We built AI network security for a global resort chain. It learns how devices normally behave on guest Wi-Fi and isolates suspicious ones automatically. It neutralised 99.9% of threats and detected them 2.5x faster.
Client: Guardian CatalogsIndustry: HospitalityService: Cloud & DevOps
Overview
Client
Guardian Catalogs
Global resort chain with 25 properties
Engagement snapshot
The challenge
The resort Wi-Fi relied on older packet filtering. It could not tell a guest streaming a film from an attacker sniffing traffic or running a man-in-the-middle (MITM) attack.
Once a device passed the captive portal, the firewall stopped looking at it. Alerts needed someone on site to step in, so any response took hours.
An insecure guest device could give attackers a route into the resort's PMS and payment systems.
Unencrypted session data on shared Wi-Fi left guest logins and financial details open to hijacking.
Security audits were manual and monthly, so a persistent threat could go unnoticed for 30 days.
The solution
We placed small edge sensors across 25 properties. They read live network traffic patterns without ever opening the content guests send.
AI models build a behaviour baseline for every connection and flag MAC address spoofing and unauthorised network scanning.
The AI is linked to the network controllers, so a malicious device is cut off straight away and every action is written to a traceable event log.
Key features
AI learns each guest connection's normal traffic and flags spoofed devices, scanning and data theft.
Business impact
2.5x faster detection
Suspicious devices are isolated in under a second, and every blocked threat is logged.
Business impact
99.9% of threats neutralised
The system watches behaviour patterns without inspecting personal information or private guest data, in line with strict GDPR rules.
Business impact
100% data residency control
Each blocked threat is logged with the behaviour that triggered it, giving the board clear evidence of how the network is protected.
Business impact
Audit-ready security
The edge sensors rotate their own security certificates and apply patches without taking any property offline.
Business impact
Zero downtime
Before and after
Before
Static firewall
Could not see threats moving inside the network once a device passed the captive portal.
After
Behaviour monitoring
Every session is watched for signs such as impossible travel and data being copied out.
Before
Basic VLANs
Simple VLAN tagging that a skilled attacker could get around.
After
One device, one segment
Automatic micro-segmentation treats every guest device as its own isolated network.
Before
Manual triage
Security alerts waited for on-site IT staff, delaying the response by hours.
After
Automatic shutdown
AI spots and isolates a threat in moments, before it can spread to other properties.
Results
99.9% Risk Reduction
Where the old setup could only react after the fact, automated detection now blocks 99.9% of unauthorised scanning and MITM attempts.
Before: ReactiveAfter: 99.9% Neutralised
2.5x Faster Response
Threats are now detected at the network edge in under a second.
Before: SlowAfter: Sub-Second
2ms p95 Overhead
Because checks run at the edge, the security layer adds just 2ms to guest Wi-Fi traffic at p95.
Before: < 5msAfter: 2ms
Testimonial
“Coretus helped us detect threats on our guest network 2.5x faster across all 25 properties. Suspicious devices are isolated in under a second, 99.9% of threats are neutralised, and Wi-Fi overhead is only 2ms.”
Paul PetersonDirector of Information Security, Guardian CatalogsKey results
Trust and control
Data is filtered at the edge, so plain-text guest names and room numbers are never stored in the cloud.
GDPR-alignedEach decision carries an automatic reason code and forensic log, which supports PCI DSS and SOC 2 requirements.
Audit trailThe cloud-managed setup lets the team roll out security updates safely, even when resorts are full.
Scales with demandThe client owns 100% of the IP in the security models and property-wide automation logic.
100% ownedFaster delivery
With these pieces already tested, the project saved about 9 weeks of setup and put the time into the AI models and resort network rules.
Gave the team tested logic for profiling connected devices, which we tuned for busy resort networks.
Ran and updated the sensors at all 25 properties from one place.
Linked each device to its network session without storing guest names or room numbers in the cloud.
Measured the delay the security layer added to guest Wi-Fi, so the team could keep it to about 2ms.
The Wi-Fi relied on older packet filtering that could not tell heavy streaming from packet sniffing or man-in-the-middle attacks. An insecure guest device could give attackers a path into the PMS and payment systems, and manual monthly audits let threats go unnoticed for up to 30 days.
Edge sensors at 25 properties read network traffic patterns, never the content guests send. AI learns normal behaviour for each connection and flags MAC spoofing or scanning. Network controllers then isolate a suspicious device in under a second, and the whole layer adds only 2ms of delay at p95.
The system tracks behaviour patterns without inspecting personal information or private guest data, in line with GDPR. Data is filtered at the edge, so no plain-text guest names or room numbers are stored in the cloud. Each guest device also sits on its own isolated network segment.
If your guest Wi-Fi relies on a perimeter firewall alone, we can help you add device-level monitoring that isolates threats without slowing guests down.