Recent Breaches
Breaches
2026PowerSchool62.4M records stolen2026DISA Global Solutions3.3M records stolen2026Globe Life850K records stolen2026Co-operative Group6.5 million members (names, contact details, dates of birth) records stolen2026HarrodsAttempted intrusion, limited disruption records stolen2026Legal Aid Agency (Ministry of Justice)2.1 million applicants (financial, criminal, contact data since 2010) records stolen2026Adidas UKCustomer contact details (subset) records stolen2026Peter Green ChilledOrder and logistics data records stolen2026Jaguar Land RoverProduction and IT systems disrupted records stolen2026Collins Aerospace (RTX)Check-in and boarding disruption across Heathrow, Brussels, Berlin records stolen2026Co-operative Group6.5 million members (names, contact details, dates of birth) records stolen2026HarrodsAttempted intrusion, limited disruption records stolen2026Legal Aid Agency (Ministry of Justice)2.1 million applicants (financial, criminal, contact data since 2010) records stolen2026Adidas UKCustomer contact details (subset) records stolen2026Peter Green ChilledOrder and logistics data records stolen2026Jaguar Land RoverProduction and IT systems disrupted records stolen2026Collins Aerospace (RTX)Check-in and boarding disruption across Heathrow, Brussels, Berlin records stolen2026PowerSchool62.4M records stolen2026DISA Global Solutions3.3M records stolen2026Globe Life850K records stolen
View All →
All Control Blueprints
FIRE-ledCP-02Controls the path

Contain Active Breaches

When prevention fails, containment must be physical, immediate and provable.

All Blueprints
What it does

When prevention fails, containment must be physical, immediate and provable.

Where it fits

Live incident containment and recovery

Who uses it

Financial services, Energy, Public sector, Defence

CP-02 topology

How CP-02 contains a live incident.

A FIRE-led pattern for live containment. Affected zones are severed at the conduit, recovery zones are reached only through an authorised Execute event.

Grounded in NIST CSF RS.MI-1, IEC 62443-3-3 FR 6 and the CISA Incident Response Playbook.

Z0

Affected zone

Where the

Affected zone zone

Where the live incident is unfolding

FV-Firebreak module iconFirebreakFV-Isolate module iconIsolate

Severed on alert. Blast radius bounded.

Z1

Unaffected production

Operational zones

Unaffected production zone

Operational zones still running

FV-Execute module iconExecuteFV-Lock module iconLockFV-Archive module iconArchive

Reach into forensic and recovery only as an approved event.

Z2

Forensic and recovery zone

Where evidence

Forensic and recovery zone zone

Where evidence is held and recovery is staged

OSS

Crown jewels · detail callout

Sealed evidence and recovery vault

Logs, snapshots and golden images sealed offline for the incident response and any later investigation.

Modules & symbols

FV-Firebreak module iconFirebreakPhysical sever
FV-Isolate module iconIsolateZone boundary
FV-Execute module iconExecuteApproved action
FV-Lock module iconLockNamed access
FV-Archive module iconArchiveDisconnected copy
ConduitEnforced module path
┄┄┄
Crown jewelsOffline · detail callout
How it reads end to end

Firebreak disconnects the exposed path. Isolate contains the breach area. Execute allows immediate action during a live incident. Archive preserves logs, evidence and recovery points while Lock protects what remains as recovery begins.

Sector relevance
Financial servicesEnergyPublic sectorDefence
Mark Fermor
David Bailey
Kenny Phipps
Online Now
Concierge

Build control around your environment

Talk to our team about composing this Blueprint for your estate.

Takes about 2 minutes. No account needed.

Free2 minsNo sign-up

    Your privacy matters

    We use cookies to keep the site running smoothly and to understand how you use it. You are in control. Privacy Charter · Cookie Policy