A national architecture, engineering, planning, and construction services firm scales cybersecurity maturity across a distributed organization.
Client
Mead & Hunt, a national architecture, engineering, planning, and construction services firm
Challenge
Scaling cybersecurity across a growing, distributed organization while protecting client data, intellectual property, and federal-work requirements
Solution
Collaborative partnership for managed cybersecurity, consulting, training, and compliance help
Results
Stronger cyber resilience, board-ready visibility, improved security maturity, CMMC-aligned progress, and a trusted extension of the IT team
Because that's how I see AI. Everybody's like, it's gonna replace my job. It's gonna take away all these things for me. And I'm like, we had people that just didn't wanna make the change. They wanna keep on drawing on the boards. And so most people left their work because they're like, I'm never gonna learn CAD. I don't wanna learn CAD. I wanna keep on drawing on the board. So you can do that if you want, but it's probably not gonna last long because everybody's gonna be doing CAD, and everybody did. That's how AI is gonna work too. If you don't come along for the ride, if you resist it, you're gonna be left behind just like those people that were drafting. Welcome back to Unraveling IT Expert Tech Talks. I'm Bush Williams, director of Microsoft Business Development at Corsica Technologies. Today, we're covering a topic that every IT leader in a growing professional services firm knows intimately. How do you keep your security posture, your infrastructure, and your team ahead of the curve even when the business is evolving faster than your road map? Joining me is Andy Knauf, CIO and VP at Mead & Hunt, a national engineering and architecture firm with over 125 years in business. Andy's one of the most tenured CIOs in the industry. He's been with Mead & Hunt for over 34 years, and in that time, he's watched the firm grow from a single office of 85 people to 60+ offices and 1350 employees. Along the way, he's navigated every major technological shift, mainframes to cloud, perimeter security to modern SOC, and now the AI era. In this conversation, we'll dig into what it actually looks like to build a cyber resilient organization, how to evaluate AI without getting distracted by hype, and what scaling IT the hard way teaches you that no certification or consultant ever could. Let's start with a quick intro and and kick this off. I, was looking through things this morning because I was curious and saw that, as of as of recording this, you and I had been partnered since twenty twenty one. So here in June, it'll be five years, and that's pretty hard to believe. Looking forward to, to an anniversary gift, you know, five years. Well, we'll see. Yeah. Maybe maybe something for the boat. I know it's about to be that season, so especially come June. So I know you've been you've been with Mead & Hunt for, gosh, like, 34 years, and we're actually the firm's first IT hire. How's your relationship with cybersecurity changed over the course of that career? And feeding into that, you know, I know you're pretty passionate about Mead & Hunt. If wanna tell us a little bit about the firm's history as well. It's pretty well. I started back in in nineteen ninety as a twenty one year old right out of out of school. We had one office, and I think there was eight computers total at at the office. So I really and I was the first IT guy. So there there really wasn't much there. So I could I could really say that I, you know, I could really help start everything. There was no net network, and obviously, cybersecurity back in nineteen ninety, it really wasn't even a thing. I mean, I could remember a day when we still, you know, let people have admin permission to their desktop. I have seen everything, you know, and that that's really, you know, I I started with almost nothing, and then, you know, where we are today, it's it's been it's been pretty fantastic. But, yeah, I think, you know, when I look at that journey where we were five years ago when we, you know, we hooked up with you guys, and we really saw that that big change happening. We saw, you know, people getting ransomware and, you know, that was around the COVID time too. Things really changed a lot, and and we were very proactive to do steps to get ahead of of it. I would say that, you know, fifty, sixty percent of my colleagues have had some sort of ransomware attack, but I feel like we we were lucky enough just to keep on staying ahead of that. It was Right. Gonna hurt. I mean, we've had some scares, but we never actually had an instant instant, you know, so I'm pretty pretty thankful of that. But, you know, really partnering with you was quite honestly one of the better decisions that we ever, you know, we ever made. What I tell people, it wasn't so much that the the thing that got put in place, it was the education that went on top of it. It was really, really fantastic because you can go with a lot of people and they'll forklift and drop off whatever solution is. But I think it's it's really important to get somewhat of the education so you're informed as to how how in the why all this stuff works, and that that to me is the most beneficial. I wanna know the mechanics of it a little bit at least, you know, than just going for the ride. I wanna I wanna be along for the ride. Right. Yeah. We try to take that rising tide brings up all the boats, you know, metaphor for not just saying, hey. Here's how we're gonna implement this thing, but we'll get together and make sure everybody comes along for the ride from an education standpoint. It just makes for better relationships. I guess, you know, along along those lines, you kinda had made the decision not to build your own security operations team entirely in house and move to a security provider. You know, you're a mature org. You've got great talent there. I know many of them. You know, that being said, what what pushed you towards that decision? Well, it it's funny. It it kinda happened by mistake. I