How it looks today
Assessment
Sites, connectivity, applications and where they live, identities and devices, flows between segments, exposed services, what is already in use and what is worth keeping.
Cybersecurity › Firewall and network security
The perimeter is the identity,
not the office.
Main firewall in the cloud, sites connected through private tunnels, access to applications by identity rather than by address, protection that follows people outside the company too. We design, deliver and manage network security for companies with one site or fifty. Or we support your team only on the part you need: architecture, consulting or management.
The on-site firewall protected an office that no longer exists.
People work from home, from customers, from their phones. Applications live in the cloud. There is more than one site, and sites change. A firewall that only defends the office door protects the place where the data no longer is. Today the perimeter is the identity of whoever connects and the state of the device they connect from: that is what the network must be designed around.
Cloud
The main firewall lives in the cloud. Sites connect to it through private tunnels, the load and the anti-DDoS protection sit there, site gateways become peripheral. With one site or fifty, the architecture is the same.
Identity
Access to applications is granted by identity and device state, not by IP address: Zero Trust Network Access instead of VPN, and the same protection on the endpoint when it leaves the company.
Managed
Firmware, policies, monitoring and logs are daily work, not an installation. We do it remotely, with automatic alerts and response times defined in the contract. Or your team does it, on our design.
What the service includes
Six components, one design.
Each piece can be delivered by us or by your team on our design. What does not change is that they belong together.
Cloud firewall and site gateways
The main firewall is a virtual appliance in the cloud, in Azure or in the cloud you choose; sites connect through private tunnels and cloud-managed gateways on site close the local perimeter. Gateways in active/passive high availability with periodic failover tests, or active/active with virtual appliances where the service cannot stop.
Identity-based remote access (ZTNA)
No VPN open to the world: people access individual applications based on who they are and the state of their device, with a WireGuard-based overlay with a European control plane or with Microsoft Entra Global Secure Access for companies that live in Microsoft 365. The gateway VPN remains available where it is really needed.
Filtering, IPS and DNS protection
Intrusion prevention, web category filtering, blocking of malicious domains and addresses and DNS filtering on the cloud firewall and on the gateways. The same protection follows the endpoint when it leaves the company, because the perimeter is the person, not the desk.
Site network: switches, Wi‑Fi, segmentation
Switches and access points managed from the same console as the firewall, separate VLANs for offices, guests, phones, cameras and production machines, scheduled firmware updates. A segmented network confines an incident to the segment where it starts.
Logs, monitoring and SIEM
Logs from the cloud firewall, gateways and access land in a central SIEM, where they are correlated with endpoint and identity logs. Continuous monitoring with automatic alerts; for organisations with NIS2 obligations, incident handling connects to our CSIRT service.
Four ways of working together
Full service, from design to day-to-day management. Architecture and design only, implemented by your team or your provider. Consulting only, for decisions, audits and regulatory compliance. Management only, of the firewall and network you already have, whatever the brand. From the single site to the group with an internal IT team.
How we work
From an office to defend to a perimeter to design.
Four steps. You can entrust all of them to us or stop where your team takes over the project: the design stays the same.
The design
Architecture
Perimeter in the cloud and role of the site gateways, segmentation, identity-based access, high availability, logs and monitoring. Platforms chosen together, not from a catalogue.
Without stopping the business
Implementation
Cloud firewall, gateways, tunnels between sites, policies, ZTNA and migration of access. The old firewall stays on until the switch, in agreed windows.
Every day
Operations
Firmware and policies managed remotely, continuous monitoring with automatic alerts, logs in the SIEM, failover tests and periodic rule reviews.
How we choose
An architecture,
not a box.
We do not start from the product: we start from where your data lives and how your people work. For site gateways our reference choice is cloud-managed platforms with no recurring per-feature licences, with hardware in your name that you can also buy directly. For the cloud firewall, open-source or commercial virtual appliances. The firewall you already have, whatever the brand, we manage through partners and distributors.
We sell the hardware, manage it if it is yours, or include it in the service fee: your choice. The exit terms are written into the contract, as our ISO/IEC 27001, 27017 and 27018 certifications require. Endpoint protection is on the EDR and XDR page, periodic vulnerability checks on Vulnerability Assessment and Penetration Testing, NIS2 incident handling on the outsourced CSIRT.
