The Thinking Schools Academy Trust (TSAT) runs 26 primary and secondary academies across the south of England. Over four delivery phases, we standardised every site on HPE Aruba infrastructure, managed through a single Aruba Central instance and secured with ClearPass, cutting helpdesk demand and saving an estimated £20,000 a year in electricity.
TSAT is a Multi-Academy Trust (MAT) of 26 primary and secondary academies, educating around 16,000 pupils and employing approximately 2,000 staff. Its schools sit across several regional hubs in the south of England, including Medway, Kent, Portsmouth, Plymouth, Torbay and Essex.
As the trust has grown, schools have joined carrying inherited and ageing network hardware built to different standards. The trust set out to standardise its estate on a single platform, meet the Department for Education (DfE) wireless connectivity standards, and strengthen network security and segmentation across every site.
TSAT runs a technically mature in-house IT team. We have worked alongside that team across successive infrastructure programmes, engaging at a technical level on network and Wi-Fi design, ClearPass policy configuration, and access control list (ACL) based network security, rather than simply delivering to a fixed specification.
"Their engineers understand what a technically mature trust requires and have worked collaboratively with us rather than simply delivering to a specification."
Trust IT Leadership, TSAT (draft, pending approval)A trust that grows by adoption inherits the infrastructure decisions of every school it takes on. TSAT needed to bring 26 sites onto a common standard, satisfy DfE connectivity requirements, and lock the network down, all while keeping a large and dispersed estate manageable from the centre.
New academies arrived with non-standard, often ageing network kit. Without a common platform, each site carried its own configuration, its own support burden, and its own risk profile.
The trust needed Wi-Fi that met the DfE connectivity standards and qualified under the Connect the Classroom (CTC) programme, with funded sites delivered to specification and on time.
A flat or loosely segmented network is hard to defend. The trust wanted port-based authentication and role-based access, with ACLs limiting what any device or user can reach.
Managing 26 separate networks site by site does not scale. The trust needed a single view of the estate, with consistent policy and the ability to act centrally rather than school by school.
"The solutions deployed have strengthened our security posture, improved network segmentation, and given us a more manageable and resilient infrastructure across our academies."
Trust IT Leadership, TSAT (draft, pending approval)We delivered the programme in four phases over successive funding rounds and trust expansions. Project management shifted between the trust's in-house team and Medhurst as each phase required, with Medhurst leading the network access control and security workstreams.
Aruba access points and switching supplied as part of the DfE Connect the Classroom programme. Project managed by TSAT's in-house IT team, with Medhurst supplying to specification.
As schools joined the trust, we supplied APs and switches, then designed and deployed ClearPass, configuring user roles and applying ACLs for port-based authentication to lock the network down. Medhurst project managed the ClearPass workstream.
Additional Aruba access points and switching delivered under a later Connect the Classroom round. Medhurst project managed this phase end to end.
Supply of switches and access points to replace ageing, unsupported hardware across the estate, bringing remaining sites onto the common Aruba standard and back into support.
Working to a tight window: Phase 2 carried a short timeframe for supply and setup of the APs and switches, and an equally short window to implement ClearPass with port-based authentication and role-based ACLs. We prestaged ClearPass in advance to reduce the number of changes needed during the AP and switch installation window, protecting the live school environment.
Why the HPE Aruba partnership mattered: Our partner status supported competitive pricing against other resellers. More importantly, our stock position at the time of Phase 1 meant we could supply all the kit required when other partners were affected by supply chain delays. Our status as Aruba Design Experts, and engineers accredited across multiple Aruba examinations, gave the trust assurance on the design and the delivery.
Each phase was scoped around funding rounds, new academy onboarding, and the need to keep schools running. Installation windows were kept tight and prestaged wherever possible.
Aruba access points and switching delivered under the DfE Connect the Classroom programme. Project managed by the trust, supplied to specification by Medhurst, with stock available when other partners faced delays.
APs and switches supplied for incoming academies. Medhurst designed and deployed ClearPass, configured user roles, and applied ACLs for port-based authentication. ClearPass was prestaged to compress the on-site install window.
A later CTC round added more Aruba APs and switching across the estate. Medhurst project managed this phase end to end.
Supply of switches and access points to replace end-of-life kit, bringing the remaining sites onto the common Aruba standard and back into vendor support.
A large Smoothwall programme is now scoped as the next phase, extending the partnership into web filtering and safeguarding across the trust.
Standardising on Aruba and managing the estate centrally changed day-to-day operations for the trust's IT team. The clearest gains are in support demand, engineer time, energy cost, and security.
Helpdesk requests for devices not working after being moved between rooms are no longer happening. Consistent configuration across sites means a device works wherever it is plugged in.
Aruba Central lets the trust power down devices overnight and through the holidays, with an estimated saving of around £20,000 a year in reduced electricity consumption.
1,402 access points and 610 switches across 26 schools are managed from one Aruba Central instance, so policy is consistent and the team can act centrally rather than site by site.
Standardisation and central management have reduced the time engineers spend resolving raised issues, freeing capacity for proactive work rather than repeat fixes.
Stronger security posture: ClearPass network access control, role-based policy, and ACL-based segmentation have tightened what any device or user can reach on the network, delivered in partnership with HPE Aruba.
The relationship spans multiple infrastructure programmes and continues into safeguarding and filtering. The trust's reflection on the work to date is below.
"Medhurst Communications have proven themselves a capable and technically credible partner across a wide range of infrastructure programmes at TSAT. Unlike many suppliers, they have been able to engage meaningfully with our in-house IT team at a technical level, from network and Wi-Fi design through to ClearPass policy configuration and ACL-based network security. Their engineers understand what a technically mature trust requires and have worked collaboratively with us rather than simply delivering to a specification. The solutions deployed have strengthened our security posture, improved network segmentation, and given us a more manageable and resilient infrastructure across our academies. We value the relationship with Medhurst and look forward to continuing to work with them on future phases."
Trust IT Leadership, The Thinking Schools Academy Trust Draft, pending approvalWe continue to support the trust as required across the standardised estate. The next phase is a large Smoothwall programme, extending the partnership from network and security into web filtering and safeguarding. Our aim with TSAT is consistent: a manageable, resilient, and secure network that lets the trust focus on teaching and learning.
We work with schools, colleges, and Multi-Academy Trusts across England to design, deliver, and manage HPE Aruba networks, standardise estates, and strengthen security. Speak with our experts about your connectivity and infrastructure plans.