I had I had an individual who wanted to be the head of security. We actually had an ad out for it, and then the person decided they didn't wanna get the position, and then they didn't even actually wanna work here anymore. That ended up, you know, sometimes there's a positive comes out of a negative. Right. You know, that that switched my gears and I thought, well, you know, if I would have hired this person, we really would have only been protected from ADM to five or whenever they were around. And really, when I looked at it fundamentally, I'm like, that was probably a good thing that happened because then I switched my gears and I'm like, we really got to have around the sun protection. You know, we can't just have a head of security. At the time, that's what a lot of people were doing is they were just hiring these individuals to be their CSOs or their their head security people. And I'm like, can we do that better ourselves compared to having it done by somebody else who has our back and who's gonna do it. And I think that fundamentally has been a real issue in in our IT industry is how do you trust that? Like, cloud, you know, like, when everybody's if it's saying about putting things on the cloud, they're like, yeah. We can't do that. I still have buddies that, like, I don't trust the cloud. It's gotta be on prem. And I'm like, how? Right. How is this possible? How are you doing this? So I think for for people to trust that have security out there, I I think people are like, no. I think I can do it better. And and the reality is is it's it's impossible. I mean, it really is. It's just like having on prem infrastructure. You can't do it better, and especially we've had such great experience with Microsoft. There there just isn't anything better. And you're at a company and you have maybe one, two you know, if you're a bigger company, three or four people working on security, then you're gonna be better than that team of three thousand? Come on. There's Yeah. Your your attitude towards it and, you know, confidence at this point, I think, kinda shows you were you were right at that point five years ago where a lot of firms, to your point, were hiring one person or, you know, worst case scenario, kinda shoehorning the IT admin into also being the security person. You know? And we saw a lot of issues, a lot of security breaches and things like that with folks of that model just because they didn't have the eyes on where now you could tell through the confidence of you speaking to it, you know, that you've made that decision at a critical point where other people weren't to outsource a SOC. And, you know, now you're kind of on the other side of it where you're having a great security experience because you have a robust system behind you. So I I appreciate that a lot. Yeah. And, you know, I mean, when we looked at things, I mean, you know, we were very cognizant of Microsoft that have it all figured out forever. I mean, was ATP or whatever like that back in the day. Right. Security stack was, I mean, it was not great. Know, I mean, you gotta call a ***** a *****. I mean, they did not have it figured out. But man, when they, you know, when they really turned out Sentinel, I mean, that was that was a game changer. They didn't just stay with a bad product. I mean, they just they they came out and like, hey. We're gonna redo this product. And that that's what I like about Microsoft is they'll just completely reengineer things. Like, we were on Microsoft link for initial phone system, and then Skype came up. It was completely different. And then they they redid the whole platform, and then they did, you know, Teams. And they're all different platforms. And for a while, you know, like, Skype was actually better than Teams. But then Right. A little bit. And now, I mean, there's no question. You can't you can't really have almost a better product than than Teams, but it it went through those growing pains before it really before they really nailed it. Yeah. We're we're showing our our time in the in the IT space talking about Lync and and Skype for Business now. You know? That's that that takes me back quite a while. So you've been running regular MDR reviews with Corsica. I know it's a key point of the service to not just say, here's twenty fourseven, three sixty five secondurity. But also, we want to give you access to peers and resources that work with you strategically, and and we're doing that, you know, with these MDR reviews. So what does what does that ongoing rhythm actually change for you day to day as a CIO having access to those resources? It's huge having access to that. Like, I know what's going on in our company at any point in time. I can see what trends are happening. If I have to do reports, like if I ask my board members or we have a I have an actual group of people that I have to do, you know, like, what's happening in our company, you know, cyber wise. What, you know, what what's happening? So I could take those reports and, like, here's the instances, and I can look at that data, and then I can make decisions based on that data. You know? Like, we just changed how our whole fishing system works. We're gonna be turning that out here in about, you know, another week or two based on, you know, some of the information trends that people are doing. We're we're trying to break people of bad habits. Right. It's all about education. It's like, let's not keep on doing the status quo. Let's change what people are doing and try to get them to do a better job overall of what they're doing. So those reports are phenomenal. But I mean, really the best part, like you said, it's not just getting security twenty four seven, three sixty five. It's having reports and then getting the education and find out where we could be better as a company. You know? When we wanted to get zero trust implemented, that was part of what you did. And it was like, the recommendations were there. It's like, hey, Andy. Do you have some holes here? You know? Zero trust is what you need to do. And we turned it over. We did it on the