Recent Breaches
Breaches
View All →
Control Module - FIRE

FV-Firebreak. Physically open or close the path.

Firebreak governs whether a connection path exists at all. When the path is severed, the attack has no route to progress. Containment is delivered by removing the physical connection, not by inspecting traffic or trusting a configuration to hold.

Back to Control

Control Module - FIRE

If the path can be filtered, it can be unfiltered. If the path is physically removed, there is nothing left to negotiate with.

Physical

Severance happens at the connection itself, not in a rule set

Zero

Network paths remaining once Firebreak is engaged

Authorised

Every open and close requires explicit approval

Auditable

Each state change is recorded for evidential review

The Problem

Filtering a path is not the same as removing it.

Filtering trusts the filter

Firewall rules, ACLs and segmentation policies assume the enforcement plane is intact. A compromised management plane can quietly relax the same rules that are supposed to contain the attack.

Logical boundaries leak

VLANs, overlays and software-defined boundaries can be bypassed through misconfiguration, trunk abuse or trust inheritance. The separation only exists while every layer behaves as intended.

Reaction is too slow

Emergency rule changes need authoring, testing and propagation. An attacker moving laterally does not wait for the change window to complete.

The Scenario

Scenario: cutting the route during a live incident

Detection confirms unauthorised activity reaching from a corporate segment into an operations environment. Rather than authoring emergency firewall rules and waiting for them to propagate, the duty engineer requests a Firebreak action on the inter-segment path. With co-approval, the path is physically opened. Traffic stops because the connection no longer exists. Investigation continues on each side without further risk of progression, and the path remains severed until the environment is verified clean and a controlled restoration is approved.

"Firebreak is the moment you stop debating containment and you simply remove the road."

FV-Firebreak in placement

Where Firebreak physically severs the path.

Firebreak is engaged at every conduit where a severed path is the only acceptable default. It removes the connection itself, not the rule about the connection.

Grounded in IEC 62443-3-3 SR 5.1 Network Segmentation, NIST CSF PR.AC-5 and NCSC Cyber Assessment Framework B4.

Inputs ─┐Telemetry ─┐

FV-Firebreak

FIRE layer

┌─ Outputs┌─ Control
01SR 5.1

Internet to enterprise conduit

Severs the inbound path when no legitimate traffic is expected. The path comes up only for an authorised window.

02SR 5.1 / SR 5.2

IT to OT boundary

Removes the standing route between corporate IT and operational technology. An IT compromise has nowhere to go.

03PR.PT-5

Production to recovery vault

Holds the path to offline recovery copies severed at rest. Ransomware cannot encrypt what it cannot reach.

04SR 1.13

Vendor maintenance conduit

Default-severed third-party reach. Opens only as a named, time-bound session and closes on schedule.

Relies on · prerequisites

  • Physical interruption hardware in the conduit, not just a routing change
  • Out-of-band authorisation channel that survives an IT compromise
  • Tamper-evident audit of every open and close event

Pairs with · companion modules

IsolateRelayExecuteValidate

Featured In

TechRadar ProSecurity BuyerYahoo FinanceSecurityBriefChannel Insider

Key Capabilities

Path-level severance

Firebreak operates on the connection path itself, so a closed path cannot be reached, scanned or negotiated with from either side.

No logical bypass

There is no rule plane to subvert and no configuration to mis-set. The contained state is the absence of the connection.

Multi-party authorisation

Open and close actions require explicit approval from designated parties so no single account, compromised or otherwise, can change the boundary alone.

Triggered or commanded

Actions can be initiated by an operator, by a scheduled task, or by an upstream detection in line with pre-approved conditions.

Evidential record

Each state change, the requesting party and the approving party are recorded on physically separate storage through Archive.

Controlled restoration

Paths are reopened deliberately and individually, through Relay where a defined purpose and window applies.

Demo to Live

Adoption Guide

Step 1

Map the paths

Identify the connection paths where severance is a meaningful response, including inter-zone, inter-site and third-party links.

Step 2

Define the authority

Agree the approval pattern for open and close, the pre-approved automation conditions and the escalation route.

Step 3

Rehearse and validate

Walk the playbook with the responders, then exercise live severance and restoration on a non-production path.

Step 4

Operate and review

Run Firebreak as part of regular response, review state changes through Archive and tune the trigger conditions over time.

Step 1

Map the paths

Identify the connection paths where severance is a meaningful response, including inter-zone, inter-site and third-party links.

Step 2

Define the authority

Agree the approval pattern for open and close, the pre-approved automation conditions and the escalation route.

Step 3

Rehearse and validate

Walk the playbook with the responders, then exercise live severance and restoration on a non-production path.

Step 4

Operate and review

Run Firebreak as part of regular response, review state changes through Archive and tune the trigger conditions over time.

Questions

Frequently Asked

    Firevault

    Firevault is Offline Secure Storage. Hardware you own, physically disconnected by default, with KYC-verified access. Ransomware-proof by design, not by patch.

    © 2026 Firevault Limited. Disconnect to Protect®