Skip to main content

Author Archives: Ant Bullock

Older posts
Newer posts

Culture Club – creating joy at work

Posted on by
The Ideal team celebrating an Easter egg hunt in the office.

At the heart of our organisation is a simple belief, that when people feel connected, supported, and valued, they thrive.

That’s why our Culture Club has been working hard behind the scenes to create moments of joy, laughter, and community across the year. In the last 12 months alone, they’ve organised over 20 events for us all to enjoy! Here are some of the ways we’ve been making work more than just work:

The Great Garden Bake Off

From signature sponges to showstoppers, our bakers rose to the challenge in a friendly competition that brought out everyone’s inner Paul Hollywood. The icing on the cake? Sharing slices (and smiles) with teammates.

Golf days

For those who enjoy the great outdoors (and a bit of healthy competition), our golf days have been a hole-in-one — (mostly) great weather, great company, and even the occasional birdie.

Volunteering at Tarner Park

As part of our commitment to giving back, we spent a day gardening at Tarner Park in Brighton, supporting a fantastic local charity. Getting our hands dirty for a good cause brought a whole new sense of team spirit. It was so good, we’ve been back two years in a row!

Summer Party

Our summer bash combined virtual cricket with delicious food and plenty of laughter. It was a great way to unwind, connect, and celebrate the sunshine (however brief!).

Christmas Party

We traded the usual festivities for something a little different — a themed escape room, followed by dinner and drinks. Nothing bonds a team like being locked in a room together under pressure!

Easter Egg Hunt

The office turned into a chocolate-fuelled treasure hunt, with eggs tucked in unexpected places and plenty of friendly rivalry.

Blue Monday Boost

To lift spirits on the so-called “saddest day of the year”, we brought everyone together for coffee, cake, and conversation. A small gesture with a big impact.

Coat Drive for Local Charity ‘Off The Fence’

We wrapped up the year with a coat drive, collecting warm clothing for a local homeless charity. A simple way to show kindness and care for our wider community.

These moments – big and small – help shape our culture and remind us that work can be a place of joy, connection, and purpose. A huge thank you to the Culture Club for making it all happen.

Promise and Peril in the Age of Agentic AI: Navigating the New Security Landscape

Posted on by

The IT function is undergoing its most fundamental transformation in decades. We’re moving from an era where our job was to provide and secure technology that helps humans DO work to an era where we provide and secure technology that DOES the work. This shift is profound, it’s happening at unprecedented speed, and it’s creating entirely new categories of security risk that most enterprises aren’t prepared for.

1.1 The Agentic Transformation

The rapid evolution from the mid-90s “castle and moat” security model through cloud computing, SaaS, and software-defined networking gave us a quarter of a century to adapt. But as those working hands-on with AI every day understand, the magnitude and speed of change in the coming years could make that look like a walk in the park. We had 25 years to manage the previous transformation. We may have just 5 years for the next one. As with past technological disruptions, not every company will meet the challenge, but this is likely the timeframe for anyone that wants to be ahead of the curve.

Agentic AI systems differ fundamentally from traditional generative AI in their capacity for autonomous operation. Where generative AI responds to prompts with relatively straightforward generated outputs, agentic AI actively plans, reasons, and executes tasks with minimal human oversight. These systems can access external tools, interact with databases, call APIs, and even generate and execute code to accomplish their objectives.

Consider a typical enterprise scenario: an agentic AI system managing supply chain operations doesn’t merely analyse data and provide recommendations. It autonomously monitors inventory levels, predicts demand patterns, negotiates with suppliers through API integrations, places orders, and adjusts logistics arrangements in real time. This level of autonomy promises unprecedented operational efficiency but it also introduces security risks that extend far beyond those associated with “traditional” AI implementations.

To get a handle on the complete rethink of the enterprise technology and security stack required, consider how enabling AI capabilities represents the antithesis of conventional security thinking: the more access generative AI has to data, the more reliable it becomes, and the more autonomy agentic AI has, the more useful it becomes. So – more access, more autonomy – basically cyber security kryptonite.

1.2  Understanding the Unique Risk Profile

The security implications of agentic AI deployment are both profound and multifaceted. As discussed in the Cloud Security Alliance’s Agentic AI Red Teaming Guide, these systems introduce emergent behaviours not present in traditional generative AI, including stateful memory across interactions and sophisticated tool orchestration capabilities. These characteristics fundamentally alter the threat landscape, creating what is essentially “a completely new attack surface”, the most obvious examples of which are summarised below.

1.2.1  Tool Misuse and Exploitation

Perhaps the most immediate risk stems from the agents’ ability to interact with external tools and systems. Unlike generative AI, which is confined to producing text or content, agentic AI can execute actions through integrated tools. Unit 42 research demonstrates how attackers can manipulate agents through carefully crafted prompts to abuse legitimate tool access, potentially leading to unauthorised database queries, internal network access, or even arbitrary code execution.

The risk compounds when agents are granted broad permissions to accomplish their tasks effectively. An agent designed to manage customer support tickets might need access to customer databases, payment systems, and communication platforms. If compromised, such an agent could become a vector for data exfiltration or service disruption at machine speed.