desktops, and, you know, it was just phenomenal. And then it was like, we gotta go over to mobile devices. And it was painful for users because they're really, really against having, you know, any kind of software put on their phone. You know, I worked with Clayton who was on your team, and he was very adamant that we have to have that zero trust on those phones. And he pushed it. Like, every time we'd had our monthly meetings on security, he's like, look, you gotta have this on there. I mean, you can do what you want, but it's always gonna be a problem until you get zero trust across your entire organization. And that was really one of the last pillars that we worked on, but that came out of those meetings. Our Endpoint protection, we're doing with Intune and and whatever, that's what came out of those those meetings and that additional information. So there's very few vendors. They'll sell you the software. They'll sell you whatever it is, but then it it kinda stops there. Right. And it doesn't stop with you. It doesn't stop until you are a hundred percent, like, you know, head to toe, you're covered. You know, there's no there's nothing. And you have to have all that coverage because if you're not doing, say, zero trust or some of these other things, you're still getting attack vectors at you. And, yeah, the software is protecting you, but you really have to you have to mind the entire shop. And that's that's what we were we're really looking for. And we didn't know we needed that when we first went with you five years ago, but that was part of the education process that we're like, wow. Right. We take the you know, you're not buying a widget or a tool. You're really everybody says the whole extension of your team analogy, but, you know, we really mean it. I think that's what we bring to the table is it's not just, hey. Here's we're gonna install some tools and look at this stuff twenty four seven, but it does you know, we wanna be a peer. We wanna be a partner. We wanna be really truly be a member of your team, and I'm glad that you've had that experience. You know, it's the core of what we're trying to do as a company and with the service. So along the lines of that, things changing the way they are and and trying to be as resilient as possible, if you had one thing with regards to being cyber resilient that you wish you'd understood earlier in your career or something you try to impart on other CIOs maybe young or or starting their first real position there, what what would you impart? What is that, you know, thing that you wish you knew earlier? You know, I I kinda feel like we stayed ahead of of all this stuff. I mean, we we kinda were the, you know, the trendsetters out there. I mean, like, in our space, we were like the second people to go to this this cloud solution. We moved over stuff to the cloud very quickly. We were very nimble. It's like our workstations in the in the cloud. All the stuff that we we did, we we found early on that getting off of on prem was the best thing for us, especially how we worked as a company. We set up a lot of small offices, three to five people. We work where the work is at. That was our philosophy. So we went from when I started one office to now we have sixty five offices. And if you talk about security, how do you secure those offices? And especially now, like, if you're doing federal work, you would actually have to go through enormous amount of effort to secure an office of three or five people. They don't care if it's three or five people or if there's five hundred people. You gotta have the same controls in place. If you don't have a robust system for storing enclaves and FedRAMP systems that you can put in the cloud, you would spend all your money just trying to protect yourself. Right. I don't know if there's just one particular thing. Probably my biggest mistakes were maybe going to things a little bit too quick. The bleeding edge? Yeah. I mean, we went to the bleeding edge. I mean, we because we were out there, you know, that kind of burned us. Like, when voice over IP phones first came in, one of the biggest mistakes, I went from analog right to voice over IP. And I remember they didn't have the codecs figured out, and you would get robot voice when you were Oh gosh. Calls. Right. Because it wasn't sending the packets correctly. I had an engineer fly over from England to try to solve this problem with us, and and people were not necessarily happy, but they understood the big picture. And, you know, when we went to the cloud, we had issues with that, and I I really had a lot of people that were upset because it wasn't a hundred percent when we did it. But when COVID happened, you know, all those tools in the toolbox that I didn't get to fully use, I got to use all of them. Right. You know? I always tell people the COVID thing was the worst thing for a lot of people, but for me, all the stuff I was waiting to use, it was all there ready to use. Pushed it all to the front. We we were prepared and and yeah. And and and we got to use everything. So everybody else was scrambling, and we were, you know, we were sitting really good. I didn't have global pandemic on my bingo card, but, you know, we were prepared for it. And Right. We weathered the storm. So it's getting those tools in place to to weather the storm, and that's that's really the the philosophy that I've taken over my career is, you know, at all costs, you gotta keep the the company running. Yeah. And I think you make a good point that resilience, it extends beyond cybersecurity. Cybersecurity is a huge cornerstone of being resilient. But in the modern times, if your organization depends on stability, having access to the cloud for workloads and having things in place that allow the ultimate example. We're gonna have a global pandemic. Folks are gonna go to remote work. You didn't know that's what you're preparing for, but as it turned out, you were able to make that transition and maintain operations and have, you know, not only the the security components, but just the operational components necessary to keep doing