--- title: "Control Firebreak Module: cut network paths | Firevault" url: https://fire-vault.com/control-module/fracture description: "Firebreak severs network paths at Layer 1 in seconds, containing lateral movement before a breach can spread across IT or OT estates." lang: en-GB --- _ Image: Fracture (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png) _**FV-01 Fracture**Control the path # A firewall blocks traffic. The connection stays. Attackers move between connected systems along paths that are always there. Fracture physically disconnects a selected connection the moment it becomes dangerous, under rules you agree in advance. The incident is contained at that crossing, and the systems that do not depend on it keep running. Book a Control demo: https://fire-vault.com/demo See it in action Fig. 1 · One crossing _Disconnected_ Layer 1 Out of band Agreed in advance Break. Segment. Contain. Module FV-01 Fracture Family Control the path The question it answers Must this connection be physically disconnected now? Enforced by Firebreak® at Layer 1 Commanded Through Execute, out of band What happens when ## The alarm goes off in time. The path is still there. Most serious incidents start small. What turns them into a crisis is a connection that carries the attacker from one system to the next. 1. 08:40**A login is stolen.** Someone in the corporate network opens a convincing email. Nothing looks wrong yet. 2. 09:15**The route is found.** The attacker finds the connection into the production network. It is always there, because operations rely on it. 3. 09:20**The response is a rule change.** An emergency change still has to be written, tested and pushed out. The attacker does not wait. Detection tells you it is happening. Fracture removes the road it is travelling on. Ransomware containment, step by step (https://fire-vault.com/control-plan/stop-kill-chain-ransomware) - **Sound familiar?**A firewall rule is all that sits between IT and OT - Supplier access that is never switched off - Backups reachable from the business network - Incidents that start overnight What Fracture is ## When a connection becomes dangerous, remove the connection itself. A filtered path can be unfiltered. A disconnected path cannot. Fracture works on the connection, not on the rules that sit on top of it. Fracture physically disconnects a selected connection when it must no longer exist. - **A controlled crossing** You choose in advance which connections Fracture can disconnect, and what must keep running. - **A physical disconnection** The crossing is interrupted at Layer 1 by Firebreak® hardware, not by a setting that can be changed back. - **A separate decision to reconnect** Nothing comes back on its own. Reconnection needs its own authorised decision. **A filtered connection** The connection stays in place and a rule decides what crosses. If the management plane is compromised, the rule can be quietly relaxed. **A disconnected crossing, with Fracture** The physical connection is interrupted. There is no rule left to change, and the crossing cannot be reached from either side. What it changes ## One decision. One crossing. Everything else carries on. Instead of taking a whole site offline to be safe, you disconnect the one connection that matters, where the services that must carry on have independent pathways. **Plant status**Friday 22:43 - IT and OT crossing_Disconnected_ - Line 1 control_Running_ - Line 2 control_Running_ - Safety systems_Running_ - Plant historian_Running_ Decision Command Observed state ### Cut the crossing. Keep production running. - The selected crossing is disconnected in one authorised action, with nobody sent to find equipment or pull a cable - Systems that are independently connected on the other side carry on working - You can show your board, insurer and regulator who decided, what was sent and what the connection actually did - Reconnection happens deliberately, when the right person decides it is safe Control Plans that use Fracture Prove how it works ## From event to disconnection. Every step on record. Step through the operational logic: an event, a request, a check against your policy, a command, the disconnection, and a separate decision to reconnect. Step 1 of 6 ### Event Your security tools confirm unauthorised activity moving from the corporate network towards production. The crossing is still connected. The recordThree kinds of evidence 1. Event Event received from your security tools Illustration, with time compressed. Which crossings are controlled, the response policy, and what must keep running are agreed with you before anything goes live. What it takes 1. 01**A physical enforcement point** Firebreak® hardware at the crossing, fibre or copper. 2. 