it faces no quarterly earnings call pressure to announce a headline AI win on any particular reporting cycle, and its accountability for how AI is governed runs through member and Board structures rather than a shareholder AGM demanding visible returns. That&#8217;s a genuinely different incentive environment to the one most large financial institutions operate in, and it may plausibly explain why Nationwide&#8217;s public account of this programme reads as patient and structural rather than promotional. Worth treating as informed speculation, not a documented causal claim, but a useful lens regardless for any C-suite comparing its own reporting pressures to Nationwide&#8217;s.</p>
<h2>Where this actually sits against UK regulation and the rest of the sector</h2>
<p>UK financial regulators have been consistent on one point: neither the FCA nor the Bank of England has issued AI-specific rules for firms like Nationwide, choosing instead to apply existing frameworks, Consumer Duty, the Senior Managers and Certification Regime, operational resilience requirements, and third-party risk management, to AI the same way they&#8217;d apply to any other technology or outsourcing decision. The FCA reopened its &#8220;AI Input Zone&#8221; consultation in May 2026, still actively gathering industry input on what good AI governance actually looks like in practice, rather than mandating a specific model. Against that backdrop, the Bank of England and FCA&#8217;s most recent published joint survey, run in November 2024 and covering 118 firms, found 75% already using AI in some form, up sharply from 58% in 2022, with governance and oversight structures now standard practice across the sector rather than a differentiator. Nationwide&#8217;s AI Centre of Expertise, in other words, puts it in line with where UK financial services already is by 2026, a genuinely sound, well-built approach, but not meaningfully ahead of where its peers have also arrived.</p>
<h2>The vendor pattern worth recognising before signing a similar deal</h2>
<p>It&#8217;s also worth being precise about how bespoke this particular structure actually is. An operations team running the AI lifecycle, a cross-functional governance council, a delivery function building on top of enterprise data, is a recognisable, repeatable IBM Consulting pattern, not a design specific to Nationwide. IBM has built structurally similar governance frameworks at Banco do Brasil, working alongside EY, and underpinned Lockheed Martin&#8217;s AI Factory with comparable watsonx.governance tooling. None of that makes Nationwide&#8217;s version wrong or diminishes the real work involved in standing it up across a 16-million-member institution. It does mean a board evaluating a similar engagement with the same vendor should expect a broadly similar governance architecture to arrive, not a uniquely tailored one, and should price and scope the engagement with that in mind.</p>
<h2>What a UK C-suite should actually take from this</h2>
<p>Nationwide&#8217;s AI Centre of Expertise is a genuinely sound piece of institutional design, sequencing governance before deployment, bringing Legal, Procurement, Security and the business together in one forum before approving use cases, is exactly the discipline this publication has argued elsewhere is the actual differentiator in enterprise AI. The useful correction is in how the story gets read, not in what Nationwide built. A case study describing governance in detail and results in the present tense is a status update, not a finished result, and the honest picture, one strong, specific number on customer letter response times, a much larger programme whose overall return the society itself says it can&#8217;t yet quantify, a governance structure that&#8217;s a standard vendor deliverable rather than a bespoke one, is more useful to a board than either the polished version or a dismissive one. The lesson isn&#8217;t that Nationwide got this wrong. It&#8217;s that &#8220;we built the governance first&#8221; and &#8220;we&#8217;ve proven the return&#8221; are two different claims, and it&#8217;s worth knowing precisely which one any case study, including a strong one, is actually making.</p>


AI as Institutional Memory: What Nationwide Building Society’s AI Centre of Expertise Actually Governs

<h2>Key Takeaways</h2>
<ul>
<li>Four UK and Ireland businesses, Norwich Theatre, Dental Tech, Seths Estate Agents and IPS Fire &#038; Security, consolidated multi-site telephony onto cloud platforms, and each case study is a useful example of what actually changes operationally, and worth reading with a genuinely critical eye rather than taking every stated number at face value.</li>
