Case studies

Real migrations. Measured outcomes.

Four engagements, documented like ops reports: the environment we found, the architecture we engineered, and what changed for the business. Toggle each architecture between before and after to see the transformation.

Manufacturing SAP Business One Microsoft Azure

From ransomware recovery to cloud resilience

How Clyhop transformed a manufacturing company's SAP Business One environment after a ransomware attack exposed every weakness of its on-premises setup.

01CASE FILE

The challenge

  • Ransomware took everything down. Production servers hosting SAP Business One became unavailable overnight.
  • Backups lost with them. Backup data lived in the same data center — and was compromised in the same attack.
  • Operations at a standstill. With no disaster-recovery strategy in place, recovery options were extremely limited.
  • Legacy remote access. Citrix XenApp added cost and complexity without adding resilience.

The Clyhop solution

  • SAP B1 rebuilt on Azure — restored with the SAP team on secure, monitored virtual machines.
  • Geo-redundant backups — encrypted, off-site copies that can never be lost with production.
  • Disaster recovery implemented — enterprise failover readiness, from a starting point of none.
  • Modern secure access — app virtualization replaced Citrix XenApp; Defender for Cloud and 24/7 monitoring watch the estate.

Architecture — tap to compare

Head office · on-premiseSAP Business One on physical servers
Same buildingBackups kept in the same data center — no off-site copy
▲ remote users via Citrix XenApp ▲
ResilienceNo disaster recovery strategy — single point of failure

Everything appeared to run smoothly — until one ransomware attack compromised production and backups together.

Microsoft Azure · primary regionSAP Business One on monitored Azure VMs · Microsoft Defender for Cloud
Azure · DR regionDisaster recovery failover
Off-siteGeo-redundant encrypted backups
▲ encrypted private connectivity ▲
UsersModern secure remote access — Citrix XenApp retired

Secure · monitored · geo-redundant · recoverable — resilience engineered in, not bolted on.

DREnterprise-grade disaster recovery, from none
GeoRedundant off-site backups, encrypted
CitrixLicensing & server maintenance eliminated
24/7Continuous monitoring & alerting

Business benefits

Enterprise-grade cyber resilience · secure off-site backups · higher system availability · reduced infrastructure management · simplified remote access · improved scalability · lower total cost of ownership with predictable cloud operating costs.

Media & Entertainment AWS Fargate CI/CD · WAF · CDN

From manual servers to a cloud-native media platform

A fast-growing digital media business whose website is its storefront — re-architected on AWS for scale, security, and speed.

02CASE FILE

The challenge

  • Manual deployments. Releases pushed by hand to a single server — slow and error-prone.
  • Frequent outages. Regressions repeatedly disrupted the live site the audience depends on.
  • No backups. A single failure risked permanent, unrecoverable data loss.
  • Weak security, high cost. Little stood between attackers and the backend, while hardware bills kept climbing.

The Clyhop solution

  • Automated delivery. Code moves from commit to production hands-free via CodeBuild and CodePipeline.
  • Serverless containers. AWS Fargate scales the platform automatically with audience demand.
  • Security at the edge. Firewalled backend, Web Application Firewall, and a global CDN.
  • Resilient data. Replicated MongoDB cluster with automated backups, plus dedicated Dev and UAT environments.

Delivery pipeline — tap to compare

Release processDeveloper copies files by hand to one on-premises server
▼ no testing gate ▼
ProductionSingle server · no backups · exposed backend

One fragile path from keyboard to production — and one failure away from permanent data loss.

1 · CommitGit repository — single source of truth
2 · BuildAWS CodeBuild compiles & tests every change
3 · ReleaseAWS CodePipeline orchestrates to production
4 · RunAWS Fargate — serverless, auto-scaling containers
▼ protected & delivered at the edge ▼
SecurityFirewall + WAF filter malicious traffic
DeliveryCDN serves content worldwide from the edge
DataReplicated MongoDB + automated backups

Changes flow Dev → UAT → Production automatically — nothing reaches the live site untested.

0Manual deployments — releases are push-button
ElasticAbsorbs traffic spikes instead of breaking
3Layers of edge protection: firewall, WAF, CDN
↓ CostRight-sized cloud replaced on-prem hardware

The bottom line

From fragile on-premises servers to a secure, scalable, cloud-native platform — a revamp that lets the media business focus on its audience, not its infrastructure.

Manufacturing SAP ECC → HANA Azure primary · AWS DR

SAP on cloud: a zero-dependency HANA migration

A multi-site manufacturer where shop-floor transactions, dispatch and billing all run on SAP — re-platformed to HANA on Azure with multi-cloud DR on AWS, and every branch made independent of head office.

