This network security case study shows how Compuloop separated payment systems, staff devices, guest Wi-Fi and CCTV across 22 Australian retail stores. The staged rollout ran after hours to protect trading.
Project technologies and related platforms we support
The retailer had opened its 22nd store the month before we were engaged. Every store had been stood up the same way: an ISP router, a switch, whatever access points were on special, and a POS terminal configured by the vendor. Nobody had ever drawn the network.
The trigger was a landlord-required security review at a flagship shopping centre. The centre's IT team ran an external scan and flagged that guest Wi-Fi appeared to be on the same subnet as POS. The operations manager asked a reasonable question — “is that bad?” — and that question became the project.
Guest Wi-Fi routable to POS terminals in all 22 stores. CCTV NVRs on default vendor credentials in 19 stores. Three stores with UPnP-enabled RDP exposed directly to the internet. Two stores sharing the guest Wi-Fi password with staff Wi-Fi. No VLANs anywhere, and no central visibility of store networks from head office.
The realistic attack path was not sophisticated. A customer on guest Wi-Fi, or anyone in Wi-Fi range, could reach the POS subnet. With default NVR credentials, an attacker could pivot into the store network and attempt to reach head office over the site-to-site link. Card data was tokenised at the terminal, which limited direct card exposure — but POS held pricing, stock and integration credentials into head office systems, and three stores had RDP exposed. The commercial risk was a payment environment incident during peak trading, plus breached landlord and PCI obligations that were already overdue.
A card terminal illustrates why network reliability and controlled access matter at the point of sale. The project below explains the changes made around the retail environment.
Retail networks need clear separation between business systems and guest traffic. Access-point hardware works together with the network design and support process.
Fortinet’s product interface illustrates switch administration.
A Fortinet product example shows wireless administration.
Documented every store's topology and built a standard four-VLAN design: POS (payment), Corporate, Guest, and IoT (CCTV, access control, signage). Defined the inter-VLAN policy matrix before touching a store, so each rollout was a repeatable build rather than a bespoke job.
FortiGate 60F firewalls and UniFi access points in two stores, managed centrally through FortiManager. Ran a full trading week before scaling — which is where we found the POS discovery problem.
Two stores per night after close, with a documented two-hour change window and a rollback plan. Each store: firewall swap, AP replacement, VLAN setup, policy load, NVR credential rotation, endpoint agent, and a signed-off test script covering POS, EFTPOS, printing, stock lookup and CCTV playback.
FortiManager dashboards giving head office visibility of all 22 store networks, centralised logging, incident escalation path, and the records pack for PCI DSS v4.0 self-assessment.
The project also established repeatable processes. These controls support ongoing operation after the initial rollout.
Talk through your priorities, current systems and next practical step with Compuloop.
The following before-and-after figures relate to this engagement. The scope and starting position matter when comparing them with another business.
| Measure | Before | After |
|---|---|---|
| Stores with POS isolated from guest Wi-Fi | 0 of 22 | 22 of 22 |
| Internet-exposed RDP instances | 3 | 0 |
| CCTV devices on default credentials | 19 | 0 |
| Head office network visibility | None | 22 stores, centralised |
| PCI DSS self-assessment | Overdue, incomplete | Submitted and cleared |
| Trading disruption during rollout | — | Zero |
New store network build
Monthly fault diagnosis per store
Config drift detection (was quarterly manual)
All 22 stores (was 22 phone calls)
Project-specific financial model. Avoided losses and productivity benefits are estimates, not guaranteed cash savings or returns.
| Line item | Value |
|---|---|
| Project investment (9 weeks, 22 stores) | $96,000 |
| Cost per store | $4,364 |
| Avoided: PCI non-compliance fee exposure (per month) | Up to $100,000 |
| Avoided: breach investigation and re-certification | $60,000–$120,000 |
| Avoided: 5-day peak outage at 22 stores | ~$310,000 |
| Annual recurring: fault diagnosis time saved | ~$30,000 / yr |
| Annual recurring: store build time saved (4 stores/yr) | ~$6,000 / yr |
| Payback | Immediate against fee exposure |
Background guidance: read the relevant official framework or product documentation. This explains the technology; it is not independent verification of this client project.
If this network security case study reflects a problem in your business, start with a scoped conversation. Tell us about your sites, people, systems and current priorities. We can then identify the right assessment, the practical constraints and the evidence you need.