1.2.2  Intent Breaking and Goal Manipulation

Agentic AI systems operate based on defined objectives rather than simple reactive responses. This goal-oriented behaviour introduces a novel attack vector: intent manipulation. Adversaries can potentially subvert an agent’s core objectives through sophisticated prompt injection techniques, causing the agent to pursue malicious goals whilst appearing to operate normally.

The Cloud Security Alliance identifies this as a critical vulnerability unique to agentic systems. An attacker might subtly alter an agent’s perceived goals, redirecting a financial analysis agent to prioritise certain investments or causing a security monitoring agent to overlook specific patterns. These attacks are particularly insidious because they exploit the agent’s reasoning capabilities (or lack thereof!) rather than traditional software vulnerabilities.

1.2.3  Identity and Trust Challenges

Agents are more akin to users – perhaps even super-users – than they are to tools within the network. As agentic AI systems increasingly operate as first-class entities within enterprise environments, identity management becomes paramount. These agents often require their own identities to access systems and perform tasks, creating new challenges for authentication and authorisation frameworks.

The risk of identity spoofing and impersonation extends beyond traditional concerns. Compromised agent credentials could allow attackers to masquerade as trusted autonomous systems, potentially accessing sensitive data or triggering cascading failures across interconnected agent networks. Research indicates that treating agents as privileged users requires robust identity governance, including multi-factor authentication adaptations and just-in-time provisioning mechanisms.

1.2.4  Agent Communication Poisoning

In complex enterprise deployments, multiple agents will need to collaborate to accomplish sophisticated tasks. This inter-agent communication introduces vulnerabilities to poisoning attacks, where malicious actors inject false information into agent dialogues. Such attacks can compromise collective decision-making and disrupt coordinated workflows.

Consider a scenario where multiple agents collaborate on investment portfolio management. An attacker who successfully poisons communication between a market analysis agent and a trading execution agent could manipulate investment decisions, potentially causing significant financial losses before human oversight detects the anomaly.

1.2.5  Resource Overload and Operational Risks

The autonomous nature of agentic AI also introduces unique operational risks. Agents can potentially consume excessive computational resources, overwhelm APIs with requests, or generate costs through uncontrolled tool usage. These resource overload scenarios might result from malicious exploitation or simply from agents pursuing their objectives too aggressively.

1.3  Building Comprehensive Defence Strategies

Securing agentic AI deployments requires a fundamentally different approach from traditional application security. Organisations must implement layered defences that address both the inherited vulnerabilities from underlying language models and the unique risks introduced by autonomous operation.

1.3.1  Architectural Safeguards

At its foundation, agentic AI security requires a thoughtful, deliberate “Secure by Design” approach from concept to production. Implementing strict sandboxing for code execution environments, and designing an architecture that enforces least privilege access principles for tool integration and clear boundaries between agent capabilities and sensitive systems are essential first steps.

1.3.2  Runtime Security and Monitoring

Given the dynamic nature of agentic AI, static security measures prove insufficient. Continuous runtime monitoring becomes essential to detect anomalous behaviour patterns, unexpected tool usage, or goal deviation. Advanced solutions must understand the context of agent actions, distinguishing between legitimate autonomous decisions and potential security incidents.

Agentic-AI-ready security solutions will be a must. For example, Palo Alto Networks’ Prisma AI Runtime Security (AIRS) platform provides comprehensive runtime protection specifically designed for the emerging challenges posed by agentic systems. The platform offers real-time monitoring and protection against agentic threats, including tool misuse detection, identity impersonation prevention, and memory manipulation safeguards.

By analysing both network traffic and application behaviour, Prisma AIRS’ AI Agent Security capabilities provide deep visibility into agent behaviours and interactions, identifying and blocking sophisticated attacks before they compromise agent operations. The platform can detect when agents attempt to access unauthorised resources, execute suspicious code patterns, or deviate from expected operational parameters. This runtime intelligence enables security teams to respond to threats at machine speed, matching the pace of autonomous agent operations.

1.3.3  AI Security Posture Management

As organisations deploy multiple agents across various business functions, maintaining visibility and control becomes increasingly complex. Prisma Cloud AI SPM addresses this challenge by providing comprehensive ecosystem visibility, identifying overprivileged agents, and continuously assessing security posture across the entire AI infrastructure.

The platform helps organisations understand which agents have access to sensitive data, identify potential attack paths through agent interactions, and ensure compliance with security policies. This type of holistic, real-time view will prove essential for managing the expanding attack surface created by widespread agent adoption.

1.3.4  Proactive Security Testing

Traditional penetration testing approaches fall short when evaluating agentic AI systems. These autonomous systems require specialised red teaming that understands both AI vulnerabilities and the unique attack vectors introduced by tool integration and goal-oriented behaviour.

Prisma AIRS includes automated AI Red Teaming capabilities that continuously probe AI deployments for weaknesses. Unlike static testing tools, this agent-based approach learns and adapts like real attackers, uncovering subtle vulnerabilities that might otherwise remain hidden. The system tests for prompt injection susceptibility, tool misuse potential, and goal manipulation vulnerabilities, providing actionable insights for hardening agent defences.

1.4  Implementation Considerations

Successfully securing agentic AI requires more than deploying security tools. Organisations must also adapt their security programmes to address the unique challenges posed by these systems.

