Continuous Security Monitoring Across a Multi-Site Manufacturing Network
The Challenge
Security posture across a multi-site manufacturing network — domestic and international operations, ERP-adjacent systems, and a mix of legacy and modern infrastructure — was assessed reactively. WAN exposure, certificate expiry, domain renewal, and service uptime were checked manually or not at all until something broke. There was no single place to answer 'are we exposed right now' with evidence instead of a guess, and no continuous record to show auditors or leadership.
Our Solution
Designed and deployed a security operations dashboard that runs continuous, automated checks against the actual perimeter rather than a point-in-time audit. It queries the firewall API directly for WAN port exposure and filtering state, checks SMB signing and internal host hardening, monitors public-facing service health with SSL certificate expiry alerts, and tracks domain expiry to prevent surprise lapses. Alerting runs on a 15-minute cycle with a daily digest report, and cron job health is itself monitored so silent automation failures don't go unnoticed.
The same platform pattern also tracks AI provider usage and cost — local (Ollama) and cloud (Copilot, OpenAI, DeepSeek) — giving a live, evidence-based view of AI spend and performance tradeoffs rather than trusting vendor billing dashboards after the fact.
The architecture was proven first in a personal homelab acting as a testbed, then the same discipline — know your exposure, monitor continuously, automate the noise, keep a human reviewing the signal — was applied to the production multi-site network without changing the underlying approach.
Results & Impact
• Moved security posture from periodic manual review to continuous, evidenced monitoring
• WAN exposure and cert/domain expiry now caught automatically instead of discovered after an outage
• 15-minute alerting cadence with daily digest gives leadership a standing answer to 'are we exposed' without waiting on an audit
• AI provider cost/performance visibility now informs which models get recommended for production use, grounded in real usage data instead of vendor claims
• Pattern is portable — the same codebase runs unchanged from a personal homelab to a multi-site enterprise network, proving the architecture before it touches production
Project Details
Multi-site apparel manufacturer
Apparel Manufacturing
Ongoing, initial build 2 months
Related Case Studies
Bringing Identity Governance Out of the Dark: Active Directory and IBM i Account Auditing at Scale