<li>Norwich Theatre&#8217;s case study frames its migration as racing &#8220;the UK&#8217;s ISDN switch-off deadline approaching by the end of 2025.&#8221; That date is outdated: Openreach delayed the national PSTN switch-off from December 2025 to 31 January 2027 back in 2023, and has since stated that date is final. Worth correcting rather than repeating.</li>
<li>Dental Tech is described as &#8220;a leading Irish dental technology provider,&#8221; which matters for how its story should be read alongside the other three: Ireland&#8217;s switch-off, run by Open Eir under ComReg, follows a phased, exchange-by-exchange rollout tied to fibre availability rather than the UK&#8217;s single fixed national deadline, so Dental Tech was never actually racing the same clock as the other three companies here.</li>
<li>Seths Estate Agents&#8217; own case study contains an internal inconsistency worth flagging plainly: it states the agency &#8220;operates from two sites&#8221; in one sentence, then describes &#8220;full fibre broadband across all three sites&#8221; a few sentences later, alongside &#8220;12 staff and 19 users,&#8221; another mismatch worth a reader noticing rather than smoothing over.</li>
<li>Seths Estate Agents&#8217; new system delivers &#8220;99.9 percent uptime,&#8221; a real and meaningful figure, but worth translating precisely: 99.9% uptime permits roughly 8.76 hours of downtime a year, about 43.8 minutes a month, a genuinely different picture from &#8220;always on,&#8221; and useful context for any board about to sign a similar SLA.</li>
</ul>
<p>Multi-site telephony consolidation case studies tend to get read the same way: company had a problem, company fixed it, company reports a good number. That&#8217;s a reasonable first pass, but four real examples here reward a closer read, because between them they contain an outdated regulatory deadline, a geography mismatch, an internal numbers inconsistency, and a strong statistic worth translating into what it actually means. None of that undermines the underlying value of what any of these four businesses did. It&#8217;s exactly the kind of detail a UK C-suite should be checking before treating any single case study, including a strong one, as a template to copy.</p>
<h2>Norwich Theatre: real result, outdated deadline</h2>
<p>Norwich Theatre, which operates three venues, Theatre Royal, Norwich Playhouse and Stage Two, presenting a wide range of performances across multiple departments, was running an ageing telecommunications system plagued by reliability and functionality issues, with the UK&#8217;s ISDN switch-off deadline approaching by the end of 2025, according to the case study. VoiceHost deployed a cloud-based Hosted PBX system, removing the need for on-site hardware entirely, and added a desktop application, wallboards, IVR and conference calling, backed by 24/7 support and Snom D120 and D713 handsets. &#8220;Updating our telecommunications system has led to a host of benefits, all at a cost-effective rate,&#8221; said Matthew Johnston, Head of IT at Norwich Theatre. The new system has improved uptime and redundancy, moved the theatre onto a simplified per-user, per-month pricing model for easier budgeting, and freed the IT team to focus on strategic work rather than maintaining ageing on-site hardware.</p>
<p>The one correction worth making plainly: the &#8220;by the end of 2025&#8221; framing reflects Openreach&#8217;s original PSTN switch-off target, which the company delayed back in 2023, moving the UK-wide date to 31 January 2027, a date Openreach has since described as final. That doesn&#8217;t change anything about the value of Norwich Theatre&#8217;s migration, moving off ageing on-premises hardware onto a modern hosted system was worth doing regardless of the exact regulatory date. But a reader using this case study to gauge their own urgency should work from the current 2027 date, not the superseded 2025 one, particularly given how much runway that difference actually represents for a multi-venue rollout.</p>
<h2>Dental Tech: a genuinely strong result, in a different regulatory race entirely</h2>
