Control by Firevault

Control access.Cut the affected path.

Supplier access, business networks and connected equipment all need routes into your systems. Control by Firevault governs when those routes exist and physically disconnects selected paths when your response policy requires it. Designed to contain exposure while limiting disruption to unaffected operations.

Book a demo See how it works

Controlled access. Rapid isolation. Evidence of every action.

01Why the path matters

Attackers do not stop at the first system. They follow the path.

A stolen supplier login can expose production systems. A compromised business network can put operational technology at risk. In healthcare, utilities and transport, the consequences reach beyond lost data to interrupted services. Detection matters. So does the ability to stop an incident crossing into systems you cannot afford to lose.

nationally significant cyber incidents handled by the NCSC in the year to August 2025, up from 89.

NCSC Annual Review 2025

of breaches in Verizon’s 2026 report involved a third party, up from 30% the year before.

Verizon 2026 Data Breach Investigations Report

0min

average time for an attacker to move from a first foothold into other systems. The fastest was 27 seconds.

CrowdStrike 2026 Global Threat Report

Recent incidentsCyber · OT · CNI

View all incidents

02The point of difference

Do not just watch the path. Decide when it exists.

Control is a platform for governed access and physical isolation. Your security tools detect threats; your response policy or authorised operator decides what must happen. Control applies that decision to the selected connection. Approved work can have a defined access window rather than a permanent route into critical systems.

Choose a situation to see it happen.

See it happen

Situation

A supplier needs two hours on a control system to apply a patch.

No standing path to critical systems

Control record. Each action is signed, timestamped and sent to SysLog.

What Control does

Concept illustration. Timings and module roles depend on your Blueprint and architecture.

03What changes

Detection identifies the threat. Control enforces the response.

Keep detection, firewalls and incident response. Control adds a physical enforcement point where your plan calls for isolation, without relying on someone reaching a rack and pulling cables. Which services remain available depends on the zones, dependencies and response plan agreed for your estate.

Posture	Detect and respond	Manual shutdown	Control
Time to contain	Minutes to hours	Minutes, by hand	Physical switching on command; response timing varies
Scope of action	Alerts, blocks or isolates a host	Depends on the cables and connections removed	Per zone, per module, per Blueprint
Reversible without a site visit	Yes	No	Yes
How isolation is enforced	Configured software controls	Manual cable disconnection	Physical switching on the selected path
Recorded physical action	No	Ad hoc	Yes, signed

04Who it is for

Built for the teams who own the consequences.

Different estates have different consequences. Start with the connection that exposes a critical service, sensitive environment or operational process.

Critical national infrastructureSeparate business access from essential-service systems, with planned isolation boundaries and a record of response actions. OT and SCADALimit access to legacy equipment and open maintenance paths only when needed, with isolation planned around safe process operation. Defence and national securityGovern connections into sensitive enclaves and test environments, with named authorisation and defined access windows. Regulated financeControl access to settlement systems and trading environments, with recorded actions to support investigation and oversight. Enterprise IT under NIS2 and DORATurn access and isolation policies into enforceable controls, with evidence to support risk reviews and regulatory obligations. Healthcare and researchSeparate clinical, research and administrative environments. Plan containment around patient safety and the dependencies services need.

05Control Blueprints

Ten Blueprints. One outcome each.

A Blueprint translates a specific risk into controlled zones, authorised paths and response actions. The ten Blueprints combine the same nine modules in different ways. Start with your priority, then adapt the pattern to your systems and operational dependencies.

Choose a Blueprint

CP-01Stop Kill-Chain Ransomware

Z0Internet and email

Z1Business network

Z2Crown-jewel systems

Held in Offline Secure Storage®Clean recovery copies

Out-of-band command path

This Blueprint

Stop ransomware moving, spreading or reaching crown-jewel systems, across IT and OT.

Primary modules: Firebreak, Isolate and Execute.

Read CP-01

Module in this Blueprint

Firebreak®

Controls the path

Physically open or close the path.

Controls whether a connection path exists at all. It cuts the physical link, so an attack has no route to spread, rather than inspecting traffic or relying on rule settings.

Explore the Firebreak module

Concept illustration. Select any module to see what it does. Each Blueprint page shows the full topology and every module’s role.

The AI Kill Switch.