02**An independent command route** Management Ethernet, cellular SMS or authenticated API, separate from the network under attack. 3. 03**A connection-state mechanism** So the observed state of the crossing can be read, not just assumed. 4. 04**Approved incident rules** Which events justify disconnection, and who must approve it. 5. 05**A restoration procedure** The checks and the authority needed before the crossing reconnects. How it is proved | Acceptance test | Passes when | Evidence kept | | --- | --- | --- | | The crossing opens | The selected physical crossing is disconnected on an authorised command. | The decision, the command and the observed state | | Traffic stops | Traffic can no longer traverse that crossing, tested from both sides. | Test results for each side | | Everything else continues | Unaffected pathways and independently connected services stay available. | Service checks taken during the test | | Restoration needs authority | The crossing reconnects only on the correct, separate authorisation. | The restoration decision and the new state | Three kinds of evidence, kept separately - Decision**Who or what authorised it, and why** The request, the policy it was checked against and the approval. - Execution**Which command was sent** The command and the response received over the management channel. - Physical state**What the connection actually did** A successful command response is not, on its own, proof that the connection changed state. What it is, and what it is not **Fracture does**Control the path - Disconnect a selected crossing at Layer 1, under the response policy you agree - Act through Execute, over a command route separate from the affected network - Leave independently connected services running - Record the decision, the command and the observed state **Fracture does not**Its boundaries - Remove network routes that have not been placed under control - Disconnect wireless connections - Remove a compromise already inside the protected zone - Decide on its own that every alert justifies disconnection How it works with the other modules - **Execute**What approved action must happen? Turns the authorised decision into the command that Fracture carries out. - **Validate**Is this request legitimate? Checks the request against the response policy, including any second approval. - **Isolate**Which environments must be separated? Defines the zones and crossings Fracture can act on. - **Anchor**What is the protected asset? Defines the asset, its permitted relationships and what must never be disconnected. - **Unlink**Which standing connections should go? Removes unwanted relationships for good. Fracture acts in the moment. **For your technical team**Crossings, the state model, failure behaviour and standards Where it is placed ITOT **The IT and OT boundary** The crossing into the production or process control network. IEC 62443-3-3 SR 5.1 and 5.2 ProductionBackups **The route to backups** The crossing into the backup zone, disconnected on an approved alert. NIST CSF PR.PT-5 VendorYour estate **Supplier connections** Emergency containment of a third-party route, alongside Relay and Lock. IEC 62443-3-3 SR 1.13 InternetEnterprise **The internet edge** A designated inbound crossing that can be disconnected on decision. IEC 62443-3-3 SR 5.1 State model for a normally connected crossing Connected _→_Incident _→_Validated _→_Authorised _→_Disconnected _→_Reconnection authorised _→_Connected For CNI and OT, some connections must normally stay available, and losing them can create a safety issue. Behaviour on power failure, command loss, management failure or conflicting instructions is specified for each crossing. Grounded in - **IEC 62443-3-3 SR 5.1**Network segmentation - **NIST CSF PR.AC-5**Network integrity is protected - **NCSC CAF B4**System security - **MITRE ATT&CK TA0008**Lateral movement Fracture can help support these frameworks. It does not make you compliant on its own. Start with one crossing 1. 1 **Map the crossings** Find where disconnection is a meaningful response: between zones, between sites and to third parties. 2. 2 **Agree the authority** Who approves a disconnection, the conditions for automation and how decisions escalate. 3. 3 **Rehearse it** Walk through it with your responders, then test disconnection and restoration on a non-production path. 4. 4 **Make it routine** Use Fracture in your incident response, review the evidence and refine the rules over time. Sound familiar? ## Three organisations. Three connections that matter. Each one depends on a connection it cannot simply switch off. Fracture lets them disconnect it when it counts. Switch between the two endings. Exposed Friday, 22:40 ### A manufacturerOperations director, two production sites The moment The corporate network is compromised. The connection from IT into the production control network is the obvious next step for the attacker. **Production stops as a precaution.