ControlNetwork Evolution & Rapid Protection (#NEARP)

Policy-Enforced Path Control for IT Infrastructure

Every connected device, every open port, every accessible endpoint is a potential entry point. If data is reachable, it is vulnerable. Traditional perimeter security cannot change that, physical path control can.

See where each module sits

Cyber Essentials Plus certifiedEnforced at Layer 1Commanded out of band

As featured in

Enforced at: Layer 1, out of band
In this design: 8 of 9 modules
Blueprints: CP-01 to CP-10
Adoption: One boundary first

The Challenge

Reachability is the root of all breaches.

Credential TheftStolen credentials give attackers legitimate access paths through firewalls and EDR.
Lateral MovementEvery system on the network is reachable from every other, no physical boundaries exist.
Zero-Day BypassesZero-day vulnerabilities bypass all signature-based defences.

Illustrative scenario

1Scenario: Credential Theft to Lateral MovementAn attacker purchases valid VPN credentials from an initial access broker on a dark web marketplace. They authenticate through the corporate VPN at 2:14am, bypass MFA using a session token replay, and land on a developer workstation. Over 72 hours, they move laterally across 340 systems, domain controllers, backup servers, source code repositories, and the HR database. EDR flags anomalous behaviour on day 3, but by then, 2.1TB of data has been staged for exfiltration. Active Directory credentials, customer PII, and proprietary source code are all compromised. With Control, the Firebreak module physically disconnects critical data stores from the network. The Lock module enforces identity-bound access requiring biometric verification. The attacker's stolen credentials are worthless, there is no network path to reach the data, regardless of what access they possess.

We had EDR, SIEM, zero-trust network access, and a 24/7 SOC. The attacker still moved through 340 systems in 72 hours using a single stolen credential. We realised detection is not enough, we needed to remove the paths entirely.

The idea

IT networks gain a physical governance layer that removes data reachability as an attack vector. Critical assets like Active Directory credentials, database backups, source code, and encryption keys remain physically disconnected until policy-authorised access occurs, integrating with existing security infrastructure.

Control the pathFirebreak, Isolate, Relay and Execute decide which paths exist.
Protect the assetValidate, Archive, Unlink, Lock and Transfer decide what those paths can touch.
Commanded out of bandOver management Ethernet, cellular SMS or an authenticated API that never crosses the production network.

What you get

Remove reachability as an attack vector.

AD Credential ProtectionActive Directory backups, KRBTGT keys, and service account credentials stored in physically disconnected vaults, immune to credential harvesting attacks like DCSync and Golden Ticket.
SIEM/SOAR IntegrationEvery access attempt, data movement, and policy decision feeds into existing security tools via syslog and API, enriching SOC workflows with physical-layer intelligence.
Identity-Bound AccessBiometric verification at the physical layer ensures only named, verified individuals can authorise data movement, credentials alone are insufficient.
Flexible DeploymentDeploys inline in the rack alongside existing infrastructure or out-of-band as a dedicated security layer, no network re-architecture required.
Automated ComplianceContinuous, immutable audit logging maps to ISO 27001, SOC 2, GDPR Article 32, and Cyber Essentials Plus, compliance evidence generated automatically.
Source Code ProtectionProprietary source code, IP, and trade secrets stored in offline vaults with identity-bound access, protecting against both external theft and insider exfiltration.

Firebreak® is supplied by Firevault within Control. See the Firebreak® range

How it works

Where each module sits.

Choose a module to see what it does in this environment.

What it does here

Physically disconnects critical data stores, Active Directory backups, database exports, source code repositories, encryption keys, from the corporate network. No firewall rule, no ACL, no micro-segmentation policy. The network path does not exist. An attacker with domain admin credentials cannot reach data that has no connection to any network they can access.

Explore Firebreak

Module deployment · enterprise IT network

Where each Control module is deployed across users, identity, apps, data and vendors.

Enterprise IT lays out as tiers: an internet edge at the top, a perimeter or DMZ below it, then user endpoints, identity, applications and data. Control puts a real boundary at the places where trust actually changes.

Grounded in NIST SP 800-207 (Zero Trust), ISO 27001 Annex A.13 and NCSC Cyber Assessment Framework.

Internet edge

External

WAF

DDoS

DNS

Firebreak

Validate

External traffic stops in the perimeter.

Perimeter / DMZ

DMZ · trust boundary

Reverse proxy

Email gateway

All inbound traffic terminates here.

Isolate

Validate

Endpoints and perimeter on separate fabrics.

Endpoints

Laptops

Mobile

BYOD

User estate, including contractors.

Validate

Lock

Every request to identity is checked and named.

Identity

AD / SSO

MFA

PAM

Standing privilege is the exception, not the default.

