OSS® For ransomware recovery
Keep the copy you would rebuild from (gold images, configurations and critical data) physically disconnected until named people open it. Your backup routine carries on as it does today.
Storage from 20TB, quoted for you · Vault from £360 a month inc VAT
Ransomware
Encrypts what it can reach
Your recovery copy
Clean, physically offline
Why it matters
Published cases from the last few years. In each one, what was connected shaped what happened next.
The path
Remote access without multi-factor authentication, and a known vulnerability left unpatched for months.
What followed
Ransomware encrypted 972,191 files. The backups were on the same network, so they were encrypted too. The ICO fined the firm £98,000.
A backup that shares the network shares the outcome.
The path
Attackers got into JLR’s IT, and the company shut systems down to contain the attack.
What followed
Production stopped across its UK plants for around five weeks. The Cyber Monitoring Centre estimated the cost to the UK economy at £1.9 billion, affecting more than 5,000 organisations.
Recovery time is the cost. Start from something you trust.
94%
of organisations hit by ransomware said attackers tried to compromise their backups. 57% of those attempts succeeded.
Backups are the first target, not the last line.
These cases show how connected backups shape what happens next. They are not claims about what any single control would have prevented.
What it is
Your backups are online so they can run. So is everything an attacker can reach.
If only one recovery copy had no network path to it at all.
Welcome to Offline Secure Storage®.
A new approach to data storage. Your data sits on your own drives, physically disconnected, until a named person opens it from their registered phone.
Controlled ConnectivityPhysically disconnected at Layer 1. No IP path exists until a session is authorised
Secured Offline AccessRequested from a registered phone, out of band, then sign-in and MFA
Secured Offline DataYour own dedicated drives, single-tenant, in a Firevault Bunker
What it gives you
Your backup software and schedule carry on. OSS adds one recovery copy that sits physically offline, outside the admin accounts attackers take.
Choose a situation to see the difference.
Choose a situation
SituationAttackers find the backup console and delete restore points before they encrypt anything.
Backups share the network and the admin accounts, so they go first.
One recovery copy has no network path while closed, and opening it needs a named person’s phone and MFA, not admin rights.
The retained data is physically disconnected. Your live systems stay connected and still need their own protection.
Illustrated Storage access cycle, not a live session. Only data retained in OSS is protected while physically disconnected.
One recovery copy sits physically disconnected between sessions, away from the admin accounts attackers take.
Gold images, configurations and the identity backup, ready for a clean rebuild.
Named holders and every session logged, exportable for auditors and insurers.
Who it’s for
Three people who would own the recovery. And the difference one offline copy makes.
Switch between without and with OSS, or let each one turn by itself.
Meet Dan.
IT manager, precision engineering firm
Tuesday · 05:30The backup appliance was joined to the domain. The attacker used the same admin account to wipe it before encrypting everything else.
The rebuild starts from a plan, not a blank page.
Storage · From 20TB
Recovery copies at scale
Meet Aisha.
Owner, managed service provider
Saturday · 23:10Client backups are managed from the same platform the attacker now controls.
One compromise doesn’t become forty.
Storage · Named people
Each with their own access
Meet Helen.
Finance director, logistics group
Thursday · 10:00The honest answer is “sort of”: backups are on a separate server, but on the same network and the same admin accounts.
Evidence beats assurance.
Vault · Every session logged
Digital safe deposit box™
Dan, Aisha and Helen are illustrative. Our customer story is real.
Use cases
Three situations we are asked about most. Each keeps the copy you rebuild from offline, with named holders and logged sessions.
A gold copy is the known-good version you rebuild from. Keep it where nothing on the network can delete or encrypt it, refresh it in logged sessions, and keep more than one version.
What to keep offline
Usually held by: Infrastructure lead, with named deputies
In OT, recovery means rebuilding controllers and engineering workstations, not just servers. Keep golden images, PLC and HMI configurations and the evidence of what was running before the incident.
What to keep offline
Usually held by: Control systems or site engineer
The plan for the bad day shouldn’t live on the systems the bad day takes out. Keep the runbook, contacts and decision log offline, so the first hour isn’t spent looking for phone numbers.
