Case Study / Software & Artificial Intelligence
Alegion
Projects delivered in the first 12 months
Employees supported with zero in-house IT staff
Type II compliance achieved
Prepared by TechProComp Managed IT | Austin, Texas
Executive Summary
Alegion is an Austin-based software company building AI-driven systems for enterprise customers. By the time TechProComp was engaged, the company had grown to 110 employees – without ever having built an internal IT department.
That is not unusual for a fast-scaling software company. Engineering teams are technical, cloud tooling is self-service, and IT is assumed to take care of itself. It does, until the business reaches the point where enterprise customers begin asking harder questions.
Systems had been assembled as they were needed rather than designed. Identity, device management, network, backup, and access control had grown organically across teams. Onboarding and offboarding were handled informally. There was no asset inventory, no documented process, no patching standard, and no single owner of security. Day-to-day support fell to whoever was available – usually senior engineers whose time was worth considerably more elsewhere.
At the same time, Alegion’s enterprise pipeline began requiring SOC 2 Type II attestation as a condition of doing business. A company that handles customer data to train and operate AI systems cannot answer a security questionnaire with good intentions. It needs controls, evidence, and a system of record.
TechProComp took on the entire IT function: infrastructure, network, cybersecurity, compliance, and day-to-day support. Over 12 months we delivered 52 projects, established the IT foundation from the ground up, and guided Alegion through SOC 2 Type II – building the operating processes the company will run on for years.
At a Glance
Client
Alegion
Industry
Software / Artificial Intelligence
Location
Austin, Texas
Engagement
Full managed IT, systems and network infrastructure, cybersecurity, SOC 2 Type II compliance, day-to-day support
Primary Goal
Build a real IT and security function fast enough to satisfy enterprise buyers - without slowing product development
Outcome
A documented, secure, audited technology foundation supporting 110 employees and a compliance posture that unlocks enterprise sales
Scaled to 110 People. Never Built IT.
Alegion had the technical talent to build sophisticated AI systems. What it did not have was anyone whose job was to own the technology the business itself ran on.
No IT Function
No dedicated IT staff, no help desk, and no defined owner for systems, security, or vendor management.
Unmanaged Endpoints
Laptops were purchased ad hoc across teams with no standard image, no inventory, no patch policy, and no enforced encryption.
Fragmented Identity and Access
Accounts and permissions accumulated over time. Offboarding was inconsistent, and no one could produce a full picture of who had access to what.
No Documented Process
Onboarding, offboarding, provisioning, and escalation lived in people’s heads. Nothing was written down, so nothing was repeatable.
Support by Interruption
Technical problems were solved by pulling engineers off product work - expensive, inconsistent, and invisible in any budget.
Compliance Gap
Enterprise prospects were asking for SOC 2 Type II. Alegion had no control framework, no evidence collection, and no policy set to point to.
Core Problem
The company had built a sophisticated AI product on top of an IT environment nobody owned. Growth had outrun the foundation - and the sales pipeline was about to expose it.
Compliance Became the Forcing Function
SOC 2 was not a security project. It was a revenue requirement.
Enterprise buyers evaluating an AI vendor are not only evaluating the model. They are evaluating how the vendor handles their data - where it lives, who can reach it, how access is revoked, how incidents are detected, and whether any of it can be proven.
For Alegion, SOC 2 Type II moved from "something we should do eventually" to a gate on deals already in the pipeline. Type II is materially harder than Type I: it requires controls to operate consistently over an observation window, which means the underlying IT function has to actually exist and actually work.
That reframed the whole engagement. You cannot audit processes that were never built. Before Alegion could pass an audit, it needed the infrastructure, the controls, and the documented operations that an audit measures.
The New Requirements
A managed, inventoried, and secured endpoint fleet
Centralized identity with enforced MFA and least-privilege access
Documented onboarding, offboarding, and change processes
Layered security controls with monitoring and evidence collection
Backup, recovery, and business continuity capability
A responsive support function that keeps engineers on product work
SOC 2 Type II readiness, remediation, and audit support
Threat Context
63%
of breached organizations studied lacked governance policies to manage AI or prevent shadow AI - a direct risk for companies whose product and operations both depend on AI systems.
Source: IBM Cost of a Data Breach Report, 2025.
Twelve Months. Fifty-Two Projects.
TechProComp’s methodology begins with full assessment and scanning, then converts findings into a quarter-by-quarter project plan reviewed with leadership at the end of every quarter. Alegion’s first year was the most dynamic phase – the most critical projects are always scheduled first.