Lock

Execute

App access ties to named identities and approved actions.

Applications

Web apps

APIs

Internal tools

Isolate

Transfer

Data moves on controlled routes only.

Data

Databases

File shares

Object store

Where the real value sits.

Relay

Firebreak

Unlink

Vendor and MSP access opens on a schedule and closes again.

VND

Vendor zone

DMZ · trust boundary

MSP / RMM

Software supply

Third-party access opens on a schedule.

OSS

Crown jewels

Off-network

Detail callout · A

Offline Secure Storage

Archives, recovery sets and the data you need to rebuild if the live estate is lost. Files and data of any kind.

Offline by design · secure by default

Modules & symbols

FirebreakPhysical sever

ValidateIntegrity check

IsolateZone boundary

LockNamed access

ExecuteApproved action

TransferControlled move

RelayTime-bound path

UnlinkRemove trust

DMZ boundaryTrust transition

OSS calloutOff-network detail

Where each module is deployed, and what it does there.

One row per module. Placement on the network, then plain-English purpose at that point.

Firebreak

On the T0 to T1 link and the vendor link

Real hardware off switches on the public and vendor boundaries, ready to drop the live path the moment an incident is called.
Validate

On the T0 to T1, T1 to T2 and T2 to T3 links

Inbound traffic and identity requests are checked for origin, integrity and authority before they progress.
Isolate

On the T1 to T2 link and the T4 to T5 link

Endpoints, applications and data sit on their own fabrics. A compromised laptop does not have a direct route to a database.
Lock

On the T2 to T3 link and the T3 to T4 link

App and data access tie to a named identity, on the right device, with the right entitlement.
Execute

On the T3 to T4 link

Privileged actions hold until the right approval is in place.
Transfer

On the T4 to T5 link

When data has to move into or out of the data tier, Transfer governs how it crosses and where it lands.
Relay

On the vendor link

Vendor and MSP access opens for the window of work and not a minute more.
Unlink

On the vendor link

When a vendor relationship ends, Unlink removes the persistent connection and the inherited trust.

9: Governance modules controlling every data path
Zero: Attack surface when paths are closed
100%: Policy-enforced path governance
Full: Audit trail for every data movement

From demo to live

Start with one boundary. Build from there.

01
Network Reachability Assessment

Identify all lateral movement paths, standing connections, and data reachability vectors across your IT infrastructure, mapping the real attack surface.
02
Integration Architecture

Map Control modules to your existing SIEM, SOAR, IAM, and EDR stack, ensuring physical-layer intelligence feeds directly into security operations workflows.
03
Shadow Deployment

Deploy inline in the rack or out-of-band alongside existing infrastructure with zero network changes, validating path control policies in production conditions.
04
Enterprise Go-Live

Activate policy enforcement, automated compliance logging, and team onboarding across your IT environment with full SIEM/SOAR integration.

Every breach begins with reachability. If an attacker can reach your data, through a stolen credential, a zero-day exploit, or a misconfigured firewall, they will eventually take it. Control removes reachability itself, making your most critical data physically disconnected from any network path.

Questions

What to ask before a pilot.

Control feeds every access attempt, data movement, and policy decision into your existing SIEM/SOAR via syslog and API integration. It operates as a physical-layer addition to your defence-in-depth strategy, complementing EDR, NDR, IAM, and zero-trust architecture rather than replacing them. SOC analysts gain a new signal source: physical path state.

Yes, by removing the attack surface entirely. Zero-day exploits require a network path to reach the target. When critical data is physically disconnected via the Firebreak module, there is no path for any exploit, known or unknown, to traverse. This is defence by physics, not by signatures or heuristics.

Control offers two deployment models: inline (installed in your existing rack alongside servers and network equipment) or out-of-band (deployed as a dedicated security layer with no connection to production networks). Both models require zero changes to existing network architecture, applications, or security tooling.

Every data access, transfer attempt, policy decision, and identity verification is recorded in immutable, tamper-proof logs stored in physically separate infrastructure. These logs map directly to control requirements in ISO 27001 (Annex A), SOC 2 (Trust Services Criteria), GDPR Article 32, and Cyber Essentials Plus, providing audit-ready evidence without manual documentation effort.

Talk to the team

We will map your environment, agree the paths that need governing, and show where each module would sit.

Speak to the team

Policy-Enforced Path Control for IT Infrastructure

Reachability is the root of all breaches.

Remove reachability as an attack vector.

Where each module sits.

Where each Control module is deployed across users, identity, apps, data and vendors.

Where each module is deployed, and what it does there.

Start with one boundary. Build from there.

Network Reachability Assessment

Integration Architecture

Shadow Deployment

Enterprise Go-Live

What to ask before a pilot.

A different environment?

Talk to the team