ControlControl need · Live incident containment

In a live incident, the only question is how fast can you cut the path.

Detection tells you something is wrong. Containment decides what it costs. If severing a connection means logging into a console, finding the right rule and hoping the change applies, containment is already competing with the attacker for time.

Open Blueprint CP-02 See where each module sits

Cyber Essentials Plus certifiedEnforced at Layer 1Commanded out of band

As featured in

Written for executives
Incident response context
Leads to Blueprint CP-02
Provable severance

Enforced at: Layer 1, out of band
In this design: 3 of 9 modules
Blueprints: CP-02
Adoption: One boundary first

What is exposed

During an incident, delay is the exposure.

The technical damage is usually decided in the first hour. These are the things that are exposed while the response is still being organised.

The minutes before containmentBetween detection and effective severance, the attacker keeps moving. Every additional route that stays live extends the eventual scope.
The authority to actCutting a connection has business consequences, so people hesitate. Without a pre-agreed action, the decision escalates while the clock runs.
The recovery positionIf recovery copies are still reachable while the incident is live, the organisation can lose the thing it needs to restore from.
The record of what happenedRegulators, insurers and boards ask what was severed and when. Configuration history is a weak answer to a question about physical state.

With Control

1Named paths severed immediately, including out of hours
2A control plane that does not depend on the compromised environment
3Supplier and remote links closed as part of the same action
4A physical state that can be shown to insurers and regulators

The idea

The point of physical Control during an incident is that severance is immediate, unambiguous and does not rely on the health of the systems under attack.

Control the pathFirebreak, Isolate, Relay and Execute decide which paths exist.
Protect the assetValidate, Archive, Unlink, Lock and Transfer decide what those paths can touch.
Commanded out of bandOver management Ethernet, cellular SMS or an authenticated API that never crosses the production network.

The outcome

Prevention fails occasionally. Containment has to work every time.

Pre-agreed paths are broken on signal from a control plane that sits outside the affected estate, and the state is visible rather than inferred.

Prevention fails occasionally. Containment has to work every time.
Point	Containment by configuration	Containment by physical severance
01	Severance takes as long as the console and the approval chain allow	Named paths severed immediately, including out of hours
02	Actions are performed on infrastructure that may be compromised	A control plane that does not depend on the compromised environment
03	Supplier and remote paths are handled last, if at all	Supplier and remote links closed as part of the same action
04	Proof of containment is a configuration record	A physical state that can be shown to insurers and regulators
05	Restoring service and preserving evidence pull in opposite directions	Evidence and recovery copies preserved outside the blast radius

Which path needs controlling

Containment is a list of connections you have already agreed to cut.

Deciding this in advance is what removes hesitation on the night. Each of these is a business decision, taken once, in daylight.

Public services and remote users

Internet and external boundary

Today: Severed by rule change under pressure
With Control: Cut physically on signal, restored on approval

Applications and users in that zone

Affected zone to the rest of the estate

Today: Depends on segmentation holding
With Control: Isolated at hardware level while the incident runs

Vendors and managed service providers

Third-party and supplier links

Today: Often forgotten during the first hours
With Control: Closed automatically as part of the containment action

Response and forensics teams

Recovery copies and evidence

Today: Reachable from the affected environment
With Control: Held with no live path, released under multi-party approval

The Blueprint covers how these actions are triggered, sequenced and reversed, together with the evidence each step produces. This page is here to get the list agreed.

Why the exposure exists

Containment was designed as a procedure, not as a capability.

Most incident response plans describe who should be called. Far fewer describe a mechanism that physically removes a connection in seconds and proves it afterwards.

Severance is a manual actPulling a path apart usually means editing configuration on the very estate that is under attack.
Nobody wants to be wrongDisconnecting a business system has a cost, so people wait for certainty that never arrives in time.
Control planes share the estateIf the tools used to contain an incident sit inside the affected environment, they may already be compromised.
Out of hours is the normIncidents are timed deliberately for weekends and holidays, when the fewest people are available to act.
Evidence is an afterthoughtPreserving logs competes with restoring service, and service usually wins.
The plan is rarely rehearsed physicallyTabletop exercises test the conversation. They seldom test whether the path can actually be severed.
Start with the path, not the toolEvery incident that spreads does so along a connection that was already there. Control begins by naming that connection in plain language, before anyone talks about products.
Make the default state disconnectedA path that exists only when it is needed cannot be used at three in the morning by someone who should not have it. Disconnection is the resting state, not the emergency response.
Open on approval, close on scheduleWhen work genuinely needs a connection, Control opens it for a named person, a stated purpose and a fixed period, then closes it again without anyone having to remember.
Prove it physically, not on paperA policy says the path should be closed. Physical control shows that it is. That difference is what auditors, insurers and boards are actually asking about.

With the containment list agreed, the Blueprint sets out how those actions are wired, triggered and reversed, and what each step leaves behind as evidence.

What you get

Containment becomes an action, not a project.

Named paths severed immediately, including out of hours
A control plane that does not depend on the compromised environment
Supplier and remote links closed as part of the same action
A physical state that can be shown to insurers and regulators
Evidence and recovery copies preserved outside the blast radius

Composed from one Control Blueprint

CP-02Contain Active BreachesWhen prevention fails, containment must be physical, immediate and provable.Open CP-02

Firebreak® is supplied by Firevault within Control. See the Firebreak® range

How it works

Where each module sits.

Choose a module to see what it does in this environment.

What it does here

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore Firebreak

From demo to live

Start with one boundary. Build from there.

01
Path inventory

Catalogue every live path between your zones, suppliers and management tools.
02
Boundary design

Map Control modules to your physical topology and agree which paths need governing.
03
Pilot one boundary

Deploy on a single boundary and prove the approach without disrupting operations.
04
Estate-wide go-live

Extend across the estate and feed every path change into your audit and compliance workflow.

Control the path, protect the asset. This page is about severing paths while an incident is running. Preserving the data and evidence you will rebuild from is a different job, and it belongs in Offline Secure Storage rather than in a containment plan. Protect the copies you rebuild from

Questions

What to ask before a pilot.

Severance actions are defined in advance, scoped to named paths and held under authority controls. The intention is to remove hesitation about agreed actions, not to give anyone a general off switch.

The action is physical and immediate once triggered. What usually takes time in an incident is deciding and locating, and both of those are resolved in advance.

That is precisely why the control plane sits outside the estate it protects. Containment must not depend on the health of the environment under attack.

No. Smaller organisations often have fewer people available at the moment an incident starts, which makes a pre-agreed physical action more valuable, not less.

Talk to the team

We will map your environment, agree the paths that need governing, and show where each module would sit.

Speak to the team