--- title: "Root Cause: why breaches keep reaching backups | Firevault" url: https://fire-vault.com/root-cause description: "Backups keep getting reached because they are still on the network. Read the root causes of modern breaches and how Firevault removes the network path." lang: en-GB --- Understanding The Problem # The Root Cause of Every Risk Every security failure traces back to one of four root causes. Traditional security addresses symptoms. Firevault addresses causes with Offline Secure Storage®. - Cyber attacks - Human errors - Architectural flaws - Skill gaps 01 Root Causes ## Four Causes. One Architecture. Every breach, every incident, every compliance failure traces back to one of these four fundamental causes. ### Cyber Attacks Ransomware, breaches, and targeted intrusions Every cyber attack requires a path to your data. Traditional security tries to guard those paths. Firevault removes them entirely. When critical assets are physically disconnected, attackers have no route to reach them, regardless of how sophisticated their methods. Explore solutions 11sec Between ransomware attacks globally £3.5 million Average UK breach cost 277 days Days to detect a breach https://fire-vault.com/root-cause/cyber-attacks ### Human Errors Accidental exposure, insider threats, and mishandling People make mistakes. Even well-trained, well-intentioned employees click wrong links, share wrong files, and make configuration errors. Your architecture must limit the blast radius when mistakes happen. Firevault ensures critical data remains disconnected from default. Explore solutions 74% Of breaches involve human element £15.4M Average insider incident cost 85 Days to contain insider threat https://fire-vault.com/root-cause/human-errors ### Architectural Flaws Always-on connectivity and shared infrastructure Traditional IT architecture was designed for convenience, not security. Always-on connectivity, shared cloud infrastructure, and flat network designs create permanent attack surfaces. Firevault addresses these flaws at Layer 1, the physical layer, by removing connectivity entirely. Explore solutions 100% Of breaches need a path 62% Via third-party connections 94% Rely on cloud architecture https://fire-vault.com/root-cause/architectural-flaws ### Skill Gaps Talent shortages and operational complexity The cybersecurity skills gap exceeds 4 million professionals globally. You cannot hire your way to security. Firevault provides protection through physical design that works regardless of team size or expertise: security that does not depend on constant expert oversight. Explore solutions 4M+ Global cybersecurity skills gap 71% Report understaffed teams 67% Cannot fill security roles https://fire-vault.com/root-cause/skill-gaps UK Government Research ## The Economic Cost of Cyber Attacks, UK Government Research Eight UK Government research programmes (2025) quantify the cost of cyber attacks to the UK economy, from individual fraud to systemic infrastructure incidents. Read the full DSIT/Home Office report (PDF) (https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf) Source 437,000 Fraud victims from breaches People who became fraud victims as a direct result of data breaches in 2023 Frontier Economics for DSIT/Home Office, June 2025 https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf Source £755 million Annual cost of breach-linked fraud Annual cost of fraud resulting from data breaches in the UK Source 34% More likely to be defrauded Increased likelihood of fraud for individuals affected by a data breach Frontier Economics for DSIT/Home Office, June 2025 (citing Morgan & Voce 2022) https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf ICO Data Security Incident Trends Source 3,116 Incidents reported to ICO (2024) Data security incidents reported to the ICO in 2024 Source 33% Increase over five years Increase in ICO-reported data security incidents over five years (2019 to 2024) Source 612,000 UK businesses breached UK businesses that experienced a cyber breach or attack UK Government Cyber Security Breaches Survey 2025 https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025 Source 3.9 million Fraud cases (year ending Sept 2024) Fraud cases in the UK (year ending September 2024), a 19% increase year-on-year UK Breach Breakdown Source 119% Fraud increase (credit card breach) Short-term increase in fraud probability when credit card data is breached Source 11% Of all fraud linked to breaches Share of all UK fraud victims whose fraud resulted from a data breach Source 93% Involved phishing Business breaches involving phishing attacks Source 74% Of large businesses hit Large UK businesses identifying a breach or attack NCA National Strategic Assessment 2025 Source 41% Of all crime is fraud Fraud as a share of all crime in England and Wales NCA National Strategic Assessment 2025 https://www.nationalcrimeagency.gov.uk/threats-2025/nsa-fraud-2025 Source 3.2 million Fraud victims in England and Wales People aged 16 and over in England and Wales estimated to have been fraud victims (7% of the population) Source 67% Of fraud is cyber-enabled Of fraud reported in the