<p>Dental Tech, a leading Irish dental technology provider with 35 employees across four clinics and one laboratory facility, was running a VoiceStack phone system integrated with its CareStack CRM, but the setup delivered poor call quality, missed calls, inconsistent routing between sites, and difficulty directing callers to the right department, all while costing more than the business wanted to pay. The VoIP Shop deployed a fully managed Yeastar Cloud Phone System across all five locations, with advanced call routing and flow design, call recording and live wallboards, Irish SIP trunks for inbound and outbound calling, reuse of Dental Tech&#8217;s existing handsets, and number porting completed the next working day with zero downtime. &#8220;We loved the new phone system trial in our first clinic and quickly made the decision to roll it out across all our other sites. The migration was seamless, and the system simply works,&#8221; said Olga Popova, Head of Marketing and Sales at Dental Tech. The switch cut Dental Tech&#8217;s monthly telephony costs by 75% compared with VoiceStack, eliminated the routing and transfer issues that had frustrated callers, and consolidated management of all five sites onto a single platform.</p>
<p>This is a genuinely strong, well-documented result, and it&#8217;s worth reading in its correct context rather than folding it into a UK ISDN-deadline narrative alongside the other three companies here. Ireland&#8217;s own network transition, run by Open Eir and regulated by ComReg, doesn&#8217;t follow a single fixed national cutoff the way the UK&#8217;s Openreach-led process does; it moves exchange by exchange as fibre becomes available locally, with affected businesses given 12 to 18 months&#8217; notice once their specific exchange&#8217;s countdown starts. Dental Tech&#8217;s motivation, poor call quality and high cost, was entirely sufficient reason to migrate on its own. It just wasn&#8217;t the same regulatory clock the other three UK businesses in this piece were racing, and a board reading this case study for ISDN-deadline urgency specifically should know that distinction.</p>
<h2>Seths Estate Agents: strong numbers, one to double-check and one worth translating</h2>
<p>Seths Estate Agents, a family-run estate and letting agency in Leicester with more than 50 years in the local property market, operates from two sites with 12 staff and 19 users, but its legacy analogue phone system couldn&#8217;t route calls between offices, leaving customer enquiries missed whenever one site got busy. Per-call billing also made monthly costs unpredictable, and field staff had no way to work remotely. The VoIP Shop replaced the analogue setup with a Cloud PBX system featuring an IVR menu with automatic call overflow between sites, Busy Lamp Field visibility of staff availability, full fibre broadband across all three sites with managed routers, Polycom IP handsets for all 19 users, mobile app access for field staff, and number porting that preserved the agency&#8217;s existing phone numbers. &#8220;Since moving to The VoIP Shop, we&#8217;ve had a much more reliable phone system across our sites. Calls no longer get missed even when one office is busy, and it&#8217;s reassuring to know our costs are fixed each month,&#8221; said Anish Popat, Director of Seths Estate Agents. The new system delivers 99.9% uptime, fixed monthly costs in place of unpredictable per-call billing, and significantly fewer missed calls thanks to inter-site overflow routing.</p>
<p>Two things worth flagging plainly, in the spirit of not repeating a source&#8217;s numbers uncritically. First, the case study itself is internally inconsistent about how many sites are actually involved, &#8220;operates from two sites&#8221; in one place, &#8220;full fibre broadband across all three sites&#8221; a few sentences later, alongside a 12-staff, 19-user headcount that doesn&#8217;t resolve the discrepancy either way. That&#8217;s not necessarily wrong, a growing agency might genuinely have added a site between the start of the relationship and the fibre rollout, but the case study as written doesn&#8217;t explain it, and a reader shouldn&#8217;t quietly assume it away. Second, and more useful for any board reading this as a benchmark: 99.9% uptime is a real, meaningful commitment, and it&#8217;s worth translating into what it actually permits rather than treating it as shorthand for &#8220;always on.&#8221; Standard &#8220;three nines&#8221; math puts 99.9% uptime at roughly 8.76 hours of permitted downtime a year, around 43.8 minutes a month. That&#8217;s a genuinely strong SLA figure for a small multi-site business, and also a specific, finite number worth knowing before assuming a cloud telephony system will never go down.</p>
<h2>IPS Fire &#038; Security: the cleanest of the four</h2>