business. So, I appreciate that. I think I think the one thing that everybody is top of mind today is AI adoption. I don't think you and I have talked about this because we we focus so much on security and talking through that aspect of what we do. But with all of the inside and outside pressure around AI adoption, in a lot of terms, leadership feels like, hey. Are we using AI? We feel like we should be using AI. And, you know, folks internally all have different experiences with all these different agentic AI platforms, and they're like, you know, hey. What can we do with with AI? And what are you seeing actually at Mead & Hunt from real practical value in any AI platforms today? Anything you guys are doing in in that field? You really kinda hit it on the head, you know, with AI. It's it's like, hey. We gotta be doing more, and then there's like, well, maybe we shouldn't be doing so much. So, like, what is it? You know? What where are we going? And it's difficult because you gotta kinda play to your audience. You know? I mean, we have clients that that write contracts to say, don't wanna have any AI on their contract at all. And then there's some it's like, what what are you doing to help reduce costs or help out the the projects by using more AI? So it you know, it's all across the board. I don't think people want you to just mail it in. You know? They don't want know that they're paying for something and AI is doing everything in the background. I mean, we're not quite to that spot yet, but there's there's quite a few things we're doing. Just on the automation side, you know, it's it's taking a task that takes an hour and then figuring out how to make that five minutes. That's that's what we're doing a lot of. It's it's it's the automation that we're doing. It's, you know, how do you write a proposal better, write a report quicker, go through a a bunch of resumes quicker and and ask you questions. It can be anything. One thing that we did at the first part of the year, we became a Microsoft frontier company, and I think it it's pretty well known. Anybody who knows me, I'm a huge Microsoft guy. Right. We do own every piece of Microsoft software now because we we just switched to Microsoft Dynamics, but we're implementing a lot of the frontier agents right now, and it's just been hugely beneficial to partner with them. We have meetings with them. Now it's almost weekly in some of these because there's there's so much going on, and there's so much to learn. And, really, the making that agent, you know, work for you, that's that's really the next step. Everybody's got the agents who asking the questions. But when you have an agent that's doing work for you and calling on other agents to get work, that's where we're at now. Agents, you know, actually working on our behalf, that's the next thing that we wanna get to. Right. You know, like, the help desk, you know, area and just in our department, over half of our request is, you know, it's it's all done by AI agents, and we're trying to get more self serving on this. And, I mean, I see that with so many things that we're doing is, like, how can that help and how can I take resources and put them someplace else? I don't wanna be like Oracle and and get rid of people. I wanna be able to do more work, and that's that's our philosophy. It's like, how can we do more work, you know, with less? Right. Yeah. And I think that's that's a good differentiation. I think when I asked you the question, my mind was immediately going to how do the folks working on projects there leverage AI? Kind of the the more logical approach for a company like yours, which is how do we use AI to support the business, not necessarily support the product because I would assume from a governance standpoint, there's also just a a big mess there from the uncertainty of AI tools. And to your point also, your contracts and your customers, there's probably a lot of concerns. We don't wanna be using AI tools for project work without good governance and risk analysis to know, is the information we're feeding in exfiltrating our data? There's gotta be some concerns there. But the idea that we're looking to use it to advance how we're supporting our people and how IT is being responsive and being able to do more with less or more efficiently rather is is a great way to think about it. I didn't even consider that when I asked the question, but it makes total sense to me now. I look at it as a tool because when when I started at at Mead & Hunt, there was still a percentage of people that were drafting on tables. Right. This is a classic story I share with a with a lot of people. So I was there. I'm twenty one years old, and we had four CAD machines, something like that at the company. People were working sometimes two or three shifts on CAD because it was so expensive. I'm like, we gotta buy more CAD machines and, you know, get rid of these tables. So, I mean, I came in and I was just spending money like, you know, it's ridiculous. Ridiculous. In a CAT station back then, we would get, you know, like a a three eighty six thirty three computer with a sixteen inch monitor and a fourteen inch There we go. Monitor. And it was, you know, eighteen thousand dollars. Yep. Which is just insane. And I remember the executive vice president time came up to me, and he's like, hey. I don't know what you're doing or what you think you're solving here. You're spending way too much money on CAD machines. You gotta go downstairs and bring the drafting tables back up because we can't afford to be spending all this money. And I'm like, this is the future. We can't be drawing on boards anymore. We have to have CAD everywhere in this company. We said this is this is the evolution. And, I mean, he retired three years later. I'm still here, and, you know, we didn't bring the boards back up from the basement. Right. And that's a very beneficial story because that's how I see AI. Everybody's like, it's gonna replace my job. It's gonna take away all these things for me. And I'm like, for those people that and we had people that just didn't