03CASE FILE

The challenge

  • One data center, one point of failure. Every branch reached SAP only through the head-office data center — if HO went down, all plants stopped.
  • Fragile leased lines. Expensive MPLS circuits where a single link failure isolated a plant from production.
  • No disaster recovery. A hardware, site or ransomware event meant extended, unplanned downtime.
  • Aging ECC platform. Legacy on-prem hardware near end of support, with a HANA migration mandated — and a heavy, fixed annual bill.

The Clyhop solution

  • Re-platform to HANA on Azure — ECC migrated to HANA on right-sized, elastic infrastructure.
  • Multi-cloud DR on AWS — every production server replicated to a second cloud, with HANA System Replication keeping the DR copy in sync.
  • Per-branch IPsec VPN — each plant given its own secure, independent path to SAP, protected by cloud firewalls in a segmented landing zone.
  • Decommission & save — on-prem servers and MPLS circuits retired; backups moved to cloud; reserved instances applied.

Landscape — tap to compare

Head office data center · on-premiseSAP ECC on Oracle DB · local backup only · no DR
▲ MPLS leased lines — every branch routes through HO ▲
Branch 1Plant — dependent
Branch 2Plant — dependent
Branch 3Plant — dependent
Branch 4Plant — dependent

Hub-and-spoke over leased lines: branches reach SAP only through HO — no independent path, no failover, no DR.

Microsoft Azure · primarySAP HANA production + app servers · firewall/NVA · cloud backup
AWS · disaster recoveryHANA System Replication · production DR servers · backup vault
▲ internet · per-branch IPsec VPN — no head-office hop ▲
Branch 1✓ independent
Branch 2✓ independent
Branch 3✓ independent
Branch 4✓ independent

One site going down never halts the others — DR was invoked and verified, so recovery is proven, not assumed.

~35%Lower run cost after retiring on-prem & leased lines*
100%Branch independence — every plant keeps producing
2Clouds, one landscape — no single-cloud dependency
0On-prem servers & leased lines remaining
PHASE 1Assess

Discovery of the SAP landscape, dependencies, network and business case.

PHASE 2Architect

Azure landing zone, firewall design, HANA sizing, DR & backup blueprint.

PHASE 3Migrate

Build servers, migrate ECC to HANA, validate application & data integrity.

PHASE 4Enable DR

HANA System Replication and server-level DR into AWS; failover tested.

PHASE 5Cutover

Branches switched to independent VPN access; parallel run, then go-live.

PHASE 6Decommission

On-prem servers and leased lines retired; reserved instances applied.

*Cost figures are illustrative indices for direction of change; a further ~30% saving followed from reserved instances on steady-state workloads. Customer identity anonymized.

Retail SAP B1 HANA · Azure Microsoft 365 · Intune

Retail digital transformation, zero on-premise

A 30-user retail business across head office and branches, ready to leave the server room behind. The mandate was simple: eliminate every on-premise dependency.

04CASE FILE

The starting point

  • Everything at head office. Every system ran on-premise at HO, with branches tunnelling back over VPN.
  • Local identity. An on-premise domain controller handled all authentication.
  • In-house email. A local Zimbra server hosted and maintained on site.
  • Hardware treadmill. Local servers, patching and refresh cycles consumed budget and time.

Six workstreams to cloud

  • SAP B1 HANA on Azure with disaster recovery configured for business continuity.
  • Microsoft 365 mail + Entra ID — Zimbra retired; single sign-on across every service.
  • Application virtualization — SAP streamed securely to managed devices only.
  • Intune + Autopilot — hardened perimeter, compliant devices, zero-touch onboarding.

Workplace — tap to compare

Head office server roomSAP B1 · domain controller · Zimbra mail — all on local hardware
▲ branches tunnel back over VPN ▲
UsersProductivity tied to the head-office building staying up

Every workload, one building — growth and resilience both capped by the server room.

Microsoft Azure cloudSAP B1 HANA (primary + DR) · Microsoft 365 mail · Entra ID
▼ secure delivery layer ▼
DeliveryApp virtualization streams SAP · firewall-protected perimeter
▼ managed endpoints ▼
The 30 usersCompany-approved devices · Intune managed · Autopilot onboarding — working securely from anywhere

Ship-and-go provisioning: a device is shipped to any user, anywhere; they self-onboard through Autopilot — no IT visit.

100%Cloud-hosted — the server room is gone
0On-premise servers, patching or refresh cycles
30Users working securely from anywhere
Zero-touchAutopilot onboarding gets people working sooner

Why it matters for the business

Stronger security and compliance with approved devices and cloud identity · built-in business continuity through Azure DR · work-from-anywhere productivity · elastic scalability on demand · lower cost and maintenance · faster user onboarding.

Your story next

Ready to write case study 05?

Every engagement above started with a free, no-obligation consultation. Tell us where your environment is today — we'll show you the architecture it deserves.

Book a free consultation