The systems a business runs on

The estate a business actually runs on. The network inside the building, the identity and devices that sit on it, the platforms where the work gets done, and the records that have to agree with each other at the end of a month. Most organisations buy these in four separate conversations and then discover the seams. This is the same estate designed once, by one person who can answer for the cable in the wall and for the figure in the report.

A network is installed once and lived with for a decade, so it is worth building properly the first time.

Cabling and wall ports. Structured cabling to every desk, camera, reader and access point, terminated on a patch panel in a proper comms cabinet rather than coiled behind a cupboard, and labelled at both ends so the next person can trace a fault without a tone generator and an afternoon.

Switching. Managed switches sized for the power budget they have to carry rather than the port count printed on the box. Cameras, handsets, readers and access points all draw from the same budget, and a switch that runs out of power at eighty per cent occupancy is a fault that only appears in year two, in December, when the last four cameras go dark.

Routing and the edge. A gateway matched to the connection behind it, a hardware firewall where the site needs policy of its own, a WatchGuard Firebox where that calls for an appliance, rules written once and pushed everywhere rather than maintained by hand per location, and a second path out where the business genuinely cannot be offline.

Wireless. Access points placed for coverage and for roaming rather than for symmetry on a ceiling plan, with a survey behind the placement. Channel and power planned rather than left on automatic, and roaming tuned so a laptop lets go of an access point two rooms away instead of clinging to it at one bar.

Cellular signal boosters. Concrete, steel, coated glass and basements defeat a phone signal, and no amount of wireless fixes a dead cell. A donor antenna sited on the roof where the signal actually is, a repeater sized for the floor area, and indoor antennas run to the parts of the building that need them, commissioned so the carriers stay happy with what is being retransmitted.

Storage. Buffalo network attached storage for the files that should never have lived in a mailbox, with snapshots, an offsite copy, and a restore that has been tested rather than assumed.

Everything else in the ceiling. Printers and scanners that authenticate against the directory instead of holding an open queue, displays and video feeds in meeting rooms and common areas, and the relays and extenders that carry a signal into the parts of a building that cabling will never reach.

One physical network, divided by what each thing on it is allowed to do.

Staff, guests, payment terminals, cameras and building systems each sit on their own segment. A guest gets internet and nothing else: no route to the till, no route to the file server, no route to a camera, and no route to the laptop at the next table. A payment terminal talks to exactly one destination. A camera talks to its controller and to nothing on the internet at all.

Guest access runs through a splash page of the kind you meet in a hotel or an airport: the business puts its own name and terms on it, the visitor accepts and signs in, and the session gets a time limit and a bandwidth ceiling so one download does not take the room down. It is a small piece of work that quietly does three jobs at once, keeping visitors off the internal network, giving the business a record of who used it, and turning the wireless into a legitimate opt in rather than an open door.

Quality of service is set where it matters, so a video call does not degrade because someone started a backup at half past two.

One directory as the source of truth. Sign in, group membership, conditional access and multi factor live in Entra ID, and everything downstream reads from it rather than keeping a list of its own.

Devices enrol in Intune and have to prove they are compliant, encrypted, patched, and free of anything obviously wrong, before they reach company data. A new starter is provisioned once and arrives to a working laptop, a mailbox, the right files and the right doors. A leaver is closed in a single action, including their building access where the door controllers read from the same directory.

Credentials go into Keeper instead of a shared spreadsheet, Cisco Duo carries the second factor where the estate needs one outside the tenant, and Barracuda filters mail in front of the mailbox rather than relying on what the tenant does by default.

Server to server, on premises to cloud, and cloud back to on premises where that is genuinely what the business needs.

File shares and document libraries move with their permissions intact, with AvePoint Fly where the volume justifies it, and permissions are the part that goes wrong when it goes wrong. Mailboxes cut over without a gap. Line of business data is reconciled against the source before anyone signs it off, not after. A way back exists before the switch rather than being improvised on the night, and the business knows in advance what month end looks like while both systems are still live.

A CRM that reflects how the business actually sells rather than how the software assumes it does, in Salesforce or HubSpot, with the fields a team will genuinely fill in and no others. Work management in Jira, Asana, ClickUp or Notion, chosen for how the team already works instead of imposed on it, and connected to the places where the work is really discussed.

Reporting built on those same records in Power BI and Google Analytics, so spend, pipeline and the ledger can be read beside each other instead of argued about in a meeting.

Once identity, storage and records are in order, AI stops being a demonstration and becomes useful, because the hard part of putting AI into a business is not the model. It is knowing where the data is and who is allowed to see it.

Copilot reaches what a person is already permitted to reach, which only behaves correctly if permissions were built correctly in the first place. Beyond that, a custom agent can be built for the business itself: one that reads across document libraries, the file server, the CRM and the work management tool, answers in the language the business uses, and routes anything consequential to a person before it goes out. The same agent can watch the queues in the work management platform and surface what is slipping rather than waiting to be asked.

Every decision here is a decision about the business rather than a product comparison. What a role should be able to reach. What happens on the day someone leaves. Which record is the one that counts when two systems disagree. What the building does when the line goes down at nine in the morning.

The hardware is the straightforward half. What makes an estate hold is that one person understood all of it at once and designed the seams on purpose.

The whole estate is drawn out floor by floor, from the cabling up to the AI reading across it, on the infrastructure page.