What to keep offline
Usually held by: Head of IT or incident lead
Choose your OSS
Recovery copies are usually measured in terabytes, so most teams start with Storage. A Vault suits a recovery lead’s smaller crown-jewel set.
Storage
For backup copies, gold images and archives at scale
Vault
For a recovery lead’s crown-jewel set: images, configurations and the plan
Enterprise
For enterprise, government, defence and CNI recovery estates
LUV opens one day a week, so it isn’t built for recovery. Compare all four
Protect the asset. Control the path.A recovery copy protects the data. Control by Firevault cuts the paths ransomware travels on, at Layer 1, on a separate line.
Explore ControlFrom a real customer
“I had full autonomy over the way the Vault was managed. They facilitated the requests I had and adapted to what our business needed.”
Chief Executive, award-winning multi-site UK care provider
Firevault, as featured in
techradar proyahoo!financeChannel InsiderSecurity BuyerSecurityBriefCyber Essentials Plus certifiedHow it works
Your backup routine carries on. OSS adds one copy that sits outside it.
Decide what you would rebuild from. We write a Storage proposal around it, with named people and capacity in 20TB blocks.
A named person opens a logged session, adds the latest known-good copies, and closes it. Scheduled windows work too.
Physically disconnected at Layer 1. Nothing on the network can reach, delete or encrypt it.
On clean infrastructure, open a session and restore identity and configurations first, then the data the business needs first.
Worth knowing. A copy that was already infected when you added it is still infected. Scan before you add, and keep more than one version.
See it for yourself
Step through a closed Vault, an open session and the moment it disconnects again.
Choose a state, or let it play.
Vault states
Z0Outside
Anyone on the internet
Z1Your network
Servers, backups, admin
Z2Firevault Bunker
Single-tenant drives
The normal state
Closed is the normal state. There is nothing on the network to find, search or sign in to.
Requested
No session requested.
Reported by the Vault
Vault physically disconnected at Layer 1.
On record
Last session closed Sun 02:00 by the recovery lead.
Concept illustration. The request path, the Vault’s reported state and the session record are shown separately because they are not the same thing.
Where each kind of copy stands
| Online backup | Immutable backup | Offsite tape or disks | Offline Secure Storage® | |
|---|---|---|---|---|
| Network path while idle | Yes | Yes, with copies locked for a set period | No | No. Physically disconnected at Layer 1 |
| What a stolen admin login can do | Delete or encrypt it | Can’t change locked copies; can reach the console and settings | Nothing remotely | Nothing remotely while closed. Opening needs a named person’s phone and MFA |
| Getting data back | Fast | Fast | Slow: someone fetches and loads it | On demand, from a registered phone |
| Who can open it | Anyone with backup admin rights | Anyone with backup admin rights | Whoever holds the media | Named, verified people, each with their own access |
| Proof for auditors and insurers | Backup logs | Backup logs and lock settings | Courier and handling records | A log of every session |
Most teams keep their online and immutable backups. OSS is the copy that doesn’t answer to the network.
Questions worth asking
Want your team to see a recovery session end to end? Book a demo.
Immutable copies can’t be changed until their lock ends, which is valuable. But the console and storage stay reachable on the network. OSS adds a copy with no network path while closed. Many teams use both.
No. Your backup software and schedule carry on. OSS holds one recovery copy outside them.
Opening takes moments from a registered phone. How long a restore takes depends on how much you bring back and your connection, so keep what you need first small, and test it.
Anything added during an authorised session is stored as it is. That is why we say scan before you add, keep more than one version, and add from a clean machine.
A Vault is used in your browser. Storage takes scheduled sync, SFTP, a REST API or your existing backup workflows, in windows that open and close on schedule.
It can help support the evidence insurers ask for: a physically disconnected copy, named holders, session logs and restore tests. It doesn’t guarantee cover.
Your next step
Keep one recovery copy physically offline. Your backup routine carries on as it does today.
Get a Storage proposalPrefer to talk first? Book a demoStorage from 20TB in 20TB steps, quoted in a written proposal. Over 300TB? See Enterprise.
Recovery copy
Enterprise