-
1
Assessment and Stabilization
Complete discovery of systems, network, endpoints, identity, SaaS, and vendors. Full security and vulnerability scanning. Asset inventory built from zero. Immediate risks stabilized while the roadmap was drafted.
-
2
Foundation Build
Centralized identity and MFA, endpoint management and standard imaging, network and wireless remediation, backup and recovery, and a functioning help desk with defined response targets.
-
3
Security Layering
Deployment of TechProComp’s 12-layer security framework: EDR, application control, DNS and email protection, SIEM monitoring, privileged access management, vulnerability management, and security awareness training.
-
4
SOC 2 Readiness
Gap assessment against the Trust Services Criteria, policy authoring, control implementation, evidence automation, vendor risk review, and remediation of open findings ahead of the observation window.
-
5
Audit and Attestation
Observation period supported with continuous evidence collection and monitoring. Auditor requests handled by TechProComp. SOC 2 Type II achieved.
-
6
Today - Operate and Improve
Quarterly Business Reviews with leadership, rolling three-year roadmap, continuous compliance maintenance, and AI-enablement planning.
Solution Delivered
Building the IT Function From Zero
There was no existing environment to modernize. The work was to design and stand up a complete IT operation while 110 people kept working through it.
01 / Discovery and Asset Control
Establish what actually exists
- Full inventory of endpoints, servers, cloud, and SaaS
- Vendor and license consolidation
- Lifecycle and replacement planning
- Baseline configuration standards
02 / Identity and Access
One source of truth for who can do what
- Centralized identity and single sign-on
- MFA enforced across business systems
- Least-privilege role design
- Documented joiner / mover / leaver process
03 / Endpoint and Network
A managed, consistent fleet
- Standard device imaging and enrollment
- Automated patch and update management
- Full-disk encryption enforced
- Network, firewall, and wireless remediation
04 / Continuity and Support
Operations people can rely on
- Backup and disaster recovery implementation
- Documented recovery priorities and testing
- Help desk with defined response targets
- Engineers returned to product work
Foundation
For a software company, IT is not overhead. It is the operating layer that determines how fast people can work, how quickly new hires become productive, and whether the business can answer a customer’s security questionnaire without stalling a deal.
Security and Compliance Built Together
Security controls and audit evidence were designed as one system. Controls that cannot be evidenced do not pass an audit, and evidence without real controls does not protect the business.
01 / Layered Protection
Defense in depth
- Endpoint detection and response
- Application control and allowlisting
- DNS, web, and email filtering
- Ransomware protection
02 / Monitoring and Detection
Visibility across the environment
- SIEM log collection and correlation
- Alerting and investigation workflow
- Vulnerability management program
- Periodic penetration testing
03 / Governance and Policy
Written, approved, enforced
- Full information security policy set
- Access review and change management
- Incident response and BCDR plans
- Vendor and third-party risk assessment
04 / Audit Execution
Attestation without derailing the business
- Trust Services Criteria gap assessment
- Control implementation and remediation
- Continuous evidence collection
- Auditor liaison through the observation window
Security Philosophy
Compliance is the byproduct of an environment that is genuinely well run. We build the controls first and let the evidence follow – not the other way around.
The Audit That Opened the Pipeline
SOC 2 Type II
Achieved
Alegion completed SOC 2 Type II attestation within the first year of the engagement, having started with no control framework, no policy set, and no IT function.
Sales Unblocked
Security questionnaires and vendor reviews stopped being deal-stalling events. The company could answer with a report instead of a promise.
Proof, Not Posture
Type II demonstrates that controls operated consistently over time – a materially stronger signal to enterprise buyers than a point-in-time assessment.
Built to Stay Compliant
Evidence collection and control monitoring run continuously, so the next observation period is maintenance rather than another scramble.
From Cost Center to Credential
The IT investment became a commercial asset – something the sales team leads with rather than something the company hopes nobody asks about.
Engagement details are summarized for case-study purposes and should be reviewed with the client before external publication.
