The work we've built a practice around, and the platforms behind it.
We've run these playbooks many times, for upgrades, migrations, AI and hard-to-find skills, and each one is tied to its platforms. Case studies leave client names out.
Nine engagements we run again and again.
We've run each of these enough to know its shape and its risks, and you keep a set of documents at the end. The links go to the service or platform page with the detail.
IdentityIQ 8.x → 9.0 upgrade
Inventory, GA-by-GA path to 8.5, pre-check, Jakarta fixes, rehearsal on production data, cut-over.
CyberArk self-hosted to SaaS decision
Support dates and feature gaps first. Then migration waves, and a cut-over plan that goes safe by safe.
Salesforce and Dynamics release readiness
Release notes triaged against your org, regression pack in a preview sandbox, go/no-go list.
Snowflake and Databricks governance
Roles come from your identity provider. We add masking and row policies, track lineage, and set up an access review that actually works.
Forward deployed AI sprint
One engineer goes in with one business team and ships a scoped agent into a workflow the team actually uses, with evals and access controls.
Mainframe API wrap
Document the COBOL and CICS paths that matter, expose them through APIs, and move the rest in slices.
Guidewire and Duck Creek cloud moves
Inventory every customisation, work out the upgrade path, retest the integrations, then rehearse the data migration before doing it for real.
OT security baseline
We build the asset inventory from Claroty, Nozomi or Dragos, draw up zones and conduits, and record vendors whenever they connect remotely.
Hard-to-find skills, by a date
Engineers for Murex, Calypso, CC&B, IS-U, RACF or Epic, screened on the real platform. Onsite, nearshore or offshore.
Where each practice works.
Work we've delivered, told without client names.
SailPoint IdentityIQ to Identity Security Cloud
Leaving IdentityIQ for SailPoint Identity Security Cloud (formerly IdentityNow) with custom logic, certifications and audit history carried across.
read the case studyCyberArk PAM Self-Hosted to Privilege Cloud (Idira PAM SaaS)
We move CyberArk PAM Self-Hosted vaults to Privilege Cloud, now sold as Idira Privileged Access Management. Rotation and sessions keep working.
read the case studyData center exit to AWS or Azure
Leaving a colocation or owned data center for AWS or Azure in planned waves, with dependencies mapped, licences checked and every server given an owner.
read the case studyAI pilot to production with forward deployed engineers
Taking an AI pilot into production with forward deployed engineers who work with the business team, build evals, connect real systems and hand over cleanly.
read the case studySAP ECC to S/4HANA before 2027
Getting from SAP ECC 6.0 to S/4HANA ahead of the 2027 end of mainstream maintenance, by conversion, new build or selective data transition.
read the case studyGuidewire InsuranceSuite self-managed to Guidewire Cloud
Moving self-managed PolicyCenter, BillingCenter and ClaimCenter to Guidewire Cloud without carrying every Gosu customization and integration along.
read the case studyWhere the work happens, and what we've written about it.
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it