** With no way to cut just that connection, the whole plant is taken offline. **Only the IT and OT crossing is disconnected.** Production services that are independently connected keep running. Exposed Sunday, 03:10 ### A professional services firmHead of IT, 300 people The moment Ransomware is moving towards the backup network. A high-confidence alert fires in the middle of the night, with nobody on site. **The backups go with everything else.** The rule change is still being written when the encryption arrives. **The crossing to the backups is disconnected.** The approved response policy acts through Execute, and the on-call lead is told at once. Exposed Wednesday, 14:05 ### A water companyOT manager, treatment and distribution The moment Unusual activity appears on a supplier connection. The supplier route into the operational network is open for maintenance. **The route stays open while people debate it.** Disconnecting it means finding the right equipment and the right person. **The supplier crossing is disconnected.** Essential process and safety communication is preserved, as the plan for that crossing requires. These situations are illustrative. Every crossing is mapped with you before anything is placed under control. Ready today ## Proven hardware. Plans that put it to work. Fracture is part of Control by Firevault: deciding which connections exist, under whose authority, for what purpose and for how long, with physical enforcement where it is required. ### Firebreak® delivers the Layer 1 disconnection. A reed relay in the physical media port, fibre or copper, interrupts the connection. Its control and data layers are completely separate, so your traffic is never inspected or changed. **Firebreak® is supplied by Firevault.** See the Firebreak® range: https://fire-vault.com/firebreak The AI kill switch: https://fire-vault.com/ai-kill-switch Control Plans that use Fracture CP-01**Ransomware Containment**Disconnect the crossings out of an infected zone while the rest of the business keeps running. _Read CP-01_: https://fire-vault.com/control-plan/stop-kill-chain-ransomware CP-02**Incident Containment**When an attacker is already active, contain them at the physical layer. _Read CP-02_: https://fire-vault.com/control-plan/contain-active-breaches CP-03**Third-Party Access**Supplier access open only for approved work, with Fracture for emergency containment. _Read CP-03_: https://fire-vault.com/control-plan/control-third-party-access Playbooks Playbook**Control for Water**Fracture on the Purdue model for a water operator, from pilot to rollout. _Read the playbook_: https://fire-vault.com/playbook/firebreak-water Playbook**A Control Blueprint for AI**Where disconnection belongs around training clusters, inference estates and agent actions. _Read the playbook_: https://fire-vault.com/playbook/ai-control-blueprints Playbook**Aerospace and aviation**Path control for design authority networks, maintenance systems and airside OT. _Read the playbook_: https://fire-vault.com/playbook/aerospace - **Cyber Essentials Plus**Confirm current certificate status, scope and validity with Firevault. - **Deployed with you**On premises or in a managed facility, designed around your estate. - **Works with your tools**Firewalls, SIEM, SOAR and EDR stay exactly where they are. - **A proud member**of the Motorsport Industry Association. **?**Questions ## Frequently asked about Fracture. Your engineers will want the detail and your board will want the evidence. We can walk both through it. Book a Control demo: https://fire-vault.com/demo Contact us: https://fire-vault.com/contact Is Fracture a ransomware kill switch? It can act as one for the crossings placed under it. A high-confidence alert can trigger the approved response policy, and Fracture disconnects those crossings without waiting for rule changes. Is it the same as a firewall block? No. A firewall block filters a connection that still exists, and depends on the enforcement plane staying intact. Fracture interrupts the connection itself. Can it act automatically? Yes, where you have agreed the conditions in advance. Execute carries out the response policy, and the incident owner is told at once and can reverse it. How is a crossing reconnected? By a separate, authorised decision, once the agreed checks are complete. Nothing reconnects on its own. Will it take down our operations? It disconnects only the crossings in your plan. Essential process and safety communication is identified when each crossing is mapped, and preserved. Does Fracture