Stop Kill-Chain Ransomware
Stop ransomware moving, spreading or reaching the crown jewels.
- CP-01
- Controls the path
What this Blueprint does.
Lateral movement prevention across IT and OT
Stop ransomware moving, spreading or reaching the crown jewels.
Lateral movement prevention across IT and OT
Financial services, Healthcare, Public sector, Defence
How CP-01 stops the kill chain.
A FIRE-led pattern. The path between any compromised zone and the crown jewels is severed by default, opened only as a named event, and severed again on alert.
Grounded in MITRE ATT&CK TA0008, IEC 62443-3-3 SR 5.1 and NCSC ransomware guidance.
User and endpoint zone
Where the
Where the foothold typically lands
Isolate
LockNamed, scoped reach into core services
Core IT services
Identity, file,
Identity, file, mail, collaboration
Firebreak
Execute
UnlinkSevered by default. Restored only as an approved Execute event.
Crown-jewel systems
Database, ERP,
Database, ERP, core record systems
Crown jewels · detail callout
Offline recovery vault
Tamper-evident copies, not reachable on the live network. The ransomware cannot touch them.
Modules & symbols
IsolateZone boundaryLockNamed accessFirebreakPhysical severExecuteApproved actionUnlinkRemove trustHow the CP-01 pattern composes.
The Blueprint in full.
Firebreak physically breaks the connection path. Isolate separates the affected environment. Execute triggers the control action the moment risk is detected. Unlink removes the persistent dependencies and Lock holds the crown jewels behind identity controls that ransomware cannot reach.
Where CP-01 applies.
Build control around your environment
Talk to our team about composing this Blueprint for your estate.
Takes about 2 minutes. No account needed.