wanna make the change. They wanna keep on drawing on the boards. And so most people left their work because they're like, I'm never gonna learn CAD. I don't wanna learn CAD. I wanna keep on drawing on the board. That's your decision. That's you can do that if you want, but it's probably not gonna last long because everybody's gonna be doing CAD, and everybody did. I mean, yeah, there's still a handful of people that will draw, but it's it's almost nonexistent now. That's how AI is gonna work too. If you don't come along for the ride, if you resist it, you're gonna be left behind just like those people that were drafting. You know, you're gonna be in that same group. And I haven't seen anything in industry that I could equate AI to is how the, you know, the drafting thing happened. That's a great analogy too. Just the idea of the three eighty six displacing the drafting table, and then you think of the three eighty six in terms of what we're using today from a horsepower too. It it's just the evolution over this short period of time is insane. Yeah. One thing I wanted to ask you about kind of moving off of AI for a second, that ties right into this, which is the idea of scaling IT out without breaking it. And nothing really leads into scaling more than talking about the pressure of maintaining costs from trying to transcend the organization from a drafting table to a three eighty six, and then you move that linearly through time. And now we're at the point where we're talking about cloud and AI and exponentially more powerful systems. So it's unique to be able to talk to somebody like you who has been at the same place from a time where people were drafting on tables to where we are today. When Mead & Hunt grows from one office to sixty, what were your first signs that the IT decisions that worked for a firm the size of the one you started in were no longer gonna hold up? And, you know, how did that evolve from a scaling standpoint? It's wild. It was it was very organic. You know? I mean, we I think we're very good at at at looking at trends and then seeing what we needed to do and then trying to figure out, like, what do you buy? Because there was there definitely was a lot more options back in the nineties and, like, what direction do you go? Right. It wasn't like it was today where it's like, well, you only have a handful options. I mean, there was just multitude of options. So weathering that storm and figuring that out was difficult. And then how we were doing with buying more offices because we wanted more geographic areas rather than, you know, one big corporate office, It definitely was difficult. It made it a lot more challenging just sharing work between them because in those early days, sharing work was just not difficult. I mean, you didn't have fiber. You didn't have those lines. I mean, you were maybe get up to, like, ten megs between an office. I mean Right. That was the best. That was the Cadillac. Yeah. That was the Cadillac. So, I mean, every day was really a struggle. You know, it sounds silly. You pack up a hard drive and you fed exit to another office to make sure could, you know, collaborate with the project. Hope it's fun when it got there. Yeah. You just hope that FedEx was reliable and you were there at eight o'clock to get the the work done. So, I mean, there's definitely more things on the cyber side that are scary and whatever. But on a true hardware side and actually transporting data around, I would rather be in today's world even with all the stuff that happens on the cyber side than going back and working in nineteen ninety five or even two thousand. It's pretty special, all those things I've really been a part of from nothing to where we are today because it it really was so basic what we started with. And and it sounds like, you know, you kinda leading having the reins. It sounds like you were really fortunate to have leadership that believed in your vision. You kinda were able to maintain sort of a if you build it, they will come strategy where you stayed ahead of advancing IT. And in turn, that allowed you guys to probably be more competitive acquisition of clients and contracts, which, you know, continue to keep you ahead of the game. So, you know, that's a great position to be in and kinda set you up to ride the wave to scale versus kinda having to claw at it necessarily. Yeah. I've I've often said that the technology part of my job has always come very, very easy. Technology has always been easy, and I was very fortunate to work for a company that taught me a lot of the other skills, the soft skills that I really didn't know that I need to have, and that was the part that my company just really built my foundation. You know, all that other stuff, I think, is important to make sure that you're a well rounded individual and that you can work with people and and get things done. And it's difficult to have that, and I'm, by far, not saying that I have the whole package, but those are things that you need to, you know, work on, not only what you're building for the company, but it's like, how are you presenting that to the company? How what are you doing for those people? Because when you bring in new technology and bring in new things, I mean, you have to be respectful, and you gotta convince people, like, this is what we need to do. You know, it's like the zero trust thing was huge. I had so many conversations, and people still said, at the end of the day, I did not sell that appropriately to people. I'm like, we have to have this because it was so personal to people. People can't live without their phones. You'll drive twenty minutes back to your house to get your phone. It's such a big part of you. So, I mean, you have to understand what's happening with whatever that person is that you're dealing with and try to make sure that you're you're gonna make things as easy for them as possible, have that ability to communicate and say, we need this technology or we need this thing because, really, the company depends on having this solution or we need to do this to make sure that we still have