1.4.1  Governance and Policy Frameworks

Establish clear governance structures that define acceptable agent behaviours, tool access policies, and escalation procedures. Create frameworks for agent lifecycle management, including secure development practices, deployment authorisation, and decommissioning procedures.

1.4.2  Incident Response Evolution

Traditional incident response playbooks require significant adaptation for agentic AI scenarios. Security teams must prepare for incidents that unfold at machine speed, potentially involving multiple interconnected agents. Develop automated response capabilities that can match the pace of agent operations whilst maintaining human oversight for critical decisions.

1.4.3  Skills and Training

The intersection of AI and security demands new competencies within security teams. Invest in training that covers both AI fundamentals and the specific security challenges of autonomous systems. Make security a “first class citizen” in the innovation process. Build partnerships between security teams and AI developers to ensure security considerations are embedded throughout the agent development lifecycle.

1.5  The Competitive Imperative

This isn’t merely a risk management exercise. Over time, as AI capabilities continue to improve, the share of non-human intelligence within the network will continue to increase. That machine intelligence share will rapidly become the single most important competitive differentiator. Companies with more will be at a serious advantage; companies with less at a serious disadvantage.

Competing effectively also means building the right vendor partnerships. In every technology decision you make, you need to be “skating towards the puck,” which means your vendors better be too. Consider this for example: within the next 2-3 years, as customers themselves start to have agents of their own, businesses will cease to function unless their own agentic systems are able to securely interface with these external agents. If you are embedding a vendor into your architecture today, you need to be confident that they will be innovating in a way that supports you through this level of change.

1.6  Looking Ahead

As agentic AI continues to evolve, the security landscape will undoubtedly grow more complex. The transition from generative AI to agentic AI represents more than a technological upgrade; it fundamentally alters the enterprise risk landscape. As these systems become increasingly central to business operations, the importance of getting security right from the start cannot be overstated. The time to act is now, before autonomous agents become so deeply embedded in enterprise operations that retrofitting security becomes exponentially more difficult and costly.

We are entering an era where the only constant is change. You might argue, “that’s business as usual for us technologists”. But it’s the pace of change that feels different. The organisations that can innovate fastest whilst maintaining robust security will build insurmountable advantages over those that either move too slowly or compromise on security in order to deploy quickly.

The journey towards secure agentic AI deployment is complex, but with proper planning and appropriate tools, enterprises can, and will, navigate this new frontier. Just as we have prior transformations.

 

 

SASE as a Journey. Where to Begin?

Posted on by

Over the past decade, the IT world has changed dramatically. In the latter part of the twenty-tens digital transformation projects, cloud strategies, automation and the adoption of SaaS applications were on the agenda for many businesses. Most workforces went to a place of work daily, and IT teams had control over the location of their users and endpoints, so they focused on centralising their security.

Then the global pandemic that was Covid hit in 2020, and the focus shifted onto how businesses could operate when suddenly their workforce became remote overnight. Most businesses had an I.T. Security architecture based on a central location that protected people in the office and not outside of it. With employees working from many different locations and using different devices to access apps and data, the attack surface increased significantly, and it opened business operations up to more threats that they didn’t previously have to protect themselves against.

Fast forward to the post-pandemic world, for many businesses, hybrid working has become the normal, meaning workforces remain widely distributed, and the security perimeter is no longer in one specific location.  It is everywhere.

Most companies have however not changed the infrastructure to secure the traffic passing across their network and still route all cloud traffic through their data centre to be able to leverage existing traditional perimeter protections.

But this ‘traditional’ network security architecture was designed for yesterday’s problems.  They offer inefficient and insecure access, inelastic scalability and deployment complexity, as well as resulting in poor user experience.

As such, the old architectural model of backhauling traffic to data centres no longer makes sense as more users and apps are now outside the enterprise.

So how can businesses ensure that they embrace digital transformation, stay in control of their users and the applications and data sources that their employees are accessing, and above all, still deliver a good user experience securely?

The solution is to adopt the Gartner coined phrase Secure Access Service Edge or SASE, as a holistic approach to networking and security.

So what exactly is SASE? 

SASE is seen as a networking and security architecture that is made up of SD-WAN and SSE or Secure Service Edge, consolidating networking and security as a service into a cloud-delivered service at the network edge.


Secure Service Edge (SSE)

SSE or Secure Service Edge is a collection of cloud-centric security capabilities that facilitates safe access to websites, software-as-a-service (SaaS) applications and private applications*.  In simple terms, this means that if adopted, a business will have a comprehensive set of cyber security technologies to secure remote access to applications, data, tools and other corporate resources and monitor and track behaviour once users access the network. Where a workforce is hybrid, or remote securing mobile users and the data and apps they access is vital.

Broken down, SSE is made up of, but not limited to,  Zero Trust Network Access (ZTNA), Cloud Secure Web Gateway (SWG), Cloud Access Security Broker (CASB) and Firewall-as-a-Service (FWaaS).

Let’s explore these in more detail:

Zero Trust Network Access (ZTNA)

The application of Zero Trust Network Access (ZTNA) removes the implicit trust that was automatically applied in traditional networks where users had full access to everything. The default for ZTNA is deny, providing access only to services once the user has been explicitly granted.

ZTNA is essentially a security framework and access method that works on a principle of never trust and always verify.

