Firebreak: cut the path, not the business.

Path open, path cut, on command

Firebreak does one job completely: it decides whether the path exists at all. Everything else in your stack keeps doing what it already does.

What Firebreak is

• A Layer 1 physical switch in the network path
• An air gap you can create and reverse on demand
• Controlled from an out-of-band, non-IP command path
• Logged, evidential and independent of the estate it protects

What Firebreak is not

• A firewall or an inspection appliance
• Software that can be disabled by a compromised host
• A protocol-aware device sitting inline in the data plane
• A forklift upgrade of your existing network

Pick the model that matches the port type and the place it sits. The command path and the behaviour are identical across the range.

NATO and defence

Tier-1 programme

Air gap on demand for a classified test range with intermittent partner connectivity.

Operator-triggered disconnect in milliseconds, full audit log, no inline software in the path.

Critical national infrastructure

Multi-site utility

Severance of the IT and OT boundary during patching windows and SCADA incident response.

Scheduled and ad-hoc cuts over SMS and REST API, with no re-architecture of the control network.

Regulated finance

Trading floor

Verifiable physical isolation of a settlement enclave from the wider corporate network, on demand.

The out-of-band command path satisfied both internal audit and external regulator review.

Network configuration

We help map ports, zones and command paths to your existing architecture.

Support model design

Roles, runbooks and on-call patterns so cuts and restores are routine, not heroic.

Naming and command structures

Clear conventions for ports, zones and Blueprints, so every action reads the same way.

Secure command processes

Approval, authentication and audit flows that satisfy internal review and external regulators.

Is Firebreak an air gap?

On demand, yes. When Firebreak cuts a path, the segment is severed at Layer 1. It is disconnected on that interface, invisible to scans on it, and independent of any software that might have been compromised.

Does Firebreak replace firewalls?

No. Firewalls inspect and filter traffic on connections that still exist. Firebreak removes the connection itself. The two complement each other rather than substitute for each other.

Does Firebreak inspect or filter traffic?

No. Firebreak sits at Layer 1 and has no inline protocol stack in the data path. When the path is cut, there is no payload to inspect because there is no link.

How are commands authenticated?

The command path is out of band by design. The web interface uses multi-factor authentication with brute-force protection. SMS uses structured commands with number filtering and a secondary code. The API uses scoped access tokens. Every action is logged.

How does Firebreak fit into Control?

Control is the wider framework of Fire and Vault modules, packaged into Control Blueprints. Firebreak is the physical control point that delivers the Layer 1 cut wherever a Blueprint calls for one.

How does Firebreak support compliance evidence?

Every cut, restore and command is logged on the appliance with the actor, the channel and the outcome. The evidential trail maps directly to the isolation and operational-resilience expectations in regimes such as NIS2 and DORA.

Do you offer help with deployment?

Yes. Our professional services team helps you choose the right module, plan the rollout and operate it well, through to handover to your operations team.