inspect our traffic? No. It decides whether a connection exists, not what travels on it. Firebreak® keeps its control and data layers completely separate. Who makes the hardware? Firebreak® is supplied by Firevault, which also designs how it is deployed in your Control Plan. Your next step ## Decide which connection you would cut first. We map your crossings, agree who authorises a disconnection, and rehearse it on a non-production path before you rely on it. Book a Control demo (https://fire-vault.com/demo) Prefer to start with a plan? Explore the Control Plans: https://fire-vault.com/control-plans Firevault home (https://fire-vault.com/) Offline Secure Storage® and Control. A UK cyber resilience company. Data protection and storage through Offline Secure Storage®. Network evolution and rapid protection through Control. Firevault on LinkedIn: https://www.linkedin.com/company/firevault-limited Firevault on Facebook: https://www.facebook.com/Firevaultltd/ Firevault on YouTube: https://www.youtube.com/@Firevault-ltd Verify Firevault Cyber Essentials and Cyber Essentials Plus certification on the NCSC register: https://registry.blockmarktech.com/certificates/ © 2026 Firevault Limited Company No. 16320803 VAT No. 490 8551 64 Registered in England and Wales ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-module/fracture#webpage", "url": "https://fire-vault.com/control-module/fracture", "name": "Control Firebreak Module: cut network paths", "description": "Firebreak severs network paths at Layer 1 in seconds, containing lateral movement before a breach can spread across IT or OT estates.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/2a9868c7-789c-40f7-bb9f-e70f75005876/og-control-firebreak.png" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-module/fracture#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-module/fracture#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Module", "item": "https://fire-vault.com/control-module" }, { "@type": "ListItem", "position": 3, "name": "Control Firebreak Module: cut network paths", "item": "https://fire-vault.com/control-module/fracture" } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "WebPage", "name": "FV-01 Fracture", "url": "https://fire-vault.com/control-module/fracture", "description": "Fracture physically disconnects a selected network connection when it must no longer exist, under rules agreed in advance, with the decision, command and observed state on record.", "publisher": { "@type": "Organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com/" } }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Control", "item": "https://fire-vault.com/control" }, { "@type": "ListItem", "position": 2, "name": "Modules", "item": "https://fire-vault.com/control-modules" }, { "@type": "ListItem", "position": 3, "name": "Fracture", "item": "https://fire-vault.com/control-module/fracture" } ] }, { "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Fracture a ransomware kill switch?", "acceptedAnswer": { "@type": "Answer", "text": "It can act as one for the crossings placed under it. A high-confidence alert can trigger the approved response policy, and Fracture disconnects those crossings without waiting for rule changes." } }, { "@type": "Question", "name": "Is it the same as a firewall block?", "acceptedAnswer": { "@type": "Answer", "text": "No. A firewall block filters a connection that still exists, and depends on the enforcement plane staying intact. Fracture interrupts the connection itself." } }, { "@type": "Question", "name": "Can it act automatically?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, where you have agreed the conditions in advance. Execute carries out the response policy, and the incident owner is told at once and can reverse it." } }, { "@type": "Question", "name": "How is a crossing reconnected?", "acceptedAnswer": { "@type": "Answer", "text": "By a separate, authorised decision, once the agreed checks are complete. Nothing reconnects on its own." } }, { "@type": "Question", "name": "Will it take down our operations?", "acceptedAnswer": { "@type": "Answer", "text": "It disconnects only the crossings in your plan. Essential process and safety communication is identified when each crossing is mapped, and preserved." } }, { "@type": "Question", "name": "Does Fracture inspect our traffic?", "acceptedAnswer": { "@type": "Answer", "text": "No. It decides whether a connection exists, not what travels on it. Firebreak keeps its control and data layers completely separate." } }, { "@type": "Question", "name": "Who makes the hardware?", "acceptedAnswer": { "@type": "Answer", "text": "Firebreak is supplied by Firevault, which also designs how it is deployed in your Control Plan." } } ] } ] } ] ```