Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control for ransomware containment

Contain ransomware through physical path severance.

Ransomware relies on network reachability to spread, encrypt and extort. When the paths it depends on are physically severed, lateral movement stops, and recovery assets stay off the network.

  • Lateral movement
  • Backup destruction
  • Dwell time exploitation

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The challenge

Ransomware exploits the connections organisations depend on.

If ransomware can reach your backups, they are part of the attack. If it can traverse between network segments, containment is theoretical. Physical disconnection makes containment real.

  1. Physical path disconnection across network zones on an authorised command, in milliseconds per zone.

  2. Verified control-plane baselines held by the Archive module have no live network path to production.

  3. Network segments are physically separated during normal operations, limiting the blast radius.

Challenge 1

Lateral movement.

Once inside the perimeter, ransomware traverses network segments through legitimate pathways, escalating privileges and encrypting systems faster than response teams can isolate them.

Answered byFast severance

Challenge 2

Backup destruction.

Modern ransomware specifically targets backup infrastructure. Network-connected recovery systems are encrypted alongside production data.

Answered byOffline control-plane baselines

Challenge 3

Dwell time exploitation.

Attackers spend weeks mapping the network before detonation, identifying backup schedules, disabling security tools and positioning payloads.

Answered byPre-positioned segmentation

The scenario

Scenario: ransomware detonation in a multi-site enterprise.

Backups, immutable storage and network segmentation were all reachable from every other system, so all of it was encrypted. Step through it, or play it through.

Step 1 of 2

The attack path

A logistics company detects ransomware encryption beginning on a file server at 02:14 on a Saturday morning. The malware has been resident for 18 days, mapping shares, identifying backup schedules and deploying payloads to 340 systems across four sites.

The attackers disabled volume shadow copies and encrypted the backup server before detonating the primary payload.

The path
Always there
What the attacker needs
A foothold and time

An illustrative scenario.

Layer 1
Path severance, zone by zone
Out of band
The command path
Offline
Recovery baselines held by Archive
Logged
Every severance and recovery action

Where Control breaks the chain

Where Control breaks the ransomware chain.

Ransomware operators rely on a predictable sequence: get in, get quiet, get everywhere, then encrypt. Control removes the network reachability each stage depends on.

  1. Physical severFirebreakPhysically opens or closes connection paths to prevent unauthorised access and stop attack progression.
  2. Zone boundaryIsolateSeparates systems and networks into controlled zones to reduce lateral movement and enforce trust boundaries.
  3. Named accessLockRestricts access through identity, authority, policy, permission and operational controls.
  4. Remove trustUnlinkRemoves persistent connections, live dependencies and inherited trust that keep sensitive assets exposed.
  5. Integrity checkValidateChecks whether a request, command or approval should proceed before access, action or transfer is allowed.
  6. Time-bound pathRelayAllows connectivity only when needed, for a defined purpose, under controlled conditions and for a limited time.
  7. Preserve, freeze, accessArchivePreserves critical files and records for recovery, retention, compliance, continuity and evidential integrity.
  8. Controlled moveTransferControls how sensitive assets move into, out of or between protected environments through approved paths.
  9. Trigger, act, terminateExecuteInitiates control actions when a policy, approval, schedule, incident state or supervisory override requires it.

Explore the Control Blueprints

Capabilities

What you get with every deployment.

Six things Control gives the team, from the first boundary to the audit afterwards.

Ransomware

Fast severance

Physical path disconnection across network zones on an authorised command, in milliseconds per zone.

Ransomware

Offline control-plane baselines

Verified control-plane baselines held by the Archive module have no live network path to production.

Ransomware

Pre-positioned segmentation

Network segments are physically separated during normal operations, limiting the blast radius.

Ransomware

Multi-party authorisation

Emergency severance and recovery operations require multiple authorised parties.

Ransomware

Tamper-evident forensics

Network path changes, access events and recovery operations are logged to physically disconnected storage.

Ransomware

Regulatory evidence

Automated logging that can help support ICO notification and NIS2 incident reporting.

Adoption guide

From first boundary to routine operation.

Four steps, piloted on one site before it extends across the estate.

  1. 1

    Lateral movement audit

    Map every network path that ransomware could traverse between segments, including backup infrastructure.

  2. 2

    Containment architecture

    Design physical segmentation zones with Firebreak points at every critical boundary and Archive positions for recovery.

  3. 3

    Tabletop exercise

    Simulate a ransomware detonation with physical path severance, testing response times.

  4. 4

    Production deployment

    Deploy across all network zones with alerting integration and continuous compliance evidence.

Questions

What teams ask first

Firebreak severs a path in milliseconds, zone by zone, over an out-of-band command, triggered by an operator, a scheduler or your SOC tooling.

They are held by the Archive module with no live network path to production, physically disconnected between sessions.

Immutability is enforced in software on a connected platform. Control removes the path itself, so there is nothing for the ransomware to traverse.

They stay isolated for forensic analysis while recovery runs from known-good copies held offline.

All questions

Speak to the team to organise a PoC.

Walk through your blueprint with the Firevault team and scope a proof of concept on your estate. 30 minutes, no sales pitch.