The layers of inspection and enforcement include:

  • Centralised Visibility and Control: Visibility of your network traffic including the location of data storage and who is able to access the data.
  • Identity-Based Authentication: Applying precise least-privileged access users with continuous monitoring of user behaviours for malicious activity and signs of credential theft, malware and data loss.
  • Uniform Security Policies: Enforcing security policies on all corporate-owned and third-party applications regardless of where the data resides.
  • Granular, Role-Based Access: Granting user access only to the data required for a job role and restrict access based on the type of device and location used to connect.
  • Post-Connect Threat Monitoring: Ensuring that ZTNA capabilities are still working and able to detect if an attacker is still able to access the businesses network and detect an attacker based on their network activity.

In summary, ZTNA essentially redirects the user traffic through a security broker, which then verifies the identity of the device or user. It checks on security, compliance, and posture. It only then allows that device or a user to a network or a specific corporate resource and offers a very granular visibility into user’s activities.

Secure Web Gateway (SWG)

The Secure Web Gateway (SWG) component of SASE allows remote users to connect to the Internet through a cloud-based proxy solution, which essentially sits between the user and the Internet and offers similar security functionality as the next generation firewalls did in the traditional work from the offices model.

Instead of connecting directly to a website, a user accesses the Secure Web Gateway, which is then responsible for connecting the user to the desired website and performing functions such as URL filtering, web visibility, malicious content inspection, web access controls and other security measures.

Because the Secure Web Gateway is based in the cloud, it also means that the user traffic doesn’t have to trombone through corporate firewalls which improves the latency and end user experience without compromising levels of Cyber Security protection.

Cloud Access Security Broker (CASB)

Cloud Access Security Broker (CASB) solutions help businesses discover where their data is across multiple software-as-a-service (SaaS) applications. It can detect when data is moving across cloud environments, on-prem data centres or being accessed by mobile workers.

Security, governance and compliance are enforced by policies which allow only authorised users to access and consume cloud resources while enabling businesses to effectively and consistently protect their data across multiple locations.

Firewall-as-a-Service (FWaaS)

Firewall-as-a-service (FWaaS) enables firewalls to be delivered as part of a business’s cloud infrastructure to protect cloud-based data and applications. FWaaS capabilities (as part of a SSE solution) enable the aggregation of traffic from multiple sources – whether from on-site data centres, branch offices, mobile users or cloud infrastructure. It also provides consistent application and security enforcement of policies across all locations and users while giving complete network visibility and control without deploying physical appliances.


Summarising Secure Service Edge

In summary, by deploying a comprehensive SSE solution, businesses can allow their employees secure, remote access to applications, data, tools and other corporate resources whilst monitoring and tracking behaviour once users access the network. As the hybrid workforce expands, securing those remote and mobile users, and the data and apps they access remain protected.

It allows companies to automatically manage dispersed remote and hybrid users by connecting them to nearby cloud gateways instead of backhauling traffic to corporate data centres.

It also provides consistent secure access to all applications while maintaining full visibility and inspection of traffic across all ports and protocols.

SD-WAN

SD-WAN as part of a SASE solution delivers networking functionality, directing and optimising traffic across a businesses’ network.

SD-WAN (compared to traditional MPLS type networks) allows companies to centrally manage their WAN infrastructure, typically from a central application hosted in the cloud. It also allows businesses to dynamically route network traffic based on the requirements of their applications.

Unlike traditional WANs that depend on manual rule creation for routers, SD-WAN is application-centric and virtualised, swiftly adapting to changes and offering better security. It’s crucial to accessing cloud applications securely. Typically it can be managed from a centralised control plane and minimises individual device management. Furthermore, SD-WAN supports diverse connection types, like MPLS and broadband, bolstering bandwidth and performance while simplifying administration.

By not backhauling traffic to a central data centre, latency is reduced, and performance improves, leading to better user satisfaction, all while maintaining strong security.

When coupled with SSE technology the complete SASE solution delivers networking and security as a service in a single cloud-delivered service at the network edge.

The Key to Deploying SASE is Treating it as a Journey.

In our experience very few businesses will wake up one day and say ‘today I’m going to look at how I can implement a SASE solution into our organisation.’ It is more likely that businesses will take small steps and go along a journey to achieving a full SASE architecture.

For most businesses, the journey can start with a unique use case. The need to replace legacy systems or networks, a branch transformation project to improve user experience, meet industry compliance requirements for protecting data or securing mission critical web of SaaS based applications.

It is likely that businesses are already using a number of different Cyber Security products, and the challenge is whether to continue using disparate Cyber Security products and have a multi-vendor SASE solution or whether to opt for a platform approach using a single vendor.

To consolidate and simplify are the guiding principles of SASE so the natural answer would be to go for a single vendor SASE solution which converges network and security capabilities into a single cloud-delivered service. By consolidating different point products, appliances can be eliminated, and consistent policy enforcement can be easily achieved. This will also allow one data source and a single management console.

That is not to say of course a multi-vendor SASE solution won’t deliver similar functionality to a single vendor SASE, but the set up will require greater integration to ensure solutions work together, to enable log collection and correlation for management. Effectively it will increase complexity and limit the agility and flexibility achieved if opting for a single vendor.