Cloud-first
The main firewall in the cloud and the sites as branches: the same architecture for one site or fifty, with anti-DDoS protection and capacity that grows without changing hardware.
High availability
Gateways in active/passive pairs with periodic failover tests when provided for in the contract; active/active with virtual appliances where downtime is not acceptable.
SIEM
A single collection point for network, identity and endpoints: correlated logs, searches and reports ready for NIS2 and ISO/IEC 27001 audits, and a concrete starting point for incident response.
ISO 27001 · 27017 · 27018 · 9001
A service delivered by a company certified for information security, cloud security, personal data protection and quality. Members of Clusit.
Frequently asked questions about firewalls and network security
The questions we hear before redesigning a perimeter.
We do not start from the brand but from the architecture, and then we choose with you. For site gateways our reference choice is UniFi: we are partners in the UniFi Enterprise programme, with access to the Enterprise portfolio, authorised distributors and partner support; the hardware stays in your name and you can also buy it directly. For the main firewall in the cloud, and wherever active/active high availability is required, we use pfSense as a virtual appliance in Azure. We also have direct expertise on Fortinet and WatchGuard, and we manage any other brand you already own through partners and distributors. If you have a firewall that works, we do not ask you to replace it: we ask you to let us manage it well.
Because that is where the data and applications are, and where people converge from home, from customers and from the sites. A cloud firewall, built as a virtual appliance, receives the traffic of every site through private tunnels, applies the same policies to everyone, withstands volumetric attacks thanks to the cloud’s anti-DDoS protection and grows in capacity without changing hardware. The site gateway remains, but becomes peripheral: it closes the local perimeter, segments the internal network and connects the site to the hub. With one site or fifty the architecture does not change, only the number of branches does.
A classic VPN opens a whole slice of the network to whoever connects, which is why we use it only where it is really needed. ZTNA (Zero Trust Network Access) grants access to the single application based on the person’s identity and the state of their device, without exposing the network: it is our reference choice, delivered with a WireGuard-based overlay with a European control plane or with Microsoft Entra Global Secure Access for companies that live in Microsoft 365. SASE (Secure Access Service Edge) is the next step: network and access security delivered as a single cloud service per user, with ZTNA, firewall, web filtering and SaaS application control in one place. It makes sense for distributed organisations with many sites and many mobile users. We design SASE and SSE architectures and integrate them with identity, network and cloud firewall; we choose the platform together, based on where you want your traffic to flow.
In sites that cannot stop we install gateways in pairs, in active/passive high availability: if one fails the other takes over with the same configuration, and if the contract provides for it we run periodic failover tests, so that redundancy is verified rather than merely declared. Where even that switchover is not acceptable, we use virtual appliances in an active/active configuration. The configuration is in any case saved in the cloud and can be restored on a spare unit. Hardware replacement goes through the partner programme and the distributors, within the times defined in the contract.
With both, and in four different ways. For companies without an internal network team we deliver the full service: design, implementation and day-to-day management. For companies with an internal IT team or an on-site provider we can do only the architecture and the design, which they then implement; only the consulting, for decisions, audits and regulatory compliance; or only the management of the firewall and network that already exist, whatever the brand. A company with one site and one with fifty sites in three countries have different needs but the same question: who designs the perimeter and who keeps it in order every day.
MIMIT Cloud and Cybersecurity Voucher 2026
This service is eligible for the voucher: a 50% non-repayable grant.
AtWorkStudio is an approved supplier. The grant covers 50% of the expenditure, up to €20,000, as a direct purchase or a subscription of at least 24 months. The application must be submitted before buying: drafting opens on 20 October 2026, submissions from 10 November 2026 to 20 January 2027, first come first served.
Codes to enter in the application
VCCFA2600000145-A1VCCFA2600000145-A2VCCFA2600000145-A3VCCFA2600000145-A4VCCFA2600000145-B2VCCFA2600000145-B4VCCFA2600000145-C3
Ready to redesign your network perimeter?
Tell us how many sites you have, where your applications live and how people access them today. We will tell you which architecture makes sense and which part is worth entrusting to us. Network security is completed by EDR and XDR on endpoints and by digital identity management.