<p>IPS Fire &#038; Security had outgrown its legacy PSTN-based PBX system. The setup couldn&#8217;t separate call destinations properly, wouldn&#8217;t support the kind of complex IVR routing a growing security business needed, made it awkward to transfer calls between staff, and failed to display the correct outbound number to customers. TTNC moved IPS Fire &#038; Security off the old PSTN setup and onto a Cloud PBX platform running over VoIP, including Yealink IP desk phones pre-configured for plug-and-play deployment, CRM integration and porting of the company&#8217;s existing numbers. &#8220;Can&#8217;t rate these guys highly enough. We have been using them for many years now and honestly can&#8217;t think of any faults or any issues we have had with them,&#8221; said Noah Searle, IT Manager at IPS Security. With the new system in place, IPS now displays its main office number on every outbound call, routes incoming calls through IVR to the right department automatically, and tracks communications in real time, with the old handset and line restrictions gone and predictable monthly costs in place of upgrade and maintenance fees.</p>
<p>Of the four case studies here, this is the one with the fewest loose threads: no outdated deadline framing, no geography mismatch, no internal inconsistency. It&#8217;s also, notably, a company whose own business is fire and security, where call routing reliability, the right outbound number displaying correctly, IVR getting a customer to the right person, carries a slightly sharper edge than it would for most businesses. That context is worth keeping in mind when comparing the four: the same technical fix means something different depending on how much an organisation&#8217;s core function depends on the phone actually working correctly the first time.</p>
<h2>What a UK C-suite should actually take from reading four of these side by side</h2>
<p>None of the four companies profiled here did anything wrong, and every one of them achieved a real, worthwhile result. What this comparison actually demonstrates is a discipline worth applying to any telephony case study, or any vendor case study at all: check whether the regulatory deadline cited is still current, Norwich Theatre&#8217;s isn&#8217;t; check whether the geography actually matches the regulatory pressure being invoked, Dental Tech&#8217;s doesn&#8217;t quite; check the case study&#8217;s own numbers against each other for internal consistency, Seths Estate Agents&#8217; don&#8217;t fully resolve; and translate any headline percentage, uptime, cost reduction, into what it concretely means before treating it as a benchmark. Applied consistently, that discipline doesn&#8217;t make any of these four stories less useful. It makes them useful for the right reasons, rather than for whichever number happens to be in the headline.</p>


Multi-Site Telephony Consolidation: The Real Numbers Behind 4 UK and Ireland Rollouts

<h2>Key Takeaways</h2>
<ul>
<li>Three very differently sized financial-services-adjacent companies, Bridgewater Associates (a giant hedge fund), Copp Clark (a small Canadian data vendor) and ICONOMI (a crypto investment platform), have taken three genuinely different approaches to cyber and operational risk, and the differences track company type and regulatory exposure closely, not one company simply doing more than the others.</li>
<li>Bridgewater&#8217;s Zero Trust rollout, rebuilding security around Microsoft 365 and identity-based access instead of a corporate firewall, is described in a case study that references COVID-19 as a live event and a Davos trip &#8220;this year,&#8221; dating it to roughly January to March 2020, before NIST had even published its formal Zero Trust Architecture framework. Genuinely early. Also, by 2026, Zero Trust has moved from differentiator to baseline expectation across financial services, with Gartner putting global, cross-industry adoption at around 63% and financial services among the leading adopter sectors.</li>
<li>Igor Tsyganskiy, quoted in that case study as Bridgewater&#8217;s CTO, later became Microsoft&#8217;s global Chief Information Security Officer in January 2024, succeeding a 14-year incumbent, then moved into an EVP role at Microsoft Research by March 2026, a genuinely notable trajectory worth knowing when reading his 2020 quote.</li>
<li>DORA and rising FCA scrutiny explain why a small vendor like Copp Clark and a crypto platform like ICONOMI are now investing in structured compliance work regardless of size: DORA became enforceable across the EU in January 2025, and the FCA reports over 40% of cyber incidents reported to it in 2025 involved a third party, exactly the exposure a company like Copp Clark represents to its financial-institution customers.</li>
<li>None of the three approaches is more &#8220;correct&#8221; than the others. A board&#8217;s actual task isn&#8217;t picking the best model off this list; it&#8217;s matching its own regulatory exposure and company size to the approach that fits, rather than assuming a giant asset manager&#8217;s playbook scales down, or a small vendor&#8217;s proportionate fix scales up.</li>
</ul>