UK is cyber-enabled Source 14% Of fraud is actually reported Only 14% of frauds against individuals are reported to Action Fraud or police DSIT/KPMG Economic Impact of Cyber Attacks 2025 Source £14.7 billion Annual cost to UK businesses Total annual cost to UK businesses of significant cyber attacks, 0.5% of GDP KPMG for DSIT, April 2025 https://assets.publishing.service.gov.uk/media/68b1bdd5cc8356c3c882a904/Economic_modelling_of_sector_specific_costings_of_cyber_attacks.pdf Source £1B–£8.5B Annual IP theft cost to UK Annual cost to the UK economy from IP and knowledge assets theft via cyber attacks (0.04%–0.30% of GDP) Alma Economics for DSIT, July 2025 https://assets.publishing.service.gov.uk/media/691442809d50fc2fe8161635/Economic_Impact_of_IP_from_Cyber_Attacks_-_ALMA_ECONOMICS.pdf Source £1.8 billion One-week rail cyber incident Total economic cost of a one-week systemic cyber incident to the GB rail network KPMG for DSIT, April 2025 https://assets.publishing.service.gov.uk/media/69144f259d50fc2fe816163a/Economic_impact_of_a_systemic_cyber_incident_rail_sector_scenario.pdf Source £33.4 million Annual hospital cyber patient cost Annual patient impact from cyber attacks on major UK hospitals (estimated 3 incidents per year) KPMG for DSIT, April 2025 https://assets.publishing.service.gov.uk/media/6914486cb49cc44345161638/Impact_on_consumers_of_cyber_attacks.pdf Source £2.56 million Average scam/fraud attack cost Average cost per scam or fraud cyber attack to a UK business Source 16% SME sales decline after IP theft Decline in SME sales growth in the year of a cyber attack involving IP theft Source 150% Rise in attack cases (2022–2023) Rise in reported cyber attack cases between 2022 and 2023 Source Up to £231 million Banking attack consumer impact Consumer impact per cyber attack resulting in loss of access to online banking (3-day outage) ### These are only the reported incidents The ICO acknowledges these figures represent only breaches that were discovered and reported within 72 hours. The true scale of data exposure is significantly higher. The average time to detect a breach is 277 days. ### Once data is breached, fraud follows The UK Government model identifies three breach-to-fraud journeys: direct monetisation of financial data, identity theft from personal records, and bulk credential exploitation. Firevault addresses all three by taking data offline entirely. Sources: Frontier Economics for DSIT/Home Office (June 2025) (https://assets.publishing.service.gov.uk/media/68b86ee9b0a373a01819fdc6/Modelling_the_link_between_data_breaches_and_fraud.pdf) · NCA National Strategic Assessment 2025 (https://www.nationalcrimeagency.gov.uk/threats-2025/nsa-fraud-2025) · KPMG Sector Costings (April 2025) (https://assets.publishing.service.gov.uk/media/68b1bdd5cc8356c3c882a904/Economic_modelling_of_sector_specific_costings_of_cyber_attacks.pdf) · Alma Economics IP Theft (July 2025) (https://assets.publishing.service.gov.uk/media/691442809d50fc2fe8161635/Economic_Impact_of_IP_from_Cyber_Attacks_-_ALMA_ECONOMICS.pdf) · KPMG Consumer Impact (April 2025) (https://assets.publishing.service.gov.uk/media/6914486cb49cc44345161638/Impact_on_consumers_of_cyber_attacks.pdf) · KPMG Rail Scenario (April 2025) (https://assets.publishing.service.gov.uk/media/69144f259d50fc2fe816163a/Economic_impact_of_a_systemic_cyber_incident_rail_sector_scenario.pdf) · ICO Incident Trends (https://ico.org.uk/action-weve-taken/complaints-and-concerns-data-sets/data-security-incident-trends/) · Cyber Breaches Survey 2025 (https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025) 02 The Solution ## One Architecture. Four Root Causes. Complete Protection. Firevault does not try to patch each root cause individually. Our physically disconnected architecture addresses all four simultaneously by removing the fundamental assumption that data must always be reachable. No path for attackers Limited blast radius Physical air gap Works without experts Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Image: David Bailey (https://fire-vault.com/assets/david-bailey-Dgqj8eaE.jpg) Image: Kenny Phipps (https://fire-vault.com/assets/kenny-phipps-Dy-CtCjw.jpg) Online Now Get started ## Address every root cause of data loss See how offline architecture eliminates the fundamental vulnerabilities behind every breach. From £360 a month including VAT. 36-month commitment. First payment at checkout. From £360/mo VAT included 36-month plan ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/root-cause#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Root Cause: why breaches keep reaching backups", "item": "https://fire-vault.com/root-cause" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/root-cause#webpage", "url": "https://fire-vault.com/root-cause", "name": "Root Cause: why breaches keep reaching backups", "description": "Backups keep getting reached because they are still on the network. Read the root causes of modern breaches and how Firevault removes the network path.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-solutions.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/root-cause#breadcrumb" } } ] ```