clients. And I think that is probably the harder part of the job than just bringing in whatever technology it is. It's it's really that other thing about the convincing your board or convincing the people. That's the hard part. You guys have the solution. I mean, it's a no brainer. I'm making a call, and I'm saying install this. Like, that's it. Like, here it is. That is the other thing that that you really help with is you you do help with that education. And I I've had problems with really, like, how do I present this information to the board? Clayton, to me, is he's very busy, so I don't wanna sell him for everybody on there. But, I mean, he was so beneficial in helping with those reports and helping sell that and then convincing people that we need that. And that's that's the other thing that you need to have. What I really appreciate is that I've never called you a vendor. You're a partner. I mean Yeah. I think there's a big distinction between that because a partner is somebody who wants to work with you. They're looking at your business like it's their business. It hurts you if something happens to us, and a lot of people don't have that. When I was first working with you Oh, I know this one. I I love this one. Yeah. The And we're going on for Christmas to Grand Caymans down there with the family, and I get a call. You know, somebody on on your team that I know calls me and say, hey, Andy. How's it going? And I'm like, going good. I'm like, what's you know, we talked a week or two ago. I said he's like, everything okay? And I'm like, yeah. You know, I I I said, I'm here with my my family. We actually just we just came to, you know, Grand Caymans. You know? And he's like, are you under any kind of distress? And I'm like, distress? I'm like, what what are you talking about, man? Like, no. I'm on vacation. I'm looking at the ocean right now. This is great. You know? He's like, so everything's fine? I was like, yeah. He's like, tell me if anything's not fine. I'm like, everything is cool, man. What's going on? He's like, well, I just have you know, what I thought was somebody's, you know, logging in to your system was getting denials trying to log in from the Grand Caymans, and he like, it threw up a red flag. And I wanted to call to make sure that somebody then was on one of your devices, that that you were okay because I was really concerned that something maybe happened to you and they maybe had your phone and they were trying to get into into your system. So I just wanna make sure you're okay if I needed to do anything to get police or whatever involved. And I'm like, I didn't tell my guys that, you know, I was going to the Grand Cayman and I was getting bounce backs. I mean, that to me was just over the top. Like, I got a phone call asking if I was okay and my family was okay. I was like, wow, this just unbelievable to have that extra level of service to make sure that something didn't happen to me. That was like the cherry on top of everything else that we had. So that was that was pretty cool. It really is a partnership. I I would never ever call you the the V word at all because it is that that partnership that we've had for five years that some of the other companies I've been dealing with now, they are looking at more partnerships. I've seen a trend. I'd say now I have more partners that I deal with now than I ever did before. I I don't have very many vendors anymore. It's it's all partnerships that I've based that on, and and that's because of what we set up together. I I'm like, this is kinda what I demand. You know? Right. This is gonna have this partnership with you. It's not just buying whatever that hardware or that software is. I wanna establish a partnership. And when somebody comes really trying very hard to sell something, I'm like, pump the brakes. Figure out what we need as a company and make sure that we're a fit rather than trying to shoehorn something in without getting to know me or know my company. If you just wanna sell me a product, I know that we are not gonna have a good relationship. Right. From our side now, the new frontier of that is we find another partner within the same customer that we need to work with that has that same mentality, and now we're all sort of peers together working on the same sheet of music, and there's no friction or concerns about crossing services over or things like that. Everybody just understands, hey. This is our piece, and this is your piece, and this is the customer's goal, and we all need to work together. You know, we're starting to see more of those opportunities and relationships. And we're getting really close here. I just wanted to ask you kind of one last, you know, go home question, if you will, which is one thing that I have always appreciated about Mead & Hunt is how strong your IT team is. There's choices you have to make when you're scaling, you know, kinda touch back on the scaling question. What leadership or hiring choices do you think made the biggest difference as you scaled the organization? You know, what builds that culture of long term retention for you? What I learned early on is you gotta have just, you know, really good people that really have the core beliefs that you have. And and, really, they gotta have a a good customer service background, I think. The very first person I ever hired is is still working for me, and and and honestly, that is one of the most proud things that I have. You know, I've been here thirty five years down. He's been here thirty three years. I have another individual who's been here for over twenty five years with me. It's that longevity. It's it's it's building those relationships, and I think it's learning customer service. So I I worked in a music store part time when I was in school, and I really learned how to have that customer relationship. You know, people would go and they buy a Guns N' Roses cassette, and they come back five days later, and and it looked like they ran it over with a car. And they're like, I wanna, you know, I wanna exchange this. You know? And I'm like, you just abused the