Recent Breaches
Breaches
2026PowerSchool62.4M records stolen2026DISA Global Solutions3.3M records stolen2026Globe Life850K records stolen2026NHS ScotlandUndisclosed records stolen2026HertzUndisclosed records stolen2025Marks & Spencer9.4M records stolen2025PayPal35K records stolen2025Jaguar Land RoverUndisclosed records stolen2025Co-operative GroupUndisclosed records stolen2024National Public Data2.9B records stolen2024Ticketmaster560M records stolen2024Change Healthcare100M+ records stolen2024AT&T73M records stolen2024Dell Technologies49M records stolen2023Progress Software (MOVEit)77M+ records stolen202323andMe6.9M records stolen2023Royal MailOperations halted records stolen2023British LibraryUndisclosed records stolen2023MGM ResortsUndisclosed records stolen2022Uber57M records stolen2022LastPass33M records stolen2022Optus9.8M records stolen2022Medibank9.7M records stolen2022Twitter5.4M records stolen2026NHS ScotlandUndisclosed records stolen2026HertzUndisclosed records stolen2025Marks & Spencer9.4M records stolen2025PayPal35K records stolen2025Jaguar Land RoverUndisclosed records stolen2025Co-operative GroupUndisclosed records stolen2024National Public Data2.9B records stolen2024Ticketmaster560M records stolen2024Change Healthcare100M+ records stolen2024AT&T73M records stolen2024Dell Technologies49M records stolen2023Progress Software (MOVEit)77M+ records stolen202323andMe6.9M records stolen2023Royal MailOperations halted records stolen2023British LibraryUndisclosed records stolen2023MGM ResortsUndisclosed records stolen2022Uber57M records stolen2022LastPass33M records stolen2022Optus9.8M records stolen2022Medibank9.7M records stolen2022Twitter5.4M records stolen2026PowerSchool62.4M records stolen2026DISA Global Solutions3.3M records stolen2026Globe Life850K records stolen
View All →
Control Module

FV-Unlink: Credential and Session Isolation

Credential theft is the primary method attackers use to move laterally. Unlink separates administrative credentials from production network paths, ensuring that stolen credentials cannot reach the systems they govern.

Back to Control
Control

Control Module

If your administrative credentials can reach systems from the same network paths that attackers traverse, your security depends on credentials never being stolen. That is not a realistic assumption.

80%

Of breaches involve compromised credentials

Zero

Production paths reachable with administrative credentials alone

Physical

Separation between credential stores and production networks

100%

Administrative sessions isolated and recorded

The Problem

When credentials are the keys, credential theft opens every door.

Credential Reuse

Attackers harvest credentials through phishing, credential stuffing, or memory scraping and use them on production network paths that trust those credentials implicitly.

Lateral Movement via Trust

Valid credentials allow attackers to move between systems as trusted users. Detection systems struggle to distinguish malicious use of valid credentials from legitimate administration.

Shared Authentication Infrastructure

Active Directory and identity providers serve both production and management systems. Compromise of the identity infrastructure gives attackers access to everything.

The Scenario

Scenario: Credential Theft Without Lateral Movement

An attacker compromises a domain administrator account through a phishing campaign targeting the IT team. They attempt to use the credentials to access file servers, database systems, and backup infrastructure. With Unlink, the administrative credentials are valid only on the physically separate management network. From the production network where the phishing payload executed, those credentials cannot reach any management interface because the physical path does not exist. The attacker has valid credentials but no path to use them.

"The red team harvested our domain admin credentials in the first hour. They spent the remaining four days trying to find a path from the production network to a management interface. With Unlink, there was no path to find."

Module Overview

Credential theft without a path to exploit.

FV-Unlink separates administrative credentials from production network paths, ensuring that credential theft does not translate to system compromise. Even valid credentials are useless without access to the physically separate management network.

  • Physical separation between credential domains
  • Credentials bound to management network only
  • Session isolation on separate physical infrastructure
  • Separated identity infrastructure for management and production
  • Privileged access workstations on the management network
  • Complete session recording on disconnected storage
Unlink

Unlink — How It Works

Module 1 of 4

Unlink places administrative sessions on physically separate network paths from production traffic. Even valid administrative credentials cannot reach management interfaces from the production network because the physical connection does not exist. Credentials are bound to the management network only.

Featured In

TechRadar ProConnected BritainTotal TelecomSecurity BuyerComms BusinessComms DealerBlocks & FilesYahoo FinanceGlobeNewswireChannel InsiderUK DirectorSecurityBriefPCRBusiness Time in EssexTechRadar ProConnected BritainTotal TelecomSecurity BuyerComms BusinessComms DealerBlocks & FilesYahoo FinanceGlobeNewswireChannel InsiderUK DirectorSecurityBriefPCRBusiness Time in Essex

Key Capabilities

Credential Binding

Administrative credentials are bound to the management network. They cannot authenticate on production network paths regardless of how they were obtained.

Session Isolation

Administrative sessions exist on physically separate network paths. No session bridging, no jump hosting from production to management.

Identity Infrastructure Separation

Authentication services for management and production are physically separated. Compromise of production identity infrastructure does not affect management access.

Privileged Access Workstations

Administrative work is performed from dedicated workstations on the management network, physically separated from general-purpose corporate devices.

Session Recording

Every administrative session is recorded on physically disconnected storage, providing complete visibility into privileged activity.

Compliance Alignment

Credential isolation maps directly to ISO 27001 privileged access management, NIST CSF identity controls, and NIS2 access governance requirements.

Demo to Live

Adoption Guide

Step 1

Credential Path Audit

Map every credential that can reach management interfaces from the production network, identifying shared authentication infrastructure and bridged paths.

Step 2

Isolation Architecture Design

Design physically separate management and production credential domains with dedicated access workstations and independent identity infrastructure.

Step 3

Core Admin Pilot

Deploy credential isolation for core infrastructure administrators, testing management network access, session recording, and emergency procedures.

Step 4

Full Credential Isolation

Extend to all privileged access with automated session governance, separated identity infrastructure, and continuous compliance evidence.

Step 1

Credential Path Audit

Map every credential that can reach management interfaces from the production network, identifying shared authentication infrastructure and bridged paths.

Step 2

Isolation Architecture Design

Design physically separate management and production credential domains with dedicated access workstations and independent identity infrastructure.

Step 3

Core Admin Pilot

Deploy credential isolation for core infrastructure administrators, testing management network access, session recording, and emergency procedures.

Step 4

Full Credential Isolation

Extend to all privileged access with automated session governance, separated identity infrastructure, and continuous compliance evidence.

Questions

Frequently Asked

Ready to take the next step?

See how Control can govern your data paths with physical enforcement no software exploit can bypass.

    Your privacy matters

    We use cookies to keep the site running smoothly and to understand how you use it. You are in control. Privacy Charter · Cookie Policy