How do you decide what to remove?

By reviewing an inventory of the relationships touching the sensitive assets with their owners, and removing what is no longer warranted. Each removal needs the right authority and is scoped to the relationship under review.

What happens if a removed relationship is needed later?

Restoring it is a deliberate act, approved and recorded like the removal, rather than something that quietly returns.

Does Unlink reduce operational risk?

Adoption is designed around continuity: removals are piloted in a defined batch, and operational continuity is confirmed before the work is broadened.

FV-07 UnlinkControl module · Protect the asset

Remove the connections nobody needs any more.

Q: How is Unlink different from Isolate?

Isolate draws the zones and holds their boundaries. Unlink removes the individual relationships that keep a sensitive asset reachable: persistent connections, live dependencies and inherited trust.

Unlink finds and removes the persistent connections and dependencies that leave critical data exposed: old tunnels, legacy syncs, supplier links and shared stores that outlived their purpose. What remains is there on purpose.

Book a Control demo See it in action

UnlinkProtect the asset

Module: FV-07 Unlink
Family: Protect the asset
The question it answers: Does this connection still need to exist?
Removes: Persistent links and inherited trust
Keeps: Only connections with an owner and a reason

What happens when

Nobody remembers why it is connected. An attacker does not need to.

Systems collect connections over the years. Each one was reasonable once. Few are ever removed.

2019A VPN for a project.
The project ended. The tunnel did not.
2021A sync for a migration.
The old system is gone. The sync still runs.
TodayFour routes in.
The payments platform is reachable four ways, and only one is needed.

Every unused connection is a free route in. Unlink takes it away.

See it in action

One critical system. Switch between inherited links and Unlink.

The same system and the same four connections, handled two ways.

Inherited linksWith Unlink

Four persistent connections reach the payments platform. Only one is still needed.

Three are removed. The backup share stays, because it has an owner and a reason.

Step by step

Step 1Find
List every persistent connection to the asset.
Step 2Ask
Give each one an owner and a reason, or mark it for removal.
Step 3Remove
Unneeded connections are taken out of use.
Step 4Keep watch
New persistent links are reviewed before they become permanent.

What Unlink is

Less to reach. Less to defend.

Unlink reduces exposure by removing what should not be there, rather than adding another layer on top.

Persistent links
Tunnels, syncs and shares that stay connected all the time.
Inherited trust
Access that exists because of history, not a decision.
Owner and reason
Every remaining connection has both.

What it changes

Fewer ways in, and a reason for each one.

Unlink does not stop new attacks. It removes the old routes they would use.

Unlink record

Removed · Project VPNNo owner since 2019Removed
Removed · Legacy syncSource system retiredRemoved
Kept · Backup shareOwner: infrastructure leadKept
Review · New supplier linkOwner and end date agreedLogged

A smaller attack surface. A known one.

Unused connections are removed
Every remaining link has an owner and a reason
New persistent links are reviewed
A record of what was removed and why

Where it fits

Fracture, Isolate and Unlink answer different questions.

Fracture and Isolate decide whether connections exist. Unlink does a different job, and most Plans use more than one module.

Module	Fracture	Isolate	Unlink
The question it answers	Must this connection be physically disconnected now?	Which zones should never share a path?	Does this persistent connection still need to exist?
Normal state	Connected, with a crossing ready to be disconnected	Zones held apart, crossings closed by default	Only connections with an owner and a reason remain
When it acts	When a connection becomes dangerous	By design, before anything goes wrong	During review, and when a connection loses its purpose
What it ends	An incident travelling along a live path	Trust that exists only because systems share a network	Old links and inherited trust nobody chose
Typical Plans	CP-01, CP-02	CP-04, CP-05, CP-14	CP-11, CP-18, CP-01

Control Plans and Blueprints

Where Unlink does the work.

Unlink reduces exposure in supply chain, exfiltration and ransomware Plans. Plans marked Proposed are awaiting technical approval.

Control PlansTwenty Plans, each solving one problem.All Control Plans
Control BlueprintsIndustry solutions that combine Plans.All Control Blueprints
FracturePhysically disconnect a connection.See Fracture
IsolateHold zones apart by design.See Isolate

Questions

What network and security teams ask.

Want to see it on real hardware? We will show you.

Book a Control demo

How is Unlink different from Fracture?

Fracture disconnects a live connection when it becomes dangerous. Unlink removes connections that no longer need to exist, before anything goes wrong.

How is Unlink different from Isolate?

Isolate sets boundaries between zones. Unlink removes individual persistent links and dependencies, wherever they are.

Will removing links break things?

Each connection is given an owner and checked before removal. Nothing is removed without agreement.

Is this a one-off clean-up?

It starts as one, then becomes a review so new persistent links do not build up again.

Your next step

Find the connections you no longer need.

We will review the links to one critical system and show what can be removed.

Book a Control demo