Apply the Layer 1 cut to AI systems. When an AI system behaves unexpectedly, physically disconnect it from your data and networks in seconds. Supplied by Firevault within Control.

Explore the AI Kill Switch

Explore all ten Blueprints

As featured in

06Designed and engineered by Firevault

Three weaknesses. One physical answer.

We built Control around three practical problems: isolation that is too broad, response controls that depend on the affected environment, and actions that are difficult to evidence. The platform connects policy decisions to physical enforcement, with the boundaries and approvals designed for each estate.

01Per-zone independence

Once inside, an attacker can move through the network.

What we engineered: Defined isolation boundaries for circuits, tenants and operational segments, with dependencies assessed before deployment.

The result: Selected paths can be disconnected to limit further movement.

Stopping lateral movement

02Out-of-band command path

The off switch relies on the network it is meant to cut.

What we engineered: A separately governed command route, rather than depending solely on the production connection being isolated.

The result: Response commands do not depend solely on the affected data path.

Protecting the management plane

03An evidential record

Pulling cables works, but it does not scale.

What we engineered: Authorised physical actions with signed, timestamped records, logged locally and to SysLog.

The result: A record of what changed, when and under whose authority.

Control in a live incident

Board-level evidence, not screenshots.

Control can help support these obligations. It does not make you compliant on its own.

NCSC Cyber Security Toolkit for Boards

AGovernanceEach zone’s state is on record.
BCultureNo silent reconnection. Every action is named.
CBaseline controlsPhysical separation of OT, IT and crown jewels.
DSupply chainSupplier access is time-bound and verified.
EIncident responseRehearsed isolation with a signed record.

NIS2 director duties

20Management accountabilityDecisions evidenced at the physical layer.
21Risk-management measuresSupports Article 21(2)(a), (d), (e) and (i).
23Incident notificationA record from the moment of isolation for the 24 and 72-hour notices.

Read the NIS2 mapping

The platformNine modules, two families

Nine modules. Distinct responsibilities.

FIRE modules enforce connection and isolation decisions. VAULT modules govern authorisation, protected assets and their movement. A Blueprint selects the roles needed for your outcome; it is not a requirement to deploy every module.

Firebreak

Physically disconnects the selected network path.

Isolate

Separates the affected environment into a controlled zone.

Relay

Opens a temporary, time-bound window for an approved purpose.

Execute

Activates defined actions from approved commands, events or schedules.

Validate

Verifies identity, authority and purpose before access or action.

Archive

Preserves the records, logs and evidence the control produced.

Unlink

Removes persistent connections that expose protected assets.

Lock

Holds the asset behind identity, role and policy controls.

Transfer

Governs what moves between protected environments.

Control the path. Protect the asset.

Containing an incident and protecting a recovery copy are different jobs. Control governs operational paths. Offline Secure Storage® separately keeps valuable data and recovery assets physically disconnected between authorised access sessions.

Explore Offline Secure Storage®

07Questions worth asking

Before you change how paths are controlled.

Your engineers will want detail. Your board will want evidence. Here are the practical answers.

No. Your existing tools detect and investigate threats. Your response policy or authorised operator decides what action is appropriate. Control provides physical enforcement on the selected paths; it does not replace threat detection or your incident response team.

Across IT and OT, from physical processes up to enterprise networks: Purdue Levels 0 to 5. You can start with a single segment and extend from there.

No. Firebreak® physically opens or disconnects a selected connection. Traffic inspection and threat detection remain with your existing security tools.

Control is scoped around the systems and connection boundaries you need to govern. Deployment can be on your premises, in a Firevault Bunker or a hybrid arrangement. We agree the dependencies, command access and response actions before extending the design across your estate.

No single product can. Control can help support your obligations under frameworks such as DORA, IEC 62443, ISO 27001 and the NIST Cybersecurity Framework, and we map it to MITRE ATT&CK.

Yes. Choose a priority risk and use the relevant Blueprint as the starting pattern. Scope and test the affected paths and service dependencies before considering a wider deployment.

See all questions

08Your next step

Decide what stays connected.

Start with one critical system, supplier connection or operational boundary. We will discuss the exposure, the Blueprint that fits, and what a scoped deployment needs: safe isolation, authorised access and evidence of the response.

Book a demo

Prefer to talk first? Speak to the team

Book a demo Speak to the team