<p>Put a hedge fund, a reference-data vendor and a crypto platform in the same room and they&#8217;ll describe completely different security priorities, and all three will be right. Bridgewater Associates, Copp Clark and ICONOMI sit at genuinely different points on the financial-services risk spectrum, by size, by regulatory exposure, by what an attacker or a regulator actually cares about in each case, and comparing what each one actually did is a more useful exercise for a UK C-suite than treating any single approach as the model to copy.</p>
<h2>Bridgewater: a genuinely early Zero Trust move, worth dating precisely</h2>
<p>Bridgewater Associates, at the time one of the world&#8217;s largest hedge funds managing roughly $150 billion, had built its security around a traditional perimeter that made remote and mobile access difficult and limited how far cloud collaboration could go. &#8220;We developed a vision to improve productivity and collaboration and deliver comprehensive mobile access, but to achieve this goal, we needed to overhaul our technology,&#8221; said Anthony Golia, Head of Productivity and Endpoint Engineering at Bridgewater Associates. Xantrion, working alongside Microsoft, rebuilt Bridgewater&#8217;s security model around Zero Trust principles using Microsoft 365, replacing reliance on the corporate firewall with granular, identity-based access controls. &#8220;Since implementing a Zero Trust strategy using Microsoft 365 technologies, our employees can fulfill their company duties from anywhere in the world while maintaining tight control over core security needs. This has been extremely valuable now that all of our company is working from home due to COVID-19. Everyone is working from an insecure environment today, and with our Zero Trust strategy in place, we are confident we can keep our data safe,&#8221; said Igor Tsyganskiy, Chief Technology Officer at Bridgewater Associates. &#8220;Because we collaborated with Microsoft to improve our security controls, I can access my files on OneDrive as if I was in the office. When we went to the World Economic Forum meetings at Davos this year, I accessed my files from my iPad just like I would in the office, so my team could continue to adjust the presentations throughout the conference. In the past, we wouldn&#8217;t have allowed this kind of access from a public location, making that collaboration more difficult,&#8221; said Greg Jensen, co-Chief Investment Officer at Bridgewater Associates.</p>
<p>Two details worth being precise about. First, the timing: a case study referencing COVID-19 as a live disruption and a Davos trip &#8220;this year&#8221; places this rollout roughly in the first quarter of 2020, Davos 2020 ran 21 to 24 January that year, meaning Bridgewater had rebuilt its access model around Zero Trust principles before NIST published its own formal Zero Trust Architecture framework, SP 800-207, in August 2020. That&#8217;s a genuinely early move by a large financial institution, not a follow-the-herd decision. Second, worth knowing when reading Tsyganskiy&#8217;s quote: he later left Bridgewater, joined Microsoft as chief strategy officer for security in September 2023, and was named Microsoft&#8217;s global Chief Information Security Officer effective January 2024, succeeding a CISO who&#8217;d held the role for 14 years, before moving into an EVP role at Microsoft Research by March 2026. The person describing this Zero Trust rollout went on to run security for one of the world&#8217;s largest technology companies, a detail that adds real weight to the quote without needing embellishment. On scale, it&#8217;s also worth noting Bridgewater&#8217;s assets under management have since fallen from roughly $150 billion to around $92 billion as of the end of September 2025, a deliberate downsizing toward investment agility rather than a distress signal, but the two figures describe different points in time and shouldn&#8217;t be conflated.</p>
<h2>Copp Clark and ICONOMI: proportionate compliance, not the Bridgewater playbook scaled down</h2>
<p>Copp Clark, a small Canadian company supplying financial institutions with global public holiday, trading hour and close-day data, took a completely different route: not a wholesale security architecture rebuild, but a scoped DORA gap assessment and Digital Operational Resilience Testing, deliberately calibrated to avoid &#8220;compliance activities that went beyond what its actual role required,&#8221; in the case study&#8217;s own words. That&#8217;s the right instinct for a company of its size and role, DORA became enforceable across the EU in January 2025, and the FCA has reported that more than 40% of cyber incidents reported to it in 2025 involved a third party, exactly the exposure a small data vendor represents to the financial institutions that rely on it. ICONOMI took a third route again: an onboarding and functional testing pass alongside its FCA cryptoasset AML registration, a compliance track specific to crypto platforms rather than to financial-services vendors generally. Neither company needed, or attempted, a Bridgewater-scale Zero Trust rebuild, and that&#8217;s the correct call, not a lesser one; a reference-data vendor and a crypto onboarding flow carry a genuinely different risk profile than a global asset manager&#8217;s entire remote workforce.</p>
