Managed IT & security · Construction
National home builder turnaround after a malware incident
A 300-staff residential builder moved from a malware clean-up and years of under-investment to modern, monitored and fully managed IT across seven offices.
Download PDF
- 300
- endpoints replaced
- 7
- offices connected
- ~90%
- reduction in phone spend
- 18
- virtual servers retired
Before
- Unmanaged personal laptops connected to legacy file shares introduced malware.
- Ageing servers and networking, including an old network hub, remained in production.
- Seven offices used an expensive MPLS network and legacy servers hosted at NEXTDC.
- Tape backups were unreliable, with no tested off-site recovery.
- The hosted phone platform cost around $10,000 per month and lacked mobility.
- Microsoft licensing was non-compliant, devices were inconsistent and modern security controls were missing.
After
- 300 standardised HP and Microsoft Surface devices, centrally managed with no personal devices on the corporate network.
- SentinelOne endpoint protection, Huntress managed detection, application control and Microsoft 365 data protection.
- Seven offices connected through WatchGuard SD-WAN, with at least 1 Gbps Enterprise Ethernet and FTTP backup links.
- Cove cloud backups for servers, endpoints and Microsoft 365, with tested restores.
- 3CX calling with mobile and softphone apps, cutting monthly voice spend by around 90%.
- 18 virtual servers retired and two racks removed; compliant Microsoft licensing and monthly reporting.
The client and the challenge
A national residential builder employed 300 staff across seven offices, with display-home sales teams working weekends. Sales and administration depended on reliable access to contracts, pricing and plans.
Corporate machines were slow and ageing, so staff began using personal laptops. Those devices had no central updates, managed antivirus or monitoring. Malware reached the old file shares and disrupted multiple offices.
Unicorn IT Group was engaged to contain the incident, correct the underlying risks and become the builder’s fully managed IT department. Emergency response began in week one; the transformation was delivered over nine months.
Contain and clean up — week one
- Isolated affected machines and removed personal devices from the corporate network.
- Deployed SentinelOne and Huntress for immediate visibility and threat hunting.
- Reset credentials, enforced multi-factor authentication and closed open file shares.
- Checked available tape restores and introduced temporary cloud backup for critical data.
Stabilise and standardise — months one to four
- Introduced managed support from 7am–7pm weekdays, with weekend cover for display-home sales teams.
- Replaced 300 machines with HP Z Towers, HP ZBooks and Microsoft Surface laptops matched to each role.
- Corrected Office 365 and Microsoft 365 licensing.
- Replaced tape with Cove Backup and tested restore schedules.
- Refreshed switching and Wi-Fi with Ubiquiti equipment.
Transform — months four to nine
- Replaced MPLS with WatchGuard SD-WAN and Swoop Enterprise Ethernet of at least 1 Gbps per site, backed by 1000/400 FTTP links.
- Moved calling to 3CX with SIP trunks, mobile apps and softphones.
- Moved files to SharePoint and Lucid Link, with Wasabi storage for large drawing and media sets.
- Retired 18 virtual servers and removed two data centre racks.
- Replaced 20-year-old printers with a managed Konica fleet.
- Added application control and Microsoft 365 data loss prevention over customer, pricing and project information.
- Partnered with Dynamics Squared to introduce Dynamics 365 and improve business processes.
The business outcomes
- Display-village teams can reliably issue contracts and price builds seven days a week.
- Voice savings were redirected into security and new devices.
- Removing legacy servers reduced data centre, maintenance and licensing overheads.
- Restore testing reduced data-loss exposure, and compliant licensing closed audit risks.
- Leadership receives monthly reporting, a named account engineer and a rolling technology roadmap.
Lessons for other builders
- Fix slow corporate equipment before personal devices become a workaround.
- Protect shared business data with modern collaboration and access controls.
- Test restores rather than assuming backups will work.
- Use savings from older phone and server systems to fund stronger security.
“We went from a malware cleanup to a completely transformed IT environment. Our sales teams have reliable devices, our sites are fast and connected, and we finally know our data is protected.”