Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control need · Ransomware containment

Ransomware does not break in everywhere. It travels.

One compromised laptop rarely ends a business. What ends a business is the set of connections that let the compromise reach finance, backups, production and the recovery copies on the same night. Control governs those connections so that a single foothold stays a single foothold.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

What is exposed

The damage is decided by what the first machine can reach.

Before any technology conversation, it is worth being honest about what is currently within reach of an ordinary compromised endpoint.

Operational stoppage

The systems that run the day

Finance, case management, scheduling, production planning. Reachable from ordinary user devices because that is what makes them useful.

Recovery removed

The backups you would rely on

Backup servers usually sit on the same network as the systems they protect, with credentials that can reach both. Attackers target them first.

Privilege inheritance

The administrative routes

Jump boxes, remote management tools and monitoring agents cross every boundary by design. A stolen credential inherits that reach.

Evidence loss

The evidence you will need

Logs and audit records held on the same estate can be encrypted or altered along with everything else, which turns a recovery into an investigation.

Why the exposure exists

Nobody designed this. It accumulated.

The paths that ransomware uses were almost always built for a good reason, then left open long after that reason ended. This is a governance problem before it is a security problem.

The honest position

Connectivity was the goal for twenty years. It was never revisited.

Every integration, every remote support arrangement and every convenience shortcut added a route. None of them came with an expiry date. The estate now carries more standing connectivity than any single person can describe, which is precisely what makes lateral movement fast.

Control the path, protect the asset.

  • Convenience became permanentA temporary connection opened for a project or a migration is almost never closed once the work finishes.
  • Segmentation lives in softwareFirewall rules and VLANs are configuration. Configuration can be changed, misapplied or bypassed with valid credentials.
  • Backups sit inside the blast radiusIf the recovery copy is reachable from the environment it protects, it shares that environment’s fate.
  • Nobody owns the mapConnections are added by different teams over years. There is rarely one person who can list every live path.
  • Speed favours the attackerDetection and response take minutes at best. Encryption across an open estate takes less.
  • Trust is inheritedSystems trust each other because they always have, not because that trust was ever assessed against today’s risk.

Which paths need controlling

Four connections decide how far an incident travels.

This is the part most organisations have never written down. Naming the paths is what turns an anxious conversation into a decision that can be made. Switch between today and with Control.

  • User estate to core systems

    Who uses itEvery employee device

    How it behaves todayStanding connection, always availableWhat Control governsReachable only through approved routes, closed by default outside them

  • Core systems to backup and recovery

    Who uses itBackup software and administrators

    How it behaves todayLive path with credentials that reach both sidesWhat Control governsRecovery copies held with no live path from production

  • Administrative and remote management

    Who uses itInternal IT and outsourced support

    How it behaves todayPersistent reach across every zoneWhat Control governsOpened for a named person and purpose, closed on schedule

  • Zone to zone inside the estate

    Who uses itApplications and integrations

    How it behaves todayGoverned by firewall configurationWhat Control governsEnforced physically, so a rule change cannot re-open it

This page deliberately stops at the level of paths and relationships. The zone architecture, module placement and deployment sequence sit in the Blueprint, where the technical detail belongs.

What physical Control changes

The change is in the connection state, not in your software.

Control does not add another agent to the estate or ask your teams to work differently. It changes whether a connection physically exists when nobody has asked for it.

Today

Standing connectivity

Paths exist continuously and are restrained by configuration. Containment depends on someone noticing an incident and acting correctly under pressure.

  • Every route is available at all times, including out of hours
  • Containment relies on detection speed and human response
  • Backups and recovery copies share the estate they protect
  • Segmentation can be undone by a credential or a rule change
  • The board is asked to trust a diagram rather than a state

With Control

Governed connectivity

The path is physically absent unless it has been opened for a stated purpose. Containment is a property of the architecture rather than a reaction to an alarm.

  • No standing path between the user estate and the crown jewels
  • Recovery copies with no live route from production
  • Support and administrative access opened on approval and closed on schedule
  • Boundaries that survive a misconfiguration or a stolen credential
  • A connection state that can be shown, not just described

A foothold is survivable. A foothold with reach is what becomes an incident.Connected when approved. Disconnected by default.

The Control philosophy

Control the path, protect the asset.

Control is a way of thinking about connectivity before it is a product set.

  1. 1

    Start with the path, not the tool

    Every incident that spreads does so along a connection that was already there. Control begins by naming that connection in plain language, before anyone talks about products.

  2. 2

    Make the default state disconnected

    A path that exists only when it is needed cannot be used at three in the morning by someone who should not have it. Disconnection is the resting state, not the emergency response.

  3. 3

    Open on approval, close on schedule

    When work genuinely needs a connection, Control opens it for a named person, a stated purpose and a fixed period, then closes it again without anyone having to remember.

  4. 4

    Prove it physically, not on paper

    A policy says the path should be closed. Physical control shows that it is. That difference is what auditors, insurers and boards are actually asking about.

  1. NeedSets the direction
  2. ControlSets the rule
  3. BlueprintSets the architecture
  4. Modules and Firebreak®Implement it

Where this goes next

The Blueprint for this need is CP-01 Stop Kill-Chain Ransomware.

Once the paths are agreed, the Blueprint turns the decision into an architecture: where the boundaries sit, what governs each crossing and how the pattern is deployed without interrupting operations.

CP-01 Stop Kill-Chain Ransomware

Stop ransomware moving, spreading or reaching the crown jewels. Applied to lateral movement prevention across IT and OT.

What the Blueprint adds

  • The zone architecture that separates the user estate, core systems and recovery copies
  • Where each module sits on the path and what it governs at that point
  • How approved crossings are opened and closed without manual work
  • A deployment sequence that can be phased alongside live operations
  • The evidence the pattern produces for auditors, insurers and the board

Lead module

FV-Firebreak

Physically opens or closes connection paths to prevent unauthorised access and stop attack progression.

Read FV-Firebreak

Lead module

FV-Isolate

Separates systems and networks into controlled zones to reduce lateral movement and enforce trust boundaries.

Read FV-Isolate

Lead module

FV-Execute

Initiates control actions when a policy, approval, schedule, incident state or supervisory override requires it.

Read FV-Execute

Questions

What teams ask about ransomware

No. Those tools keep doing their job. Control sits underneath them and governs whether the physical path exists at all, so that a failure in software does not become unlimited reach.

Control does not add another agent to the estate or ask your teams to work differently. Approved crossings are opened and closed without manual work, and access is opened on approval and closed on schedule.

The deployment sequence is phased alongside live operations. It starts with four connections: user estate to core systems, core systems to backup and recovery, administrative and remote management, and zone to zone.

This page agrees which paths matter and how each should behave. CP-01 Stop Kill-Chain Ransomware carries the zone architecture, module placement and deployment sequence.

All questions

You have the paths. The Blueprint has the architecture.

CP-01 Stop Kill-Chain Ransomware shows how these connections are governed in practice, module by module and boundary by boundary.