Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control for retail

POS network segmentation and payment path control.

Retail networks span thousands of locations, each handling card payments through POS systems tied to corporate infrastructure. One compromised store can expose the whole estate.

  • POS compromise
  • Flat store networks
  • Supply chain risks

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The challenge

Retail networks are distributed and high-value targets.

When guest Wi-Fi and a payment terminal share a network, every customer browsing the internet is a potential path to payment card data.

  1. Payment configurations held in secured Firevault Bunkers.

  2. POS updates and configuration changes need sign-off from both IT operations and security.

  3. Automated logging that can help support segmentation requirements across the estate.

Challenge 2

Flat store networks.

Many stores run POS, back office, CCTV and guest Wi-Fi on one network, allowing lateral movement from any entry point.

Answered byMulti-party update control

Challenge 3

Supply chain risks.

POS software vendors, payment processors and maintenance contractors each create persistent pathways into the payment environment.

Answered byPCI DSS 4.0 evidence

The scenario

Scenario: estate-wide POS compromise.

A malicious update can only exfiltrate data if the POS network has a path to the internet. Step through it, or play it through.

Step 1 of 2

The attack path

Attackers tamper with a POS update server, and malware spreads to stores across the estate.

Over weeks, it steals card numbers through the shared store internet connection.

The path
Always there
What the attacker needs
A foothold and time

An illustrative scenario.

Layer 1
Separation of POS from store internet
Two-party
Sign-off for POS updates
Windowed
Vendor and maintenance access
Logged
Evidence for PCI DSS 4.0 segmentation

Where each module sits

Where each Control module is deployed across stores, e-commerce, payments and vendors.

A retail estate carries an internet edge, a corporate office, stores, e-commerce and a cardholder data environment. Control puts a real boundary at every change of trust.

  1. Public and vendor boundariesFirebreakA physical cut that takes the live connection away during an incident.
  2. Internet to DMZ and corporate to e-commerceValidateChecks the origin and integrity of inbound traffic and cross-tier requests.
  3. DMZ to corporate, corporate to e-commerce, stores to paymentsIsolateEach zone sits on its own physical fabric.
  4. E-commerce to store and store to paymentsLockStore and payment access ties to named users with the right entitlements.
  5. Store to paymentsExecuteCross-system actions hold until approval is in place.
  6. E-commerce to store and vendor linkRelayStore and vendor paths open only for the duration of the work.
  7. Vendor linkUnlinkWhen a relationship ends, Unlink removes the persistent connection and the trust it carried.

Explore the Control Blueprints

Capabilities

What you get with every deployment.

Six things Control gives the team, from the first boundary to the audit afterwards.

Retail

Payment data in Firevault Bunkers

Payment configurations held in secured Firevault Bunkers.

Retail

Multi-party update control

POS updates and configuration changes need sign-off from both IT operations and security.

Retail

PCI DSS 4.0 evidence

Automated logging that can help support segmentation requirements across the estate.

Retail

Cellular failover

Out-of-band management of store networks, independent of primary WAN links.

Retail

Estate-wide audit trail

Every access, update and authorisation at every location, recorded in centralised, tamper-evident logs.

Retail

Rapid store recovery

Verified POS configuration baselines support restoring a compromised store without relying on production systems.

Adoption guide

From first boundary to routine operation.

Four steps, piloted on one site before it extends across the estate.

  1. 1

    Estate network assessment

    Audit representative stores to find payment path exposure and segmentation gaps.

  2. 2

    Store zone architecture

    Design standard zones for POS, back office, CCTV and guest access, with Control modules at each boundary.

  3. 3

    Pilot store deployment

    Roll out to a representative group of stores with payment isolation, controlled updates and compliance logging.

  4. 4

    Estate-wide rollout

    Phase the deployment across all locations with central management, verified baselines and continuous PCI DSS evidence.

Questions

What teams ask first

With a standard store zone design, deployed in phases and managed centrally, with out-of-band management for each store.

It can help support it: physical segmentation of the payment environment, logged automatically across the estate.

Yes. Payment traffic runs on its own path as it does today; what changes is that other store traffic cannot reach it.

Maintenance paths open for the duration of the work through Relay, with the right approval, and close again afterwards.

All questions

Speak to the team to organise a PoC.

Walk through your blueprint with the Firevault team and scope a proof of concept on your estate. 30 minutes, no sales pitch.