Before TechProComp vs. After
| Area | Before TechProComp | After TechProComp |
|---|---|---|
| IT Ownership | No IT department; support handled informally by engineers and whoever was available. | Full managed IT function with defined ownership, help desk, escalation, and quarterly leadership reviews. |
| Asset Management | No inventory, no standard build, no lifecycle or replacement planning. | Complete asset inventory, standard imaging, automated patching, and budgeted hardware lifecycle. |
| Identity & Access | Fragmented accounts, inconsistent offboarding, no reliable view of permissions. | Centralized identity, enforced MFA, least-privilege roles, and documented access reviews. |
| Cybersecurity | Basic endpoint protection with no monitoring, detection, or vulnerability management. | 12-layer security framework with EDR, application control, SIEM monitoring, and vulnerability management. |
| Backup / DR | No verified backup strategy or tested recovery capability. | Implemented backup and disaster recovery with documented priorities and regular testing. |
| Process & Documentation | Undocumented, informal, and dependent on individual knowledge. | Documented onboarding, offboarding, change, and incident processes the company can operate at scale. |
| Compliance | No control framework; enterprise security reviews stalled deals. | SOC 2 Type II attestation achieved with continuous evidence collection and control monitoring. |
| Growth Readiness | IT was a constraint on hiring speed, sales cycles, and engineering focus. | A documented, secure foundation designed to support the next stage of growth. |
IT Ownership
- Before TechProComp
- No IT department; support handled informally by engineers and whoever was available.
- After TechProComp
- Full managed IT function with defined ownership, help desk, escalation, and quarterly leadership reviews.
Asset Management
- Before TechProComp
- No inventory, no standard build, no lifecycle or replacement planning.
- After TechProComp
- Complete asset inventory, standard imaging, automated patching, and budgeted hardware lifecycle.
Identity & Access
- Before TechProComp
- Fragmented accounts, inconsistent offboarding, no reliable view of permissions.
- After TechProComp
- Centralized identity, enforced MFA, least-privilege roles, and documented access reviews.
Cybersecurity
- Before TechProComp
- Basic endpoint protection with no monitoring, detection, or vulnerability management.
- After TechProComp
- 12-layer security framework with EDR, application control, SIEM monitoring, and vulnerability management.
Backup / DR
- Before TechProComp
- No verified backup strategy or tested recovery capability.
- After TechProComp
- Implemented backup and disaster recovery with documented priorities and regular testing.
Process & Documentation
- Before TechProComp
- Undocumented, informal, and dependent on individual knowledge.
- After TechProComp
- Documented onboarding, offboarding, change, and incident processes the company can operate at scale.
Compliance
- Before TechProComp
- No control framework; enterprise security reviews stalled deals.
- After TechProComp
- SOC 2 Type II attestation achieved with continuous evidence collection and control monitoring.
Growth Readiness
- Before TechProComp
- IT was a constraint on hiring speed, sales cycles, and engineering focus.
- After TechProComp
- A documented, secure foundation designed to support the next stage of growth.
What Alegion Gained
A Real IT Function: A complete IT operation - infrastructure, security, support, and vendor management - without hiring, managing, or budgeting for an internal department.
Enterprise Credibility: SOC 2 Type II attestation that removes security review as an obstacle in the enterprise sales cycle.
Engineering Focus Restored: Day-to-day support moved off senior engineers and onto a dedicated help desk, returning expensive technical time to product work.
Processes That Scale: Documented, repeatable operations that hold up as headcount grows - the foundation for everything the company builds next.
AI-Enabled Operations and What Comes Next
Alegion builds AI systems. The natural next step is applying the same capability internally – securely.
With the foundation and compliance posture in place, TechProComp is positioned to help Alegion govern AI use across the business: managing shadow AI risk, defining acceptable-use and data-handling standards, extending access controls to AI tooling, and automating internal workflows without reopening the security and compliance gaps that were just closed.
The TechProComp Difference
Alegion did not need a vendor to patch servers. The company needed a partner willing to own the entire technology function – build it, secure it, document it, and stand behind it through an audit – while 110 people kept shipping product. That is the difference between IT support and an IT foundation.
Transformation Delivered
- Complete IT function established from zero
- 52 projects delivered in 12 months
- Full asset inventory and lifecycle program built
- Centralized identity with MFA enforced
- Standard endpoint imaging and management deployed
- Network, firewall, and wireless remediated
- Backup and disaster recovery implemented
- 12-layer security framework deployed
- SIEM monitoring and vulnerability management introduced
- Security awareness training program launched
- Full information security policy set authored
- Onboarding and offboarding processes documented
- Vendor and third-party risk program established
- SOC 2 Type II attestation achieved
- Quarterly Business Review cadence established with leadership
