A catalog of representative engagements from across the three practices. The shape, the duration, the numbers, and the deliverables are honest. The clients are anonymised — and that is a deliberate choice, not a limitation.
We do not claim what we cannot prove.
Every case study below is a composite drawn from real engagements — not a fabrication, not a named client.
The shape of the work, the deliverables, the numbers, and the artefacts are taken from actual Karakor engagements with details anonymised so a reader cannot identify the client. Where a finding, scope item, or report excerpt appears in quotes, it is paraphrased from a real document we shipped. Where a number appears in the results panel, it is honest — something we could defend if you asked us about it.
When a prospective client asks for a reference, we connect them directly with a past client who has given permission. Most of our clients are reachable by phone within a week. Publishing the names here would not change that, and would make every engagement we sign harder to defend.
- CYBERSECURITY · ASSESSMENTSix weeks
A written security posture before procurement asked
A six-week NIST CSF-scoped assessment for a mid-market services firm fielding enterprise security questionnaires faster than its IT lead could answer them.
Professional services firm, ~600 employees, multi-office, US.187 → 4 hrsTime to answer a 187-question enterprise questionnaire after handoff36 ppBound posture document, referenced for every subsequent questionnaire8 → 3Remediation items closed in-house within the first quarter after handoffRead - SOFTWARE · PRIVATE AIFour months
A private-AI deployment a partner can defend
A four-month build for a healthcare-adjacent organisation: on-premises model deployment with matter-aware retrieval, audit logging, and a runbook the in-house IT lead operates unattended.
Healthcare-adjacent research operation, ~400 employees, US, HIPAA scope.0Bytes of clinical-trial data that left the organisation's network boundary23Queries the model refused — the system declining when the source was missing, working as designed4 monthsDiscovery to operator handoff, weekly written updates throughoutRead - LEGAL TECHNOLOGY · DMS & GOVERNANCEEight weeks
A DMS configuration a managing partner can defend
An eight-week document architecture review for a mid-size litigation firm: ethical-wall enforcement, retention defaults, and audit-trail design — replacing a configuration inherited from a managed-service provider.
Litigation firm, ~95 attorneys, two offices, US. Mixed practice — commercial and IP.48Matters reviewed for ethical-wall configuration during the assessment sample2Specific matters incorrectly accessible to the wrong attorney — remediated in-engagement12 → 4Seats with audit-trail access, after the redesignRead - CYBERSECURITY · INCIDENT READINESSFour weeks
An incident response plan tested before it was needed
A four-week incident-readiness engagement for a mid-market financial services firm: detection coverage analysis, three scenario-driven tabletops, and a communications playbook rewritten by people who would have to use it.
Mid-market financial services firm, ~800 employees, three offices, US.60 → 16 ppPlan length, after the rewrite — readable instead of comprehensive3Tabletop scenarios run with the full leadership team in the room2Wire-transfer authority assumptions surfaced as incorrect during the BEC scenarioRead - SOFTWARE · INTERNAL TOOLINGFive months
A greenfield internal platform that shipped on time
A five-month build for a regional healthcare-services firm: replacing a sprawl of spreadsheets and a deprecated vendor tool with an internal operations platform the firm's engineering team now owns end-to-end.
Regional healthcare-services firm, ~250 employees, two markets, US.5 monthsDiscovery to production, with weekly written updates throughout2Feature additions the in-house team has shipped since handoff, without Karakor0 bytesPatient-identifying data that left the firm's network boundary during or after the buildRead
We respond within two business days. Scoping calls are obligation-free and run thirty minutes.