* According to Gartner

Co-op Live Arena: award-winning network and Wi-Fi

Posted on by

Ideal was recognised at the Cisco Partner Summit 2024 EMEA UK & Ireland Theatre Awards in Los Angeles this week, winning Smart Buildings / Venues Partner of the Year for our CNS and Wi-Fi deployment at Co-op Live in Manchester.

This was a massively complex CNS design and build, using Cisco High-density Wi-Fi Catalyst 9800 architecture and Catalyst 9K Access Points, to:

  • Bring together around 40 different building systems in one intelligent control system, ranging from lighting and sound to turnstiles and access control
  • Provide reliable high-density Wi-Fi for up to 23,500 concurrent users, using real-time and multimedia applications
  • Deliver a consistent end-user experience throughout 40+ bars, restaurants and concessions across four floors
  • Support the Co-op Live application, delivering a paperless venue.

Take a look at the Co-op Live case study for more details about how CNS technology is supporting this phenomenal venue.

Enabling buildings to become intelligent, connected and sustainable

Posted on by

Smart Buildings has become a widely used term in today’s world. Many modern buildings and retrofit projects are delivering smart building technology as landlords and tenants seek to achieve key business objectives such as talent management and delivering an inspirational user experience to employees, achieving sustainability goals where the overall building performance can be improved, and delivering cost and operating efficiencies.

However, the adoption of smart building technologies such as Operational IT and Internet of Things technologies brings inherent challenges in planning, designing, delivering, and operating a truly smart building. If these systems are not planned and integrated effectively early in the project it can act as a barrier to achieving smart ambitions, and be disruptive, expensive, and time consuming to retrospectively address.

By effectively implementing a secure, scalable, flexible, and futureproofed network infrastructure or Converged Network System (CNS), the art of the possible can be unlocked, and the benefits of creating smart buildings can be fully realised.

Why choose a Converged Network System (CNS)

The Converged Network System (CNS) is the backbone and technological foundation that allows the integration of the IT (Information Technology), OT (Operational Technology) and the IOT (Internet of Things) devices.  The CNS is essential to supporting buildings becoming increasingly smarter as they harness technology to create sustainable, comfortable, and efficient spaces for occupants and the environment.

‘The Art of the Possible’ driven by Early Engagement

The CNS should be amongst the first considerations when planning the technological functionality of a building, to ensure that all the ambitions for the building can be achieved.  The clearer the vision is for a building and its outputs; the more network capabilities can be maximised at the early design stage.

  • Holistic Planning: Starting early allows architects, network engineers, and stakeholders to collaborate from the outset. This ensures that the network design aligns with the overall building architecture, infrastructure, and purpose.
  • Cost Efficiency: By addressing network requirements during the initial planning stages, value engineering opportunities can be investigated, and unnecessary rework and retrofitting can be avoided. This reduces costs associated with modifications later in the construction process.
  • Scalability and Futureproofing: Early engagement allows for scalability planning. Designing a network that accommodates future growth, additional services, and emerging technologies ensuring long-term viability.
  • Security and Compliance: Integrating cyber security measures from the beginning enhances network security. Compliance with regulations (such as data privacy laws) can also be addressed proactively.
  • Risk Mitigation: Identifying potential risks (e.g., network bottlenecks, compatibility issues) early allows for risk mitigation strategies. This minimises disruptions during building occupancy.
  • Vendor Coordination: Engaging service partners and vendors early facilitates communication regarding equipment specifications, installation requirements, and compatibility. It streamlines procurement and deployment processes.


Integrating Building Systems

By maximising the opportunity to enable data gathering and operational efficiency, implementing secure visibility and communication between buildings systems. Securely integrating each function into the infrastructure whilst considering the individual requirements of the building systems both physically and logically is where the convergence of IT teams and Buildings or Facilities teams takes place.

Through the CNS, it is possible to integrate numerous buildings system to operate seamlessly together, allowing gathering and normalising system data into a single pool, and enabling analysis and automation across the building’s systems

Designed for Sustainability

By creating a single data pool in a building through design and technology, sustainable practices can be effectively implemented, leading to greater energy efficiency and reduced carbon emissions.

About Ideal

Ideal are one of the leading Secure Smart Building Network and Wireless services provider for Enterprise customers in the UK and beyond. Working with new and existing buildings, technology is used to enable better-connected, more energy efficient, thriving workplaces from large commercial buildings, to multi use master plans and arenas, our technology enables better-connected buildings and is more sustainable.

Ideal, design, build, deliver and manage the Converged Network Systems deployed in some of the UK’s smartest buildings and estates. By supporting the whole construction life cycle, including retrofit and managed services, Ideal deliver against the plans and requirements of the various stakeholders’ pre and post Practical Completion, supporting the entire building lifecycle.

With over 100 customers across all industries, Ideal deliver brilliant business outcomes through innovative, secure technologies and services. Our work is distinguished by excellence in communication and delivery, and by the width and depth of our in-house expertise.

 

Smart Managed Services

Posted on by

Ideal has a long established track record in proving top class Managed Network and Cybersecurity Services. We have designed, built and now manage networks and services for some of the most prestigious projects in the UK. The combination of our people’s experience, expertise and willingness to make sure our support meets the specific needs of your building means that we effectively become an extension of the building management team.

