A filtered connection
The connection stays in place and a rule decides what crosses. If the management plane is compromised, the rule can be quietly relaxed.
FV-01 FractureControl the path
A firewall blocks traffic. The connection stays.
Attackers move between connected systems along paths that are always there. Fracture physically disconnects a selected connection the moment it becomes dangerous, under rules you agree in advance.
The incident is contained at that crossing, and the systems that do not depend on it keep running.
Fig. 1 · One crossingDisconnected
Break. Segment. Contain.
- Module
- FV-01 Fracture
- Family
- Control the path
- The question it answers
- Must this connection be physically disconnected now?
- Enforced by
- Firebreak® at Layer 1
- Commanded
- Through Execute, out of band
What happens when
The alarm goes off in time. The path is still there.
Most serious incidents start small. What turns them into a crisis is a connection that carries the attacker from one system to the next.
- A login is stolen.
Someone in the corporate network opens a convincing email. Nothing looks wrong yet.
- The route is found.
The attacker finds the connection into the production network. It is always there, because operations rely on it.
- The response is a rule change.
An emergency change still has to be written, tested and pushed out. The attacker does not wait.
Detection tells you it is happening. Fracture removes the road it is travelling on.
Ransomware containment, step by step- Sound familiar?A firewall rule is all that sits between IT and OT
- Supplier access that is never switched off
- Backups reachable from the business network
- Incidents that start overnight
What Fracture is
When a connection becomes dangerous, remove the connection itself.
A filtered path can be unfiltered. A disconnected path cannot. Fracture works on the connection, not on the rules that sit on top of it.
Fracture physically disconnects a selected connection when it must no longer exist.
- A controlled crossing
You choose in advance which connections Fracture can disconnect, and what must keep running.
- A physical disconnection
The crossing is interrupted at Layer 1 by Firebreak® hardware, not by a setting that can be changed back.
- A separate decision to reconnect
Nothing comes back on its own. Reconnection needs its own authorised decision.
A disconnected crossing, with Fracture
The physical connection is interrupted. There is no rule left to change, and the crossing cannot be reached from either side.
What it changes
One decision. One crossing. Everything else carries on.
Instead of taking a whole site offline to be safe, you disconnect the one connection that matters, where the services that must carry on have independent pathways.
Plant statusFriday 22:43
- IT and OT crossingDisconnected
- Line 1 controlRunning
- Line 2 controlRunning
- Safety systemsRunning
- Plant historianRunning
DecisionCommandObserved state
Cut the crossing. Keep production running.
- The selected crossing is disconnected in one authorised action, with nobody sent to find equipment or pull a cable
- Systems that are independently connected on the other side carry on working
- You can show your board, insurer and regulator who decided, what was sent and what the connection actually did
- Reconnection happens deliberately, when the right person decides it is safe
Prove how it works
From event to disconnection. Every step on record.
Step through the operational logic: an event, a request, a check against your policy, a command, the disconnection, and a separate decision to reconnect.
Step 1 of 6
Event
Your security tools confirm unauthorised activity moving from the corporate network towards production. The crossing is still connected.
The recordThree kinds of evidence
-
EventEvent received from your security tools
Illustration, with time compressed. Which crossings are controlled, the response policy, and what must keep running are agreed with you before anything goes live.
What it takes
- 01A physical enforcement point
Firebreak® hardware at the crossing, fibre or copper.
- 02An independent command route
Management Ethernet, cellular SMS or authenticated API, separate from the network under attack.
- 03A connection-state mechanism
So the observed state of the crossing can be read, not just assumed.
- 04Approved incident rules
Which events justify disconnection, and who must approve it.
- 05A restoration procedure
The checks and the authority needed before the crossing reconnects.
How it is proved
| Acceptance test | Passes when | Evidence kept |
|---|---|---|
| The crossing opens | The selected physical crossing is disconnected on an authorised command. | The decision, the command and the observed state |
| Traffic stops | Traffic can no longer traverse that crossing, tested from both sides. | Test results for each side |
| Everything else continues | Unaffected pathways and independently connected services stay available. | Service checks taken during the test |
| Restoration needs authority | The crossing reconnects only on the correct, separate authorisation. | The restoration decision and the new state |
Three kinds of evidence, kept separately
- DecisionWho or what authorised it, and why
The request, the policy it was checked against and the approval.
- ExecutionWhich command was sent
The command and the response received over the management channel.
- Physical stateWhat the connection actually did
A successful command response is not, on its own, proof that the connection changed state.
What it is, and what it is not
Fracture doesControl the path
- Disconnect a selected crossing at Layer 1, under the response policy you agree
- Act through Execute, over a command route separate from the affected network
- Leave independently connected services running
- Record the decision, the command and the observed state
Fracture does notIts boundaries
- Remove network routes that have not been placed under control
- Disconnect wireless connections
- Remove a compromise already inside the protected zone
- Decide on its own that every alert justifies disconnection
How it works with the other modules
- ExecuteWhat approved action must happen?
Turns the authorised decision into the command that Fracture carries out.
- ValidateIs this request legitimate?
Checks the request against the response policy, including any second approval.
- IsolateWhich environments must be separated?
Defines the zones and crossings Fracture can act on.
- AnchorWhat is the protected asset?
Defines the asset, its permitted relationships and what must never be disconnected.
- UnlinkWhich standing connections should go?
Removes unwanted relationships for good. Fracture acts in the moment.
For your technical teamCrossings, the state model, failure behaviour and standards
Where it is placed
ITOT
The IT and OT boundaryThe crossing into the production or process control network.