<h2>What actually explains the difference</h2>
<p>The pattern across all three isn&#8217;t effort or sophistication, it&#8217;s exposure. Financial services was the second most-targeted industry globally in the first half of 2025, roughly 19% of observed attacks, and 65% of financial firms reported being hit by ransomware in the prior year, with average breach costs in the sector running around $6 million. Regulatory pressure has risen to match: DORA&#8217;s enforcement, the FCA&#8217;s own reporting on third-party-linked incidents, and industry estimates suggesting only around half of EU financial institutions were fully DORA-compliant even a year into enforcement, all point toward a landscape where every company touching financial data, regardless of size, now has a specific compliance obligation attached to its specific role. Zero Trust has followed a similar arc inside large institutions: Gartner&#8217;s most recent research puts global, cross-industry Zero Trust adoption at around 63%, with financial services among the leading adopter sectors, meaning what Bridgewater did as a genuine early move in 2020 is, by 2026, closer to a baseline expectation for an organisation its size than a differentiator.</p>
<h2>What a UK C-suite should actually take from this</h2>
<p>The temptation with a comparison like this is to rank the three companies by how impressive their security story sounds. That&#8217;s the wrong exercise. Bridgewater needed, and built, a comprehensive architectural rebuild because it is a global asset manager with a large, distributed workforce handling extraordinarily sensitive data, and it did so early enough that the engineer who led it went on to run security at Microsoft. Copp Clark needed, and got, a proportionate compliance assessment scoped to its actual role as a third-party data vendor, not more than that. ICONOMI needed a compliance track specific to being a regulated crypto platform. The right question for a board isn&#8217;t &#8220;which of these should we copy.&#8221; It&#8217;s &#8220;which of these three profiles, by size, by data sensitivity, by regulatory category, actually matches our own position,&#8221; and then building the proportionate version of that answer, rather than either underbuilding against real exposure or over-engineering a Zero Trust programme a company&#8217;s actual risk profile doesn&#8217;t yet justify.</p>


What UK Financial Services Firms Are Actually Doing About Cyber Risk: 3 Approaches Compared

<h2>Key Takeaways</h2>
<ul>
<li>Two real companies, Arcata Cloud and Copp Clark, cleared two different compliance bars, SOC 2 and DORA, under real commercial pressure, and both stories are genuinely instructive for a UK C-suite, provided the specific claims are read precisely rather than treated as interchangeable proof of &#8220;being secure.&#8221;</li>
<li>Arcata Cloud passed SOC 2 Type 1 on its first attempt in four weeks. That&#8217;s a real, well-executed result, but Type 1 tests whether controls are properly designed at a single point in time, not whether they hold up under sustained operation, which is what SOC 2 Type 2 actually tests over a three-to-twelve-month observation window. Sophisticated enterprise buyers generally treat Type 1 as a credible first step, not the final answer.</li>
<li>Copp Clark, a Canadian reference-data provider, is described in its own case study as having &#8220;found itself classified as an ICT third-party service provider&#8221; under the EU&#8217;s DORA regulation. That&#8217;s a real and common pattern, being pulled into a financial customer&#8217;s own compliance register, but it&#8217;s a materially different, lighter designation than being named a formally-designated &#8220;Critical ICT Third-Party Provider&#8221; by EU regulators, a status held by only 19 firms globally as of the first official list published in November 2025.</li>
<li>Rigour, roughly ranked for a UK C-suite: Cyber Essentials (self-assessed, five baseline controls) sits well below Cyber Essentials Plus (independently tested), which sits below SOC 2 Type 1 (independently audited design), which sits below SOC 2 Type 2 (independently audited operation over time), with DORA sitting apart from all of them as a binding EU regulation rather than a certification at all.</li>