Partnering for ongoing success

Our range of Managed and Smart Services means that we can support building management teams by providing access to deep expertise and wide experience. The scale and complexity of Smart Building projects means that we are often asked to maintain a presence on site, and this is something that we have seen add significant value for customers. Importantly, we can support Building Management Teams where we have not provided the CNS, or even where there is no CNS in place.

Smart Managed Network

Developers and Building Managers face multiple challenges. Smart buildings need to deliver outstanding user experiences to attract people to work there, whilst also delivering against challenging energy and sustainability goals. A well-run CNS minimises the issues caused by data silos across the myriad of Information Technology (IT), Operational Technology (OT) and Internet of Things (IoT) devices and systems that underpin a smart building, campus or environment.

Ideal provides expertise and resource to ensure the network continues to provide high availability and reliability, and that it evolves in step with the needs of users.

 

Smart Managed IP Service

Smart buildings rely upon thousands of assets and devices connected to the converged network to be available and operate correctly. Our Smart Managed IP Service provides monitoring and management of devices connected via the Converged Network System (CNS) to the Building Management System (BMS). By extending monitoring beyond the CNS, clients achieve visibility of the building’s IP devices and the associated CNS connections, enabling rapid identification of issues. It also provides an enhanced managed service wrapper which supports and notifies and, where appropriate, provides centralised incident management across all parties e.g., Ideal, building management teams and control system providers, facilitating investigation and remediation activities. The service is under-pinned utilising ITIL best practices, providing deliverables such as:

  • Configuration Management Database (CMDB)
  • Incident Management, root cause analysis, and Incident reporting
  • Incident trend analysis
  • Problem Management
  • Change Management
  • Impact analysis
  • Service Reporting
  • Continual Service Improvement Planning


Smart Managed Cybersecurity

Smart buildings require the thousands of assets and devices connected to the CNS to be available and operate correctly. However, the very fact that these IT, OT and IoT devices and assets are connected creates a significant ‘attack surface’ for cyber attackers. Cybercriminals are increasingly aware of this and are increasingly targeting OT and IoT infrastructures with emerging cyber threats.

Our Managed Smart Managed Cybersecurity service secures the combined IT and OT estate as a Managed Service, delivering assurance via an industry leading capability to minimise the risk of a cyber security breach.

The service is powered by our 24x7x365 global SOC, offering complete, around-the-clock coverage. The SOC leverages onthe industry-leading capabilities of the Microsoft Security Stack which, when combined with our dedicated team of cyber security experts, offers unbeatable protection with service has one goal in mind: prevent operational disruptions caused by cyber-attacks on these sensitive networks.

Testimonials

What do our client’s say?

  • “ …we wouldn’t be able to do our job without the team. It’s like having an extra set of hands at the desk at all times.”

    Author thumbnail James Ward Technical Services Director, Battersea Power Station
    View case study

  • “They understand our business, they understand the business of our occupiers, with a willingness to deliver what is a world class service.”

    Author thumbnail 22 Bishopsgate 22 Bishopsgate Team
    View case study

Project management – the special sauce for smooth network implementation

Posted on by

We work with some mighty complex projects in smart buildings and enterprise networks. What makes the difference between success and failure is often the unsung heroes in the middle – our project management team. Kevin Green, Head of Projects at Ideal, says that as a company, Ideal has learnt a great deal about what good project management looks like from the construction industry and now applies that discipline for enterprise networks too.

 

Kevin explains: “When we got involved with the converged network for the first phase of Battersea Power Station, it was the biggest brick building in Europe and possibly the biggest building site in the country. Imagine the number of contractors and trades involved. Each working to their own deadlines, with limited access to site.

“…there’s a real danger that someone will come and plonk a massive aircon unit in front of the AP…”

“Everything is interconnected, like a giant eco-system. We need power to install the network. Certain fixings need to be finished before we can mount Access Points (AP’s). But if you do it too soon, there’s a real danger that someone will come and plonk a massive aircon unit in front of the AP; or reconfigure an internal wall, compromising Wi-Fi for ever more.”

So, what’s the secret to a smooth project?

Kevin says it all comes down to communication. “For each contractor that might have an impact on our work, we have to quickly understand what’s important to them. And help them to understand what matters to us. We have to be patient and a hundred percent clear in our communication.”

“Forward planning is critical, but being agile on site is equally important. At Battersea, I would regularly clock up 25,000 steps a day, trudging up and down nine immense floors to check details and liaise with other people. In the end, those are literally the hard miles you need to put in to make it all happen.”

Battersea was a complex working environment

Kevin says that since Phase 1 at Battersea, the company has been involved some of the most sophisticated building developments and network refurbishments in the UK, including Phase 2 and 3 at Battersea and cutting-edge smart buildings like 22 Bishopsgate and 150 Holborn.

Getting involved early in the process makes a difference

One of the latest projects, Co-op Live Arena which won the Cisco Smart Building/Venue Award 2024 for its CNS and Wi-Fi deployment, has just come into operation in the UK after a 3-year design and build. This required Ideal to bring together as many as 40 building services in a single converged network. Many contractors struggled to deliver on this complex project, but Ideal signed off on Practical Completion ahead of schedule.

Kevin says: “What made a difference there was that we were invited in relatively early in the design phase. That meant that we were closer to the architects and consultants and were able to make sure our network design wasn’t compromised. We then fully consulted with electrical and mechanical contractors and speciality contractors for sound, PA, lighting, aircon, security and access to make sure everything could connect, communicate and share data.”

