Recent Breaches
Breaches
2026PowerSchool62.4M records stolen2026DISA Global Solutions3.3M records stolen2026Globe Life850K records stolen2026NHS ScotlandUndisclosed records stolen2026HertzUndisclosed records stolen2025Marks & Spencer9.4M records stolen2025PayPal35K records stolen2025Jaguar Land RoverUndisclosed records stolen2025Co-operative GroupUndisclosed records stolen2024National Public Data2.9B records stolen2024Ticketmaster560M records stolen2024Change Healthcare100M+ records stolen2024AT&T73M records stolen2024Dell Technologies49M records stolen2023Progress Software (MOVEit)77M+ records stolen202323andMe6.9M records stolen2023Royal MailOperations halted records stolen2023British LibraryUndisclosed records stolen2023MGM ResortsUndisclosed records stolen2022Uber57M records stolen2022LastPass33M records stolen2022Optus9.8M records stolen2022Medibank9.7M records stolen2022Twitter5.4M records stolen2026NHS ScotlandUndisclosed records stolen2026HertzUndisclosed records stolen2025Marks & Spencer9.4M records stolen2025PayPal35K records stolen2025Jaguar Land RoverUndisclosed records stolen2025Co-operative GroupUndisclosed records stolen2024National Public Data2.9B records stolen2024Ticketmaster560M records stolen2024Change Healthcare100M+ records stolen2024AT&T73M records stolen2024Dell Technologies49M records stolen2023Progress Software (MOVEit)77M+ records stolen202323andMe6.9M records stolen2023Royal MailOperations halted records stolen2023British LibraryUndisclosed records stolen2023MGM ResortsUndisclosed records stolen2022Uber57M records stolen2022LastPass33M records stolen2022Optus9.8M records stolen2022Medibank9.7M records stolen2022Twitter5.4M records stolen2026PowerSchool62.4M records stolen2026DISA Global Solutions3.3M records stolen2026Globe Life850K records stolen
View All →
Control Module

FV-Isolate: Physical Boundary Enforcement

Network segmentation works only when the boundaries are real. Isolate enforces physical separation between network zones, ensuring that segments remain isolated regardless of misconfiguration, credential theft, or privilege escalation.

Back to Control
Control

Control Module

If a network boundary depends on correct configuration of the devices within those segments, an attacker who compromises those devices controls the boundary. Physical isolation removes this dependency entirely.

Physical

Separation between configured network zones

Zero

Cross-zone paths during isolation periods

100%

Boundary enforcement regardless of privilege level

Full

IEC 62443 zone compliance evidence

The Problem

Logical segmentation is only as strong as its configuration.

VLAN Misconfiguration

A single trunk port misconfiguration, an overlooked ACL rule, or a VLAN hopping attack can collapse the separation between network segments that appears robust on paper.

Privilege Escalation

An attacker who escalates privileges on one segment can reconfigure switching and routing to reach segments that were supposedly isolated.

Configuration Drift

Over time, emergency changes, temporary rules, and undocumented modifications erode segmentation. The network diagram shows isolation that no longer exists in reality.

The Scenario

Scenario: Physical Segmentation Preventing Lateral Movement

A healthcare provider maintains physically separate network zones for clinical systems, medical devices, administrative IT, and guest Wi-Fi using the Isolate module. An attacker compromises a workstation on the administrative IT segment through a phishing email and attempts to reach the clinical systems containing patient records. Despite escalating to domain administrator privileges, the attacker cannot reach the clinical segment because the physical connection between the two zones does not exist. The Isolate module enforces the boundary at the physical layer, independent of any configuration on the compromised administrative network.

"We had VLANs between clinical and admin networks. Our penetration tester crossed the boundary in 4 hours. With Isolate, there is no boundary to cross. The connection simply does not exist."

Module Overview

Network segmentation that exists in reality.

FV-Isolate provides physical network segmentation that cannot be bypassed through any software-based attack. Zones are physically separated, boundaries are configuration-independent, and controlled conduits enable authorised data flows without compromising the isolation.

  • Physical separation that no privilege level can bypass
  • Configuration-independent boundaries
  • Multi-zone architecture with independent governance
  • Controlled conduits for authorised data flows
  • Continuous boundary monitoring and alerting
  • Direct compliance mapping to IEC 62443 and ISO 27001
Isolate

Isolate — How It Works

Module 1 of 4

Isolate creates physical separation between network zones. Unlike VLANs or firewall rules, this separation cannot be bypassed through privilege escalation, misconfiguration, or exploitation of switching vulnerabilities. The physical path between zones does not exist.

Featured In

TechRadar ProConnected BritainTotal TelecomSecurity BuyerComms BusinessComms DealerBlocks & FilesYahoo FinanceGlobeNewswireChannel InsiderUK DirectorSecurityBriefPCRBusiness Time in EssexTechRadar ProConnected BritainTotal TelecomSecurity BuyerComms BusinessComms DealerBlocks & FilesYahoo FinanceGlobeNewswireChannel InsiderUK DirectorSecurityBriefPCRBusiness Time in Essex

Key Capabilities

Physical Zone Separation

Network zones are physically separated, not logically segmented. No VLAN hopping, ARP spoofing, or configuration exploit can traverse a physical gap.

Configuration-Independent Security

The boundary does not depend on correct configuration of the devices within the zones. Even if every device is compromised, the physical separation remains.

Multi-Zone Architecture

Supports complex zone architectures with multiple physically separated segments, each with independent governance policies and controlled conduits.

Dynamic Zone Adjustment

Zone boundaries can be reconfigured through authorised commands, allowing the architecture to evolve without physical infrastructure changes at every boundary.

Boundary Monitoring

Continuous monitoring of all zone boundaries with alerts for any attempted or actual boundary violations, logged on physically disconnected storage.

Compliance Mapping

Physical zone architecture maps directly to IEC 62443 zones, ISO 27001 network segmentation requirements, and NIS2 resilience obligations.

Demo to Live

Adoption Guide

Step 1

Segmentation Audit

Map current logical segmentation and identify where physical isolation would eliminate the highest-risk lateral movement paths.

Step 2

Zone Architecture Design

Design physically separated zones with controlled conduits for each authorised data flow, aligned to compliance requirements.

Step 3

Pilot Zone Deployment

Deploy physical isolation on a single high-risk boundary, testing data flow conduits and operational procedures.

Step 4

Full Zone Deployment

Extend to all critical boundaries with continuous monitoring, automated compliance evidence, and dynamic zone management.

Step 1

Segmentation Audit

Map current logical segmentation and identify where physical isolation would eliminate the highest-risk lateral movement paths.

Step 2

Zone Architecture Design

Design physically separated zones with controlled conduits for each authorised data flow, aligned to compliance requirements.

Step 3

Pilot Zone Deployment

Deploy physical isolation on a single high-risk boundary, testing data flow conduits and operational procedures.

Step 4

Full Zone Deployment

Extend to all critical boundaries with continuous monitoring, automated compliance evidence, and dynamic zone management.

Questions

Frequently Asked

Ready to take the next step?

See how Control can govern your data paths with physical enforcement no software exploit can bypass.

    Your privacy matters

    We use cookies to keep the site running smoothly and to understand how you use it. You are in control. Privacy Charter · Cookie Policy