Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control for defence

National security-grade network severance and isolation.

Defence networks carry the most sensitive information a nation possesses, and the threat landscape includes the most capable adversaries on earth.

  • Nation-state persistence
  • Cross-domain risks
  • Legacy military systems

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The challenge

Defence networks face state-level adversaries.

Defence information requires defence-grade protection: boundaries between domains that are physical, not only certified in software.

  1. Access requires authorisation from multiple individuals across different roles.

  2. Automated compliance logging that can help support defence security policy and assurance.

  3. Out-of-band management via dedicated, secured communications keeps control plane access available.

Challenge 1

Nation-state persistence.

State-sponsored actors maintain persistent access campaigns against defence networks.

Answered byMulti-party access

The scenario

Scenario: cross-domain boundary compromise.

A certified, accredited cross-domain solution can still pass every penetration test and carry a covert channel. Step through it, or play it through.

Step 1 of 2

The attack path

A state-sponsored group identifies a misconfiguration in a cross-domain solution that allows carefully crafted data packets to bypass content inspection.

The channel operates for months at low bandwidth, evading detection systems tuned for bulk data movement.

The path
Always there
What the attacker needs
A foothold and time

An illustrative scenario.

Layer 1
Classification boundary enforcement
Brokered
Movement between domains
Multi-party
Authorisation for every crossing
Logged
Every access, transfer and decision

Where each module sits

Where each Control module is deployed across admin, mission and classified domains.

Defence estates separate admin networks from mission systems and classified enclaves. Control puts a real boundary between each.

  1. D1 to DMZ and D3 to D4 linksIsolateAdmin, mission and classified each sit on their own physical fabrics.
  2. D0 to D1 and D1 to DMZ linksFirebreakA physical cut on the public and admin boundaries.
  3. D0 to D1 link and the cross-domain DMZValidateRequests crossing into trusted estates are checked for origin, integrity and authority.
  4. Cross-domain DMZTransferMovement between domains is brokered, often one-way.
  5. D2 to D3 linkExecuteMission actions hold until the right approval is in place.
  6. D3 to D4 linkLockClassified access ties to named individuals with the right clearance, device and authority.

Explore the Control Blueprints

Capabilities

What you get with every deployment.

Six things Control gives the team, from the first boundary to the audit afterwards.

Defence

Multi-party access

Access requires authorisation from multiple individuals across different roles.

Defence

Defence security evidence

Automated compliance logging that can help support defence security policy and assurance.

Defence

Independent communications

Out-of-band management via dedicated, secured communications keeps control plane access available.

Defence

Forensic-grade logging

Every access, transfer and authorisation decision is recorded in tamper-evident logs.

Defence

Recovery capability

Verified control-plane baselines support recovery after an incident.

Defence

Manufactured by Firevault

Firebreak®, the physical control point, is manufactured by Firevault, selected for the NATO DIANA and MoD DASA accelerator programmes.

Adoption guide

From first boundary to routine operation.

Four steps, piloted on one site before it extends across the estate.

  1. 1

    Classification boundary assessment

    Map all cross-domain connections and data flows between classification levels.

  2. 2

    Sovereign architecture design

    Design physically separated classification zones, with Control modules enforcing each boundary.

  3. 3

    Accredited pilot

    Deploy within a controlled environment with classification boundary enforcement.

  4. 4

    Operational capability

    Full deployment across defence infrastructure, with verified baselines.

Questions

What teams ask first

It sits on the paths between domains rather than inside them: Isolate keeps each domain on its own fabric, and Transfer brokers movement between them.

Talk to the team about your coalition topology. Movement between domains is brokered, often one-way, and every crossing needs multi-party authorisation.

Firebreak® hardware is manufactured by Firevault, which was selected for the NATO DIANA and MoD DASA accelerator programmes, and supplied by Firevault within Control.

All questions

Speak to the team to organise a PoC.

Walk through your blueprint with the Firevault team and scope a proof of concept on your estate. 30 minutes, no sales pitch.