“It’s about more than IT. We were there every step of the way – from when the stair cores were rising from the ground, moving the cherry-pickers into the bowl for the Wi-Fi, turning the internet on for the first time and welcoming the MTV European Music Awards to the arena.”

Being true to the vision of each project

 

With highly complex projects, Kevin says, it’s easy to get sucked in by solving problems on the ground, but the checking back with the bigger picture is vital.

“What’s really important is the vision for each project. For one of our global manufacturing clients, smooth automation in giant spaces is king. For 150 Holborn, creating an unparalleled work environment which also serves as a ‘Living Lab’ where they can learn from building data is key. For Co-op Live Arena, providing a safe, secure and iconic experience for up to 23,000 screaming fans live streaming a concert, whilst supporting 30 bars and restaurants across five floors is the focus. Keep that front and centre and everything else follows.”

Looking back at 2024 – Top 5 subject areas

Posted on by

Ideal Founder and CEO, Moto Shakoori, became a regular user of LinkedIn in 2024, which has enabled him to review the year based on data from his posts. Here are Mo’s top five subject areas of 2024:

 

1. Co-op Live

Co-op Live, on Practical Completion, back in April. Co-op Live was super newsworthy at the time, so perhaps it’s no surprise that my post about reaching PC on time was number one in terms of impressions. Winning the Cisco Smart Buildings / Venues Partner of the Year Award for our Co-op Live CNS network in October also came in at number three for impressions and number one for reactions, comments and reposts. Picking up the Award in LA was a definite highlight for me.

2. 150 Holborn

The summary of our 150 Holborn, Smart Building Workshop in June was number two in terms of impressions. I really enjoyed those sessions, where Ideal as the CNS design, installation and support specialist shared a platform with building owner and tenant Sidara and BMS giant Schneider to discuss what goes into a creating a successful smart building.

3. 15 Years, 15 Lessons

The first of my ’15 Years, 15 Lessons’ posts is right up there. This was an honest reflection on the 15 years since I founded Ideal and my not-so-conventional journey to where we are today, which is our most successful year ever. The first three posts in the 15-post series got a really high following before impressions for the series fell away, perhaps suggesting that there’s a limit to how much people want to hear from me!

4. Twickenham Stadium

Our case study on Twickenham Stadium squeezes into the top five. This coincided with the announcement of the controversial name change to the ‘Allianz Stadium’ in August, proving that topicality seems to win out.

5. Celebrating 10 years with codebar

Celebrating 10 years of supporting codebar, the charity that runs free programming workshops for minority groups in tech, comes in really high, showing the professional community spirit we all share is alive and well.

Honourable mentions must also go to:

  • An award for our Managed Services at 22 Bishopsgate.
  • Our volunteering day at the Tarner Community Project, where lots of the Ideal team got down and dirty with hedge trimmers, spades and forks to tidy communal gardens.
  • My tongue-in-cheek post about NOT receiving any Managed Service support tickets from HRH King Charles on his recent visit to Battersea.

Here’s looking forward to another eventful year in 2025.

UK Presence Makes the Managed Services Difference

Posted on by

Tracy Stairs, Service Delivery Manager at Ideal, has 15 years of expertise in Customer Support and Managed Services for IT clients. She says Ideal’s UK-based 24/7/365 offering makes all the difference for the customer experience (CX).

Ideal’s Managed Services provide proactive and reactive support to help protect customers’ Networks, Connectivity, Wi-Fi, Cyber Security, Data Centres and Cloud environments.

From supporting IP telephony for IKEA stores in the UK and Ireland, to critical patient services at Horder Healthcare and Network and Wi-Fi systems at Battersea Power Station development, one of the largest built environments in Europe – the Ideal team support a wide range of organisations in the UK and globally.

 

Meet Tracy – the voice of the customer

Tracy Stairs, Service Delivery Manager, has an important role at the heart of Managed Services, ensuring that the customer’s technology runs smoothly and co-ordinating the best possible response when an incident occurs.

“I am the voice of the customer within Ideal,” Tracy says. “I work on behalf of the customer with our technical teams, and I work with the customers’ own people on-site to make sure they know exactly what is going on and are taking any necessary action.”

It’s primarily a preventative role

Tracy says that her role is more about prevention than emergency. “When people hear that I work in Managed Services, they imagine TV scenarios with red lights flashing on screens, and people rushing around to solve critical failures that threaten life itself.

“Whilst that does occasionally occur, over ninety percent of my job is focused on prevention. I talk to customers to understand what updates they might be planning, so that we can anticipate possible risks or clashes. I monitor patches and software updates to ensure they have been actioned correctly, in a timely fashion. I alert customers to cyberattacks, threats or vulnerabilities that have occurred in other companies and may be relevant to them. And I prepare reports on technical performance, so we can collaborate on improvements to the service.”


What major incidents do the team face?

Tracy says that Managed Services takes a similar approach to a hospital A&E department. The team triage incidents based on severity, in this case the impact or potential threat to each enterprise. “Many incidents are just things not running as smoothy as we might like or upgrades that can be actioned over time. Critical incidents – ‘P1s’ as we call them – are when services are down, or security is threatened.