<li>None of that undermines what either company achieved. It means a board should ask a more specific question than &#8220;are they certified&#8221;: which specific standard, which tier of that standard, and tested over what period.</li>
</ul>
<p>Compliance certifications and regulatory labels tend to get treated in boardrooms as a single signal: certified or not, compliant or not. That flattens genuinely useful distinctions a UK C-suite should actually understand, both when evaluating its own posture and when reading a vendor&#8217;s claims. Two real case studies, one an enterprise SOC 2 audit under a hard launch deadline, one a Canadian company&#8217;s brush with EU financial regulation, are a useful way into what those distinctions actually are.</p>
<h2>Arcata Cloud: a real first-attempt pass, of a specific, faster kind of audit</h2>
<p>Arcata Cloud was four weeks from a public launch with a non-negotiable deadline: an enterprise customer had made SOC 2 Type 1 compliance a contractual condition of signing, and the audit had to be booked and passed inside that window. The company&#8217;s security posture had grown organically as the product was built, which meant nobody had a clear picture of where the actual gaps were. Hashorn ran a two-phase engagement, starting with comprehensive threat modelling using STRIDE analysis, a real, established methodology developed at Microsoft in 1999 covering spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege, alongside a full application and infrastructure-as-code audit, then moving into prioritised hardening work. That included migrating secrets into HashiCorp Vault, tightening 213 separate IAM policies, and wiring DevSecOps tooling, Semgrep, Checkov and Trivy, into the pipeline so the same issues couldn&#8217;t creep back in unnoticed. &#8220;We knew our security posture had grown organically. We didn&#8217;t know we had two critical issues we&#8217;d been shipping for nine months. Hashorn found them, helped us fix them, and got us through SOC 2 on the first try,&#8221; said Priya Iyer, CTO of Arcata Cloud. By the company&#8217;s own account, Arcata Cloud launched with zero critical CVEs outstanding, all high and critical findings resolved before the deadline, and passed its SOC 2 audit on the first attempt with zero observations.</p>
<p>That&#8217;s a genuinely strong result, and it&#8217;s worth being precise about what it actually certifies. SOC 2 Type 1 assesses whether an organisation&#8217;s controls are suitably designed at a single point in time; SOC 2 Type 2 assesses whether those same controls actually operated effectively over a sustained observation period, typically three to twelve months. A four-week timeline is plausible and unremarkable for Type 1 specifically, industry sources put typical Type 1 timelines at four to eight weeks, precisely because there&#8217;s no observation period to wait out; it&#8217;s a design review, not an endurance test. Enterprise procurement teams generally treat a Type 1 report as a credible first step, sufficient to unblock an early deal, but expect a Type 2 report before granting deeper production access or renewing at scale. None of that diminishes what Arcata Cloud did under real time pressure. It means &#8220;passed SOC 2 on the first try&#8221; is the correct, honest description of a real achievement, and &#8220;proven secure over time&#8221; is a claim Type 1 doesn&#8217;t make, and isn&#8217;t designed to.</p>
<h2>Copp Clark: a real DORA engagement, with a classification worth reading precisely</h2>
<p>Copp Clark, a Canadian company supplying financial institutions with global public holiday, trading hour and close-day data, found itself classified as an ICT third-party service provider under the EU&#8217;s DORA regulation because of the European financial businesses it serves. The tricky part wasn&#8217;t the regulation itself, it was scoping Copp Clark&#8217;s proportional responsibility accurately, so the company didn&#8217;t drain its resources on compliance activities that went beyond what its actual role required. Sigma Software ran stakeholder interviews to map Copp Clark&#8217;s existing security processes, then performed a gap assessment benchmarked directly against DORA&#8217;s requirements for ICT third-party providers, producing a Risk Management Policy, Third-party Management Policy, Business Continuity &#038; Disaster Recovery Plan, and Incident Response Plan, followed by Digital Operational Resilience Testing, scoping a penetration test specifically to Copp Clark&#8217;s distributed infrastructure rather than running a blanket, resource-heavy assessment across everything. &#8220;It was our pleasure working with the Sigma Software. They provided friendly, professional, and informative support at all times,&#8221; said Carol Champ, VP – Operations at Copp Clark Limited. The engagement helped Copp Clark establish a security process aligned with both DORA and ISO 27001, and the company went on to pass third-party regulatory checks requested by its European financial customers.</p>
