Firevault, offline secure storage, physically disconnected from the internet
Pricing

FV-02 IsolateControl module · Control the path

Keep a problem in one zone. Not across the whole estate.

Isolate holds your networks and critical systems apart as separate zones, enforced at Layer 1. A compromise in one zone stays where it started, because the paths that would carry it elsewhere are closed by design, and only the crossings you approve exist.

Isolate module iconIsolateControl the path
Module
FV-02 Isolate
Family
Control the path
The question it answers
Which zones should never share a path?
Enforced by
Firebreak® at Layer 1
Commanded
Through Execute, out of band

What happens when

One laptop is compromised. Everything on the same network is next.

Most networks grew one connection at a time. Systems that never needed to talk to each other can, simply because they share a network.

  1. A laptop is compromised.

    A reused password on a corporate account. It looks like an ordinary login.

  2. The network is flat.

    Operations, finance and records sit one step away, reachable because they share a subnet, not because anyone chose it.

  3. The incident is everywhere.

    Recovery now covers the whole estate instead of one room.

Segmentation in software can drift. Isolate keeps the boundary physical.

See it in action

Three zones. Switch between a flat network and an isolated one.

The same compromised laptop, in two networks. Choose a state to see how far it can reach.

Corporate, operations and records share one network. A compromise in corporate can reach both of the others.

Each zone is held apart at Layer 1. The compromise stays in corporate; operations and records keep running; one approved crossing remains for the work that needs it.

Step by step

  1. Step 1Map the zones

    Agree which systems belong together and which must never share a path.

  2. Step 2Agree the crossings

    Name the few connections that may exist between zones, and who approves them.

  3. Step 3Hold the boundary

    Firebreak® keeps every other path between zones closed at Layer 1.

  4. Step 4Prove it

    Each boundary state and each crossing change is recorded.

What Isolate is

Separation by design, not by the way switches were wired.

Isolate decides where boundaries sit and keeps them physical, so trust does not extend across a zone unless you open a crossing on purpose.

  • Explicit zones

    Zones are designed around how the business actually runs, not inherited from old cabling.

  • Physical boundaries

    Paths between zones are closed in hardware, so a changed rule cannot quietly reopen them.

  • Approved crossings only

    The few connections that must exist are named, owned and recorded.

What it changes

An incident in one room, not the whole building.

Isolate does not stop every compromise. It limits how far one can travel, and gives responders a smaller problem.

Smaller blast radius. Clearer recovery.

  • A compromise is limited to what its zone can reach
  • Responders work in one zone while the others keep running
  • Boundaries do not drift as services are added
  • Auditors see the recorded state of each boundary

Where it fits

Fracture, Isolate and Relay answer different questions.

The three FIRE modules work on connections. Each one is chosen for a different moment, and most Plans use more than one.

Module Fracture Isolate Relay
The question it answers Must this connection be physically disconnected now? Which zones should never share a path, and where is the one permitted crossing? Should this path exist right now, for this work, and when does it close?
Normal state Connected, with a crossing ready to be disconnected Zones held apart, crossings closed by default Closed, opened only inside an approved window
When it acts When a connection becomes dangerous By design, before anything goes wrong On a schedule or approved request
What it ends An incident travelling along a live path Trust that exists only because systems share a network Standing access left open after the work is done
Typical Plans CP-01, CP-02 CP-04, CP-05, CP-14 CP-03, CP-13, CP-17

Control Plans and Blueprints

Where Isolate does the work.

Isolate is the backbone of segmentation and critical asset Plans. Plans marked Proposed are awaiting technical approval.

Questions

What network and security teams ask.

Want to see a zone held apart on real hardware? We will show you.

How is Isolate different from VLANs or firewall segmentation?

VLANs and firewall rules separate traffic in software on connections that still exist. Isolate closes the paths between zones at Layer 1, so the boundary does not depend on the configuration of a device that could be reached.

Does Isolate replace our firewalls?

No. Firewalls still filter the crossings you allow. Isolate removes the paths you do not.

How is Isolate different from Fracture?

Isolate sets boundaries by design, before anything goes wrong. Fracture disconnects a live connection when it becomes dangerous. Many Plans use both.

Can a crossing be opened temporarily?

Yes, through Relay, for an approved purpose and a defined window. Isolate keeps the boundary; Relay manages the time-bound exception.

Will isolating zones break dependencies?

Dependencies are mapped during scoping, and each boundary is tested before it is enforced in production.

Your next step

See a zone held apart in front of you.

We will map your zones, show a boundary held at Layer 1 and agree the crossings that should remain.