IEC 62443-3-3 SR 5.1 and 5.2ProductionBackups
The route to backupsThe crossing into the backup zone, disconnected on an approved alert.
NIST CSF PR.PT-5VendorYour estate
Supplier connectionsEmergency containment of a third-party route, alongside Relay and Lock.
IEC 62443-3-3 SR 1.13InternetEnterprise
The internet edgeA designated inbound crossing that can be disconnected on decision.
IEC 62443-3-3 SR 5.1State model for a normally connected crossing
Connected→Incident→Validated→Authorised→Disconnected→Reconnection authorised→Connected
For CNI and OT, some connections must normally stay available, and losing them can create a safety issue. Behaviour on power failure, command loss, management failure or conflicting instructions is specified for each crossing.
Grounded in
- IEC 62443-3-3 SR 5.1Network segmentation
- NIST CSF PR.AC-5Network integrity is protected
- NCSC CAF B4System security
- MITRE ATT&CK TA0008Lateral movement
Fracture can help support these frameworks. It does not make you compliant on its own.
Start with one crossing
- 1Map the crossings
Find where disconnection is a meaningful response: between zones, between sites and to third parties.
- 2Agree the authority
Who approves a disconnection, the conditions for automation and how decisions escalate.
- 3Rehearse it
Walk through it with your responders, then test disconnection and restoration on a non-production path.
- 4Make it routine
Use Fracture in your incident response, review the evidence and refine the rules over time.
Sound familiar?
Three organisations. Three connections that matter.
Each one depends on a connection it cannot simply switch off. Fracture lets them disconnect it when it counts.
Switch between the two endings.
ExposedFriday, 22:40
A manufacturerOperations director, two production sites
The moment
The corporate network is compromised.
The connection from IT into the production control network is the obvious next step for the attacker.
Production stops as a precaution.
With no way to cut just that connection, the whole plant is taken offline.
Only the IT and OT crossing is disconnected.
Production services that are independently connected keep running.
ExposedSunday, 03:10
A professional services firmHead of IT, 300 people
The moment
Ransomware is moving towards the backup network.
A high-confidence alert fires in the middle of the night, with nobody on site.
The backups go with everything else.
The rule change is still being written when the encryption arrives.
The crossing to the backups is disconnected.
The approved response policy acts through Execute, and the on-call lead is told at once.
ExposedWednesday, 14:05
A water companyOT manager, treatment and distribution
The moment
Unusual activity appears on a supplier connection.
The supplier route into the operational network is open for maintenance.
The route stays open while people debate it.
Disconnecting it means finding the right equipment and the right person.
The supplier crossing is disconnected.
Essential process and safety communication is preserved, as the plan for that crossing requires.
These situations are illustrative. Every crossing is mapped with you before anything is placed under control.
Ready today
Proven hardware. Plans that put it to work.
Fracture is part of Control by Firevault: deciding which connections exist, under whose authority, for what purpose and for how long, with physical enforcement where it is required.
Firebreak® delivers the Layer 1 disconnection.
A reed relay in the physical media port, fibre or copper, interrupts the connection. Its control and data layers are completely separate, so your traffic is never inspected or changed. Firebreak® is supplied by Firevault.
Control Plans that use Fracture
CP-01Ransomware ContainmentDisconnect the crossings out of an infected zone while the rest of the business keeps running.Read CP-01
CP-02Incident ContainmentWhen an attacker is already active, contain them at the physical layer.Read CP-02
CP-03Third-Party AccessSupplier access open only for approved work, with Fracture for emergency containment.Read CP-03
Playbooks
PlaybookControl for WaterFracture on the Purdue model for a water operator, from pilot to rollout.Read the playbook
PlaybookA Control Blueprint for AIWhere disconnection belongs around training clusters, inference estates and agent actions.Read the playbook
PlaybookAerospace and aviationPath control for design authority networks, maintenance systems and airside OT.Read the playbook
- Cyber Essentials PlusConfirm current certificate status, scope and validity with Firevault.
- Deployed with youOn premises or in a managed facility, designed around your estate.
- Works with your toolsFirewalls, SIEM, SOAR and EDR stay exactly where they are.
- A proud memberof the Motorsport Industry Association.
?Questions
Frequently asked about Fracture.
Your engineers will want the detail and your board will want the evidence. We can walk both through it.
Is Fracture a ransomware kill switch?
It can act as one for the crossings placed under it. A high-confidence alert can trigger the approved response policy, and Fracture disconnects those crossings without waiting for rule changes.
Is it the same as a firewall block?
No. A firewall block filters a connection that still exists, and depends on the enforcement plane staying intact. Fracture interrupts the connection itself.
Can it act automatically?
Yes, where you have agreed the conditions in advance. Execute carries out the response policy, and the incident owner is told at once and can reverse it.
How is a crossing reconnected?
By a separate, authorised decision, once the agreed checks are complete. Nothing reconnects on its own.
Will it take down our operations?
It disconnects only the crossings in your plan. Essential process and safety communication is identified when each crossing is mapped, and preserved.
Does Fracture inspect our traffic?
No. It decides whether a connection exists, not what travels on it. Firebreak® keeps its control and data layers completely separate.
Who makes the hardware?
Firebreak® is supplied by Firevault, which also designs how it is deployed in your Control Plan.
Your next step
Decide which connection you would cut first.
We map your crossings, agree who authorises a disconnection, and rehearse it on a non-production path before you rely on it.