hell out of this cassette, you know? But, know, we have take that in because that's just how our policy was. And we gave him a new tape and, you know, you tried to make things good for that customer. That's important to have that background. So I always tell people, those people I've hired that had the the customer relationship that they've come from fast food or from retail, where they really had to deal with people. Because IT, you you have to deal with people. It's not just being an expert at whatever x is. It's really a people job. And if I can teach anybody to do anything as long as you're willing to learn it, I can't teach good customer service. So in my years, sometimes I hired experts in the service that weren't good with people, and it backfired. Like, the best person at running an exchange server. That was probably, you know, some of the worst employees, you know, but they really knew exchange server or whatever it was. Give me the person who's willing to learn, who wants to work with other people. It's not all about them, it's about the team and how to make the team better, and we all grow together. But some people, it was like, I'm on an island. I'm doing my own thing, and it's hard to see that. When you interview somebody for thirty minutes, forty five minutes, it's hard to pull that out. It's hard to know how they're gonna fit into the culture for sure. And I I've learned lately or the last couple years, you know, is really getting interns and then giving interns the opportunity to become full time and then build the system. That to me, I think, is the best way to bring people on is give people a chance to prove themselves as an intern and then take them on that full journey. You know, that's kinda how my experience was. I started on a graveyard overnight shift, you know, doing backup monitoring and reporting. And, you know, over the eighteen years have just you know, they've invested in me, and I've I've tried to reciprocate and putting down those roots. So that that really resonates with me. Think trying to build that long term culture of service and, you know, you take care of them, and that's the best strategy. That's that's the group that you, you know, you hope when you go look for a position somewhere. That's what you wanna find. And, I think it's great that that's the culture that you you foster there. Well, Andy, thank you so much for the time today. I I enjoy getting to speak with you every time we connect, and I I just appreciate you being available and the kind words on the podcast and the willingness to continue to partner with us. And we just value you so much and look forward to, you know, another five years and beyond to go. So Thanks, Bush. You know, I appreciate everything that you've done for us. And I could give a plug, you know, I would and I do. I I am like, these are the guys. You don't have to look anywhere else. You can do your due diligence, but you're gonna fall in love with what you guys do. So very much appreciated. Well, thank you so much. Take care, Andy. It's been a pleasure having you. Alright. Bye. Bye. Thanks again to Andy Knoff for a great conversation and for sharing what thirty four years of doing this actually looks like. Not the polished version, but the real one. For our listeners, we'll include links to Corsica's MDR and AI consulting resources in the show notes. Today's conversation resonated with where your organization is headed. Those are great places to start. I'm Bush Williams, and this has been unraveling IT expert tech talks from Corsica Technologies. See you next time.
About Mead & Hunt
Mead & Hunt is an architecture, engineering, planning, and construction services firm serving markets nationwide. The firm has evolved dramatically over the course of CIO Andy Knauf’s career. When Andy joined Mead & Hunt in 1990 as the company’s first IT hire, the organization had one office, roughly 82 employees, and only a handful of computers. Today, Mead & Hunt operates as a national firm with a distributed office footprint and a technology environment built to support complex, high-trust work.
That growth has required more than everyday IT support. As Mead & Hunt expanded, the firm needed technology systems that could keep people productive, support collaboration across offices, protect sensitive project data, and meet the increasing expectations of clients and federal agencies. Cybersecurity became a central part of that mission.
The Challenge:
Scaling Cybersecurity for a Distributed, High-Trust Firm
For Mead & Hunt, cybersecurity is not only about preventing ransomware. It is about protecting the intellectual property, project data, and client trust at the center of the firm’s work. As Andy explained in the podcast conversation, many peer organizations have experienced ransomware attacks or serious security events. Mead & Hunt wanted to stay ahead of those risks rather than react after an incident.
The question was how to do that effectively. Hiring a single internal security leader would have provided valuable expertise, but it would not have delivered around-the-clock coverage. Cyber threats do not happen only between 8 a.m. and 5 p.m., and Mead & Hunt needed a model that could provide consistent monitoring, strategic guidance, and depth of expertise without forcing the internal IT team to build a full security operations center from scratch.
At the same time, the firm’s industry was facing rising compliance expectations. For organizations performing federal or Department of Defense work, CMMC and related NIST requirements make cybersecurity controls increasingly important. Mead & Hunt needed a security program that could support resilience, client confidence, and the ability to prove that the right protections were in place.
The Solution:
24/7 MDR Backed by Education, Strategy, and Partnership
Mead & Hunt partnered with Corsica Technologies to strengthen its cybersecurity program through managed detection and response, ongoing security reviews, and practical guidance across the Microsoft security stack. The relationship began in 2021 and has continued ever since.