<p>DORA, which became enforceable across the EU on 17 January 2025, applies to a broad set of EU-regulated financial entities and, separately, to the ICT third-party providers those entities rely on. It&#8217;s worth understanding that &#8220;ICT third-party provider&#8221; status under DORA actually comes in two meaningfully different tiers. The ordinary tier is a classification a financial-services customer effectively assigns to its own vendors as it builds its required DORA Register of Information, a broad, genuinely somewhat ambiguous category at the edges that a company like Copp Clark can be pulled into simply by serving EU financial customers, exactly the pattern this case study describes. The second, formal tier is &#8220;Critical ICT Third-Party Provider&#8221; status, a designation made directly by the EU&#8217;s supervisory authorities, and it is a considerably narrower club: only 19 firms, mostly major cloud and technology providers, were named on the first official list, published in November 2025. The case study&#8217;s framing of Copp Clark as having &#8220;found itself classified&#8221; as an ICT third-party provider is an accurate and defensible description of the ordinary, customer-driven tier. It is not the same claim as formal critical-provider designation by EU regulators, and a board reading a similar case study elsewhere should keep that distinction in mind rather than assume every &#8220;DORA classification&#8221; story describes the same regulatory weight.</p>
<h2>A rigour decoder for the boardroom</h2>
<p>Set alongside the UK&#8217;s Cyber Essentials scheme, these two case studies map out a useful, honest hierarchy for a C-suite to keep in mind rather than treating every certification or regulatory mention as equivalent proof of security maturity. Cyber Essentials, at its base tier, is a self-assessed questionnaire against five fixed technical controls, externally verified but not independently audited; Cyber Essentials Plus adds genuine independent technical testing on top of the same five controls. SOC 2 goes considerably further, covering not just technical controls but change management, monitoring and alerting, incident response and vendor risk management, evidenced through documented policy and independent audit testing, with Type 1 checking that those controls are properly designed and Type 2 checking that they actually held up in practice over months of real operation. DORA sits apart from all of it: not a certification a company can hold at all, but a binding EU regulation with legal force, covering operational resilience, mandatory incident reporting timelines, a formal register of third-party relationships and, for the largest and most integrated providers, threat-led penetration testing. ISO 27001, the international information security management standard Copp Clark aligned to alongside its DORA work, is a genuinely useful practical foundation for DORA compliance, most compliance advisories treat it as a substantial head start, but it does not by itself satisfy DORA&#8217;s more specific obligations around incident-reporting timelines and the Register of Information.</p>
<h2>What a UK C-suite should actually ask</h2>
<p>Both of these case studies describe real, well-executed work under real constraints, a four-week deadline in Arcata Cloud&#8217;s case, a proportionality problem in Copp Clark&#8217;s. Neither deserves to be read as more, or less, than what it actually is. The useful discipline for a board, whether assessing its own posture or a vendor&#8217;s claims, is to stop accepting &#8220;certified&#8221; or &#8220;compliant&#8221; as a single, flat answer and ask three sharper questions instead: which specific standard is being claimed, which tier or type within that standard, Type 1 or Type 2, base Cyber Essentials or Plus, ordinary third-party status or formal critical designation, and tested or observed over what period. Arcata Cloud and Copp Clark both have real, creditable stories to tell. The value of understanding the fine print isn&#8217;t doubting either of them. It&#8217;s knowing exactly what to ask the next vendor whose case study is less carefully worded.</p>
