Case Studies

How a 600-person infosec team turned all-hands around

David C.

David C.

Feb 22, 2026 · 9 min read

The People Operations director of a 600-person infosec team came to us with a familiar problem: quarterly all-hands attendance had dropped to 58% over four consecutive quarters. The post-event surveys read "informative" in the way people say "fine" when something is decidedly not fine.

This is a case study about what changed.

The starting state

The team was distributed across Boston, Austin, Singapore, and Berlin. Roughly 60% of staff were remote. Quarterly all-hands ran 90 minutes — leadership presentation, Q&A, team highlights, occasional guest speaker.

By Q2 of last year, the all-hands was visibly struggling:

  • Attendance: 58% (down from 87% two years prior)
  • Post-event NPS: 4.2 / 10
  • "Camera off" rate: 73% (up from 18%)
  • Q&A engagement: 4-6 questions submitted, mostly anonymous

The People Operations team had tried the obvious fixes. Shorter format. More guest speakers. Better slides. Mandatory attendance. Nothing moved the needle. Some things made it worse.

What we changed (and why)

We worked with the People Ops director over three quarters to restructure how the team treated quarterly events. The changes weren't dramatic individually — they compounded.

Quarter 1: Replace the speaker model

The first all-hands we worked on had no leadership presentation. No slides. No guest speaker.

Instead, the 90 minutes became a structured team activity — a collaborative escape room scenario with puzzles tied to the team's actual quarterly themes. People joined in pre-assigned groups of 6-8 across regions and roles.

Result Q1:

  • Attendance: 78%
  • Post-event NPS: 7.4
  • Camera-on rate: 64%

The People Ops director told us that for the first time in six quarters, people were Slack-messaging her after the event with unsolicited positive comments.

Quarter 2: Add the async layer

For Q2 we built a 5-day async pre-event experience. People could engage with puzzles in their own time, leaving notes for teammates in other regions. The synchronous closing event became a 45-minute reveal celebration.

Result Q2:

  • Async engagement: 89% participation across the week
  • Synchronous closing attendance: 84%
  • Post-event NPS: 8.1
  • Cross-region collaboration mentioned in 67% of survey responses

The director's biggest surprise: distributed Slack activity went up sustained, not just during the event. People who had connected during the activity kept talking afterwards.

Quarter 3: Lock in the rhythm

Q3 wasn't about new innovation — it was about institutionalizing what worked. We helped them build:

  • Quarterly cadence calendar
  • Pre-event communication templates
  • Team-formation algorithm (cross-region, cross-function, cross-tenure)
  • Post-event retro process

Result Q3:

  • Attendance: 94%
  • Post-event NPS: 8.6
  • Cross-region collaboration cited as top workplace strength in the annual employee survey (up from #6)

What this case study isn't

This isn't a story about a magic team-building product fixing engagement.

The actual driver was the People Operations director's willingness to stop doing what wasn't working. Most companies in this situation double down on the format that's failing — better slides, more enthusiasm, mandatory attendance. The director here did the harder thing: changed the model entirely.

Our role was providing a format that delivered on what the team needed (structured collaboration, cross-region connection, async-friendly pacing). But the strategic clarity was internal.

Three patterns we've seen replicate

Across similar engagements with distributed teams, three patterns repeat:

1. The 90-minute presentation format is dying. It worked when "all-hands" meant being in a room together. As a replacement for that experience, it's a poor substitute. Teams that recognize this and shift to active formats see immediate engagement gains.

2. Async-first beats live-first for distributed teams. Counterintuitive but consistent. Teams that build async-first experiences with synchronous celebration moments outperform teams that try to force everyone onto a single call.

3. Quarterly is the right cadence. More frequent feels exhausting. Less frequent loses momentum. The teams that make quarterly events work treat them as the heartbeat of the company.

What we'd do differently

If we did this engagement again, we'd start with the post-event retro process in Q1, not Q3. Having a structured way to capture what worked accelerated the learning significantly. The People Ops director said as much in our debrief.

The other thing we'd push earlier: cross-functional team formation. Putting people in groups with teammates they don't normally work with produced the strongest results. Teams composed of "people who already work together" engaged less.

The honest takeaway

Engagement isn't a problem you solve once. It's a practice you maintain. The 600-person team in this case study didn't permanently fix all-hands attendance — they built a rhythm that lets them notice problems early and adjust. That's the real outcome. Not the 94% number. The capacity to keep getting it right quarter after quarter.

WRITTEN BY

David C.

David C.

Feb 22, 2026 · 9 min read

← Back to all posts

NEWSLETTER

Get monthly distributed-team playbooks

One email a month. Practical playbooks for HR and People Ops. No spam, unsubscribe anytime.

Ready to stop reading and start playing?

Pick a game and book in minutes.