“More often than not, P1s are caused by physical on-site activity. A power outage that takes a firewall down, which automatically shuts down access for every device. Contractors drilling through a cable. An internal software change or upgrade that has unexpected consequences elsewhere on the network. An employee who inadvertently opens a malware attachment.

“Whatever it is, day or night, we set up a response team with the relevant expertise. I create a communications hub with the customer and include any third-party providers who may be relevant to the incident or the technology. I then report every 15 minutes, until we resolve the incident.

“I must say, when we get a P1 I get that nervous feeling in my stomach, but at the same time, it’s a really exciting part of the job. We all get an incredible feeling of satisfaction once everything is restored.”

What’s the most important ingredient in Ideal’s Managed Services?

Tracy immediately identifies the team. Not just the individuals, but how they work together.

“We have fantastic people with a huge range of skillsets, but what sets us apart is the attitude. First-, second- and third-line engineers will drop everything and work together to help solve problems, whist keeping our customers updated with the situation.

“I’ve worked for IT providers with outsourced Managed Service support abroad and however tight the processes, you simply don’t get that team cohesion. That’s the part that can quickly solve a crisis, smoothly upgrade a tech platform or just deal with everyday incidents – super-effectively and super-calmly.”

Enterprise Wi-Fi: Beyond the Myths – A Leadership Guide to Delivering Flawless Wi-Fi

Posted on by

In today’s hybrid workplace, many long-held assumptions about Wi-Fi implementation are outdated or just plain wrong.

 

 


Myth 1 : More Is Always Better

It’s tempting to deploy additional access points (APs) to boost Wi-Fi performance, but this is one of wireless networking’s most persistent misconceptions. While strategic AP placement can enhance connectivity, indiscriminate expansion of your wireless infrastructure often creates more problems than it solves.

In fact, adding APs without proper planning can degrade network performance through increased radio interference, channel congestion, and coverage conflicts. For IT leaders, understanding this counterintuitive reality is crucial – optimal wireless coverage demands thoughtful design rather than simply increasing AP density. 

 


Myth 2: All devices see the network equally 

The common belief that all devices share an identical Wi-Fi experience reflects a fundamental misunderstanding of wireless networking. While network administrators might expect uniform performance across all connected devices, the reality is far more nuanced and complex.

Each wireless client experiences your network differently, influenced by a multitude of factors – from device-specific hardware capabilities and environmental conditions to network architecture and core Wi-Fi principles. For IT leaders, recognizing this inherent diversity is crucial for delivering reliable connectivity across your organization’s entire device ecosystem. 

 


Myth 3: Default Configuration is fine 

The widespread acceptance of out-of-the-box wireless settings represents one of the most dangerous misconceptions in network management. While default configurations offer a starting point, treating them as optimal can severely compromise your network’s performance, security, and efficiency.

These preset configurations are designed for generalized scenarios, not the unique demands of your enterprise environment. For IT leaders, understanding the limitations of default settings is critical – your network’s specific usage patterns, security requirements, and performance demands require thoughtful customization.

 


Myth 4: Hybrid working means less Wi-Fi load 

The assumption that hybrid work reduces wireless network load represents a critical miscalculation in post-pandemic IT planning. While fewer employees may be present in the office, the reality is that hybrid work models often generate increased demands on enterprise Wi-Fi and security infrastructure.

This counterintuitive truth stems from changing work patterns, increased device density per user, and the surge in bandwidth-intensive collaboration tools. For IT leaders, understanding this shifted landscape is essential – hybrid environments require more robust wireless capabilities, not less, to support new ways of working.

 


Myth 5: It’s fine to just put a new AP where the last one was 

The temptation to simply replace access points in their existing locations represents a deceptively suboptimal approach to network upgrades. While this strategy might seem logical and efficient, it overlooks the fundamental evolution of Wi-Fi technology, workplace dynamics, and connectivity demands.

Given the recent transformation of the workplace, modern wireless environments bear little resemblance to their predecessors, with changes in everything from device density to building infrastructure affecting optimal AP placement. For IT leaders, understanding why historical AP locations may no longer serve current needs is crucial for maintaining network performance and user satisfaction.

 


Myth 6: Video conferencing only happens in conference rooms 

The notion that video collaboration remains confined to traditional meeting spaces reflects an outdated understanding of modern workplace dynamics. Today’s reality shows video conferencing happening everywhere – from desk-side conversations and home offices to impromptu huddles and mobile devices.

This shift in collaboration patterns has profound implications for network design and capacity planning. For IT leaders, recognizing video conferencing as a ubiquitous activity rather than a location-specific one is essential for delivering consistent, high-quality connectivity across your entire workspace. To borrow a turn of phrase from one of our partners, Palo Networks, work is no longer a place we go to but rather an activity we perform. 

 


Myth 7: Speed tests reflect user-experience 

The widespread belief that speed tests accurately represent network performance is providing false signals to IT leaders and infrastructure architects. While these tests offer snapshot metrics of bandwidth capacity, they fail to capture the complex dynamics that shape real user satisfaction.

What truly determines network quality extends far beyond raw speeds – from application-specific requirements and device capabilities to latency patterns and network congestion. For IT leaders, understanding the disconnect between speed test results and actual user experience is crucial for delivering reliable enterprise connectivity.

Older posts
Newer posts