--- title: "Control Execute Module: controlled execution | Firevault" url: https://fire-vault.com/control-module/execute description: "Execute runs a scoped, human-approved task against your offline vault, then returns it to a disconnected state. See the workflow and full audit trail." lang: en-GB --- **FV-04 Execute**Control module · Control the path # The decision is made in advance. The action runs when it is needed. Execute carries out control actions you have agreed beforehand: on an approved request, a schedule or a security alert. It sends the command out of band to Firebreak® hardware, so the action does not depend on the network that may be in trouble. Book a Control demo: https://fire-vault.com/demo See it in action Image: Execute module icon (https://fire-vault.com/__l5e/assets-v1/295067c0-eee7-4418-8e64-6c5fe9227d4e/execute-icon.png) **Execute**Control the path Module FV-04 Execute Family Control the path The question it answers What runs, on whose trigger? Acts through Firebreak® at Layer 1 Command path Out of band What happens when ## The alert arrives at 02:00. Nobody is sure who can act. Detection tools are good at raising the alarm. What happens next often depends on who answers the phone. 1. 02:00**An alert fires.** Your SIEM sees unusual traffic heading for a critical system. 2. 02:20**Calls begin.** The on-call engineer needs approval to change anything and starts phoning managers. 3. 03:10**A rule is written.** An emergency change goes in an hour later, on a device that may itself be reachable. An alert tells you something is wrong. Execute makes sure the agreed action happens. See it in action ## Three triggers. Switch between an ad hoc response and Execute. The same operator request, schedule and alert, handled two ways. Each trigger turns into calls and a manual change. Timing depends on who is awake. Each trigger runs an action agreed in advance, sent out of band and recorded. Step by step 1. Step 1**Agree the actions** Decide which actions exist, on which paths, and what triggers each one. 2. Step 2**Agree the approvals** Name who may approve each action and when approval is needed. 3. Step 3**Trigger** An operator, schedule or alert starts the agreed action. 4. Step 4**Record** The request, approval, command and result are recorded. What Execute is ## The module that acts, within rules you set. Execute does not decide what is dangerous. It carries out the actions you agreed, through a path that stays independent. - **Agreed actions** Every action is defined in advance, with its path and its effect. - **Several triggers** Operator request, schedule or an approved security alert. - **Out-of-band command** Commands travel separately from the network being controlled. What it changes ## A response that does not depend on who answers the phone. Execute does not make an incident smaller on its own. It means the response you planned is the response that happens. ### Planned actions. Recorded outcomes. - Agreed actions run on agreed triggers - Approvals are part of the action, not a phone call - Commands do not rely on the affected network - Every action has a full record Where it fits ## Fracture, Isolate and Execute answer different questions. Fracture and Isolate decide whether connections exist. Execute does a different job, and most Plans use more than one module. | Module | Fracture | Isolate | Execute | | --- | --- | --- | --- | | The question it answers | Must this connection be physically disconnected now? | Which zones should never share a path? | What should run, on which trigger, and who approved it? | | Normal state | Connected, with a crossing ready to be disconnected | Zones held apart, crossings closed by default | Ready, with actions and approvals agreed | | When it acts | When a connection becomes dangerous | By design, before anything goes wrong | On an approved request, schedule or alert | | What it ends | An incident travelling along a live path | Trust that exists only because systems share a network | Responses that depend on phone calls and emergency changes | | Typical Plans | CP-01, CP-02 | CP-04, CP-05, CP-14 | CP-01, CP-02, CP-14 | Control Plans and Blueprints ## Where Execute does the work. Execute is the module that turns a Plan into action. Plans marked Proposed are awaiting technical approval. - CP-01**Ransomware Containment**_Cut the paths ransomware uses to spread before encryption reaches critical systems._: https://fire-vault.com/control-plan/stop-kill-chain-ransomware - CP-02**Live Incident Containment**_Physically disconnect the affected path during a live incident while the rest of the operation keeps running._: https://fire-vault.com/control-plan/contain-active-breaches - CP-14**Compromised Device Isolation**_Physically isolate one affected device from the network._: https://fire-vault.com/control-plan/compromised-device-isolation - CP-19**Autonomous System Intervention**_Disconnect the communications of an autonomous system._: https://fire-vault.com/control-plan/autonomous-system-intervention - **Control Plans**Twenty Plans, each