What made the partnership different was not only the technology but the education and strategic collaboration that came with it.
“Partnering with Corsica Technologies was honestly one of the better decisions that we ever made. It wasn’t only the thing that got put in place; it was also the education that went on top of it.”
Corsica worked with Mead & Hunt as an extension of the company’s IT team, helping the firm understand not just what needed to change, but why those changes mattered. Regular MDR reviews gave Mead & Hunt visibility into trends, incidents, and risk patterns. These reports helped Andy make decisions, brief leadership, and identify where additional education or control improvements were needed.
The partnership supported progress across several security priorities, including:
Security Priority | How Corsica Helped |
24/7 security visibility | Provided around-the-clock MDR coverage and alert review beyond what a single internal hire could realistically deliver. |
Leadership reporting | Delivered reports and trend data that helped Mead & Hunt brief executives and board-level stakeholders on cyber risk. |
Zero trust adoption | Guided Mead & Hunt through zero trust implementation across desktops and mobile devices, including difficult change-management conversations. |
Endpoint and mobile protection | Helped strengthen protection across devices using Microsoft-aligned controls, Intune, and endpoint security practices. |
Phishing and user education | Used MDR trends and reporting insights to inform education efforts and break risky user habits. |
CMMC-aligned maturity | Supported the controls, visibility, and documentation mindset required as federal-work cybersecurity expectations continue to mature. |
Corsica’s role was especially valuable when security improvements required employee adoption. Zero trust on mobile devices, for example, created user concerns because many employees used personal phones. Corsica helped reinforce the importance of extending protection across the full environment, not just the easiest endpoints to secure.
Results:
Visibility, Resilience, and a Partnership That Goes Beyond Monitoring
Long-Term Partnership
Going strong since 2021
24/7/365
Continuous MDR coverage and security support
65 Offices
A distributed firm protected across a national footprint
1 Partner
Corsica operates as a true extension of Mead & Hunt’s IT team
The Corsica partnership has helped Mead & Hunt mature its cybersecurity program while giving the internal IT team better visibility, better reporting, and stronger confidence in its defenses. Here’s what those results look like in detail.
- Continuous security improvement: Rather than treating MDR as a tool that gets installed and left alone, Mead & Hunt uses Corsica’s reviews and recommendations as part of an ongoing improvement rhythm.
- Improved executive visibility: MDR reports give Mead & Hunt a clear view into what is happening in the environment, what trends are emerging, and where the organization should focus next. This visibility helps Andy communicate cyber risk to board members and other leaders in practical business terms.
- Stronger security maturity: Corsica’s recommendations helped Mead & Hunt continue advancing zero trust, endpoint protection, mobile-device controls, phishing education, and Microsoft security capabilities. The relationship has helped the firm close gaps that could otherwise create risk across a distributed organization.
- Better support for compliance-driven work: Mead & Hunt’s clients increasingly expect evidence that sensitive work and data are protected. Corsica’s guidance, reporting, and control recommendations support the firm’s ability to respond to those expectations with confidence.
- A true partnership model: Andy repeatedly described Corsica as a partner rather than a vendor. That distinction matters. Corsica does not simply sell security services; the team works alongside Mead & Hunt to understand risk, communicate priorities, and maintain forward momentum.
One story captured that partnership clearly. While Andy was vacationing in the Grand Caymans, Corsica detected unusual login activity associated with his account. Instead of treating the alert as a routine technical event, the team called Andy to make sure he was safe and that his device had not been stolen. The alert turned out to be explainable, but the response showed Andy that Corsica was watching out for more than systems.
“I got a phone call asking if I was okay—if my family was okay. That was the cherry on top of everything else that we had.”
—Andy Knauf, Chief Information Officer, Mead & Hunt
The Future:
Cyber Resilience as a Foundation for Practical Innovation
Mead & Hunt has always moved forward with technology. The firm adopted CAD early, built cloud capabilities before remote work became common, and continues to explore practical uses for AI and automation. For Andy, the goal is not to chase trends for their own sake, but to use technology to help the organization do more, respond faster, and remain resilient.
That same mindset applies to cybersecurity. Resilience is not one project, one platform, or one audit. It is an ongoing practice that combines technology, visibility, education, process, and trust. As Mead & Hunt continues to grow, serve clients, and navigate evolving cybersecurity and compliance expectations, Corsica remains a strategic partner in helping the firm keep moving securely.
For Mead & Hunt, that partnership has become a standard for what technology relationships should look like: collaborative, informed, proactive, and invested in the client’s success.
“I’ve never called you a vendor. You’re a partner.”
—Andy Knauf, Chief Information Officer, Mead & Hunt

