Updated: September 2025 • NZ retail SMB context • Disclosure included
From shared Wi‑Fi to safe POS & guest isolation in 5 days
Sector: Retail
Footprint: 2 stores • 18 staff
Timeframe: 5‑day micro‑pilot
Engagement: Design‑partner
100%
POS & guest Wi‑Fi isolated at both stores
20 min
Back‑office restore test
DMARC “reject”
Spoofing risk reduced
Disclosure: This is a design‑partner micro‑pilot in a small organisation context. Outcomes are indicative and vary by environment.
Challenge
Small team, legacy APs and a single flat network behind the router. Email spoofing targeted the store manager and patching was inconsistent across laptops.
Approach
Plan (5–8 days):
- Day 1: Scope & POS/guest network map
- Day 2–3: VLANs + ACLs, captive portal, admin MFA
- Day 4: DMARC to “reject”, patch/EDR push
- Day 5: Restore test & store‑manager checklist
Scope:
- POS • guest Wi‑Fi • back‑office devices
- IdP/MFA • email auth • EDR/MDM • backup
- Exclusions: POS vendor firmware changes
Outcomes
- Segmentation: POS & guest isolated at both stores; portal live
- Identity: Admin MFA enforced
- Email: SPF/DKIM aligned; DMARC at “reject”
- Resilience: Back‑office restore in 20 minutes
Client Quote
“Isolation made the Wi‑Fi more stable at check‑out — and the manager playbook keeps things consistent.”
— Owner‑Operator, 2‑store retailer (anonymised)
👉 Interested in a 5–8 day pilot tailored for small organisations?
We’ll ship quick wins and a 90‑day plan, in exchange for an anonymised case study.
Book a Consultation