The refresh was a multi-site next-generation firewall replacement for a nonprofit health provider. The night after cutover, somebody came at it.
Timing like that is the test nobody schedules. A platform less than twenty-four hours old is the worst moment to be attacked and the worst moment to be defending, because every unfamiliar behavior has two possible explanations and one of them is the new firewall. The response was geo-fencing and containment, run alongside the day-one support the cutover had already committed to rather than instead of it.
Why it belongs on the record
Not because the response was exotic — it was not. Because the honest version of a cutover is that the first day is when the estate is least understood by the people responsible for it, and a design is only as good as what it lets you do on that day. Being able to contain an intrusion on a platform that new is a property of the design and the documentation, not of the response.
A health provider carries HIPAA obligations that do not pause for a migration window, which is what makes this a statutory matter and not only an operational one.
Outcome
Contained, on a platform less than twenty-four hours old, without pausing the support the cutover had already committed to.