solving one problem. All Control Plans (https://fire-vault.com/control-plans) - **Control Blueprints**Industry solutions that combine Plans. All Control Blueprints (https://fire-vault.com/control-blueprints) - **Fracture**Physically disconnect a connection. See Fracture (https://fire-vault.com/control-module/fracture) - **Isolate**Hold zones apart by design. See Isolate (https://fire-vault.com/control-module/isolate) Questions ## What network and security teams ask. Want to see it on real hardware? We will show you. Book a Control demo: https://fire-vault.com/demo Does Execute act on its own? Only within the actions and triggers you agree. Whether an alert can trigger an action directly, or needs approval first, is your decision for each path. How is Execute different from Fracture? Fracture is the disconnection of a connection. Execute is how that, and other agreed actions, are triggered and commanded. Which tools can trigger an action? Integration with your SIEM or other tools is agreed during scoping. Nothing is assumed to be automatic. How quickly does an action run? It depends on command delivery, authorisation and the hardware. Timings are measured for each deployment, not promised in advance. Your next step ## See an agreed action run in front of you. We will take one of your incident scenarios and show the action, the approval and the record. Firevault home (https://fire-vault.com/) Offline Secure Storage® and Control. A UK cyber resilience company. Data protection and storage through Offline Secure Storage®. Network evolution and rapid protection through Control. Firevault on LinkedIn: https://www.linkedin.com/company/firevault-limited Firevault on Facebook: https://www.facebook.com/Firevaultltd/ Firevault on YouTube: https://www.youtube.com/@Firevault-ltd Verify Firevault Cyber Essentials and Cyber Essentials Plus certification on the NCSC register: https://registry.blockmarktech.com/certificates/ © 2026 Firevault Limited Company No. 16320803 VAT No. 490 8551 64 Registered in England and Wales ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-module/execute#webpage", "url": "https://fire-vault.com/control-module/execute", "name": "Control Execute Module: controlled execution", "description": "Execute runs a scoped, human-approved task against your offline vault, then returns it to a disconnected state. See the workflow and full audit trail.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/27d95636-cb89-494d-a105-ed44bd5b2f43/og-control-execute.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-module/execute#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-module/execute#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Module", "item": "https://fire-vault.com/control-module" }, { "@type": "ListItem", "position": 3, "name": "Control Execute Module: controlled execution", "item": "https://fire-vault.com/control-module/execute" } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://fire-vault.com/#org", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com/", "identifier": "16320803", "sameAs": [ "https://www.linkedin.com/company/firevault-limited", "https://www.facebook.com/Firevaultltd/", "https://www.youtube.com/@Firevault-ltd" ] }, { "@type": "WebPage", "name": "FV-Execute: Act on a decision, not a habit", "url": "https://fire-vault.com/control-module/execute", "description": "Execute initiates control actions in response to policy, approval, schedule, incident state or supervisory override. The decision to act is recorded with the action, so there is no ambiguity about why the environment changed.", "publisher": { "@id": "https://fire-vault.com/#org" } }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com/" }, { "@type": "ListItem", "position": 2, "name": "FV-Execute", "item": "https://fire-vault.com/control-module/execute" } ] }, { "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Execute an automation engine?", "acceptedAnswer": { "@type": "Answer", "text": "It is the initiation layer for control actions. Actions begin because a defined condition was met, under the approval pattern agreed for them, and the decision and the action are recorded together through Anchor." } }, { "@type": "Question", "name": "What happens if a trigger misbehaves?", "acceptedAnswer": { "@type": "Answer", "text": "An explicit supervisory layer can pause, redirect or stop an action when human judgement needs to take over, and each action is constrained to the systems and operations the policy permits." } }, { "@type": "Question", "name": "Does Execute act without approval?", "acceptedAnswer": { "@type": "Answer", "text": "Sensitive actions require the right approval before execution, not after the fact. Nothing destructive, privileged or boundary-altering happens without a named approver and a recorded decision." } }, { "@type": "Question", "name": "Can Execute be paused entirely?", "acceptedAnswer": { "@type": "Answer", "text": "The supervisory override can pause, redirect or stop actions. Where appropriate, actions also have a defined undo path." } } ] } ] } ] ```