AAA Northeast Replaced Progress WS_FTP Without a Big-Bang Cutover

AAA Northeast is a not-for-profit motor club, more than a century old, serving members across the Northeastern United States. Roadside assistance is the visible part. Behind it sits an operation that also runs an insurance agency, a mortgage and lending business, a full-service travel agency, and driver training.

Every one of those lines of business trades files with outside parties. Mortgage and loan applications move to banks and credit unions. Payroll and HR feeds flow from the company's Workday system to banks and downstream processors. Insurance data, membership payments and refunds, and marketing lists move in and out daily, and nearly all of it carries members' personal data. For roughly eighteen years, nearly all of that exchange passed through a single on-premises Progress WS_FTP server. Any replacement had to clear the security bar the old server could not while looking, to every counterparty and automated process, almost exactly like the server it replaced.

One Server, One Engineer, Eighteen Years

The server had accumulated roughly 200 accounts: external vendors, internal staff, and the system accounts behind automated jobs. One IT network security engineer, Daniel Manley, had owned it essentially single-handedly for that entire time. By the company's own security standards, it had fallen badly behind.

The most basic problem was what happened to a file once it landed. The server's disk was not encrypted. A mortgage application or an HR file sat on that Windows server in the clear unless the sender had remembered to PGP-encrypt it at their own desk before uploading. Protection at rest was not a property of the system. It was a habit some people had.

Identity was no better. The web interface supported only usernames and passwords, with no connection to the company's directory. Vendor accounts were shared between the vendor and the internal staff member who worked with them, leaving both parties to log in with the same credentials.

There was also no way to audit access. Permissions lived in shared virtual folders, and answering the question “what can this person reach?” meant opening folders one at a time:

“You have to actually go into the folder and see who has access to it.”

The company's retention policy called for sensitive files to be deleted within days; nothing on the server enforced it. Accounts and their purposes were tracked in a spreadsheet on the side. The CISO put the reason for replacing the system plainly:

“It's really us not being satisfied with the level of security that the current solution offers.”

Too Load-Bearing to Rip Out

None of this was news to anyone. The server survived because everything pointed at it. Scheduled jobs pushed payroll files to banks. Scripts watched for new-hire and termination lists and used them to update Active Directory, so a missed file meant a new employee without accounts. Dozens of external organizations, from national banks to small credit unions and marketing platforms, connected with their own scripts, their own clients, and their own change-control windows. And because the legacy server had no directory integration and its credentials could not be exported, every account on it would have to be rebuilt by hand on whatever came next. A big-bang cutover would have bet dozens of production jobs, at dozens of companies, on one weekend going perfectly.

AAA Northeast selected Files.com to meet both sides of the specification. It provided single sign-on for employees, SSH keys for machine connections, encryption at rest, retention the platform enforces, and a way to look at any user and see exactly what they can reach. It could also preserve the workflows already built around the legacy server.

A Cutover Built Around a Hostname Change

The work started with a catalog, not a migration. Manley sat down with each process owner and documented every connection on the old server: who was on the other end, which direction files flowed, what they contained, how often they moved, how the connection authenticated, and which folders it touched. The catalog identified 73 user and service accounts that had to be rebuilt, and it became the migration plan.

The design principle was that nothing visible would change. Usernames, filenames, directory structures, and folder permissions were carried onto Files.com exactly as they were, so an existing client or scheduled job needed two updates: the hostname and a fresh credential. The old server stayed live throughout, and partners cut over in batches on their own schedules, updating allow-lists and host keys ahead of their move. The first external partner was live-tested end to end before the batches followed.

Because every account had to be rebuilt anyway, AAA Northeast rebuilt them properly. Internal staff came in through Microsoft Entra ID single sign-on with SCIM provisioning, so the directory now creates and removes their file access and nobody administers employee accounts by hand. External organizations were onboarded as Files.com Partners, each in its own walled-off folder and invisible to every other partner. Vendors authenticate with their own SSH keys; a password with MFA exists only where a vendor genuinely needs the web interface.

Underneath, Files.com supplied what the old server never could. Every file is encrypted at rest regardless of what the sender did. A seven-day retention policy deletes files automatically. Authentication and file activity stream from Files.com into the security team's Rapid7 SIEM, and the whole estate runs behind AAA Northeast's own domain with certificates that renew themselves.

Shared Credentials Gone, Encryption by Default

With the cutover complete and the WS_FTP server retired, AAA Northeast replaced a security model that ran on habit and memory with one the platform enforces.

• Within the migration scope, roughly 65 external vendor accounts authenticate with their own SSH keys inside their own partner spaces. The shared logins that internal staff and vendors both used for years are gone, and every action traces to one party.
• Sensitive files are encrypted at rest by default, so protection no longer depends on someone remembering client-side PGP before an upload.
• Retention happens at seven days because the platform enforces it, turning a policy that existed on paper into something that applies to every file automatically.
• An administrator can look at any user and see what they can reach, instead of opening folders one by one to reconstruct it. The spreadsheet that tracked accounts and their purposes is gone; the platform's own user records carry that now.
• Security logs stream into the Rapid7 SIEM on their own, with nothing retrieved from a server by hand.

The pattern also compounds. The next vendor AAA Northeast onboards is a partner space, a folder, and an SSH key: the same construct every time, instead of one more shared password on a server one person understood.

Retired Without a Big Bang

Today the file exchange of a multi-line membership and financial business runs through Files.com, behind AAA Northeast's own domain, and the eighteen-year-old server it replaced is off. The counterparties barely noticed. Their scripts run against a new hostname with a new credential, and everything else about their process is what it always was. What changed is what the company can now say about its own data: sensitive files pass through the platform in transit, encrypted while they are there, expired automatically within a week, every touch logged into the security team's own SIEM. The engineer who once answered access questions by auditing folders one at a time now answers them by looking at the user.

The lesson in AAA Northeast's migration is that age and entanglement are not reasons to keep a legacy file server. A system that spent eighteen years accreting dependencies came out from under them in batches: preserve every filename, path, and permission, run old and new in parallel, and the only thing a counterparty ever has to change is a hostname and a credential.