--- title: "Control MITRE ATTACK: framework alignment | Firevault" description: "Physically disrupt multiple MITRE ATT&CK tactics, including Lateral Movement and Exfiltration, by removing the network paths adversaries rely on. Explore." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/solutions/control/frameworks/mitre-attack#webpage", "url": "https://fire-vault.com/solutions/control/frameworks/mitre-attack", "name": "Control MITRE ATTACK: framework alignment", "description": "Physically disrupt multiple MITRE ATT&CK tactics, including Lateral Movement and Exfiltration, by removing the network paths adversaries rely on. Explore.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-solutions.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/solutions/control/frameworks/mitre-attack#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/solutions/control/frameworks/mitre-attack#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Solutions", "item": "https://fire-vault.com/solutions" }, { "@type": "ListItem", "position": 3, "name": "Control", "item": "https://fire-vault.com/solutions/control" }, { "@type": "ListItem", "position": 4, "name": "Frameworks", "item": "https://fire-vault.com/solutions/control/frameworks" }, { "@type": "ListItem", "position": 5, "name": "Control MITRE ATTACK: framework alignment", "item": "https://fire-vault.com/solutions/control/frameworks/mitre-attack" } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) MITRE ATT&CK # Physical Countermeasures for ATT&CK Techniques MITRE ATT&CK catalogues the techniques adversaries use. Control eliminates entire categories of those techniques by removing the network reachability they depend on. No path means no technique. Schedule a Demo[Back to Control](/solutions/control) ![Rows of locked server cabinets inside a secure Firevault data hall](/__l5e/assets-v1/a4d3902c-28a5-42f4-bbfb-c12ddaacce1b/hero-square-drive.png) Exposure How it worksExplore moreQuestions The exposure in numbers 01 ATT&CK techniques mitigated through path removal 47 ATT&CK techniques mitigated through path removal 02 Lateral movement prevention between zones 100% Lateral movement prevention between zones 03 ATT&CK tactics addressed by Control modules 12 ATT&CK tactics addressed by Control modules 04 Technique-to-module mapping documentation Full Technique-to-module mapping documentation The Detection Gap ## Detection alone cannot stop sophisticated adversaries. 01 ### Technique Volume ATT&CK catalogues hundreds of techniques. Organisations cannot maintain effective detection rules for every technique across every system. 02 ### Lateral Movement Once inside a network, adversaries move laterally using legitimate tools and protocols that evade detection systems designed to spot malware. 03 ### Living Off the Land Sophisticated attackers use built-in operating system tools and legitimate credentials, making their activity indistinguishable from normal operations. MITRE ATT&CK > You cannot detect what you have prevented. Physical path removal eliminates entire categories of ATT&CK techniques before they can be attempted. The Scenario ### Scenario: Living-Off-the-Land Attack Defeated by Path Removal An advanced threat actor compromises a corporate workstation and uses built-in Windows tools, PowerShell, WMI, and RDP, to move laterally towards the SCADA network. Every tool they use is legitimate. Every credential they use is valid. No malware is deployed. Detection systems see only normal administrative activity. After three weeks, they reach the boundary of the OT network. With Control, the OT network is physically disconnected from corporate IT. The attacker's living-off-the-land techniques are irrelevant because the network path to the target does not exist. No detection was needed. The path was simply not there. "Our threat hunting team spent six months tuning detection rules for lateral movement techniques. When we ran a red team exercise, they bypassed every rule using built-in Windows tools. We realised we were playing a game we could not win." MITRE ATT&CK mapping ## Where ATT&CK tactics meet Control modules. ATT&CK describes how adversaries actually behave. Control removes the reachability and standing trust most of those behaviours depend on, so the tactic has nowhere to land. Reference: MITRE ATT&CK Enterprise v15 tactics TA0001 to TA0040 and ATT&CK for ICS tactics where relevant. SEC 01 Get in and stay in - TA0001 Initial Access Remove the standing inbound reach the attacker assumes is there. ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate - TA0003 Persistence Privileged reach is a named session, not a standing right. ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock ![FV-Unlink module icon](/assets/unlink-icon-B8GFAVW1.png)Unlink - TA0004 Privilege Escalation Boundary-altering actions require explicit, quorum approval. ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png)Execute ![FV-Validate module icon](/assets/vault-icon-CD3Pv4ri.png)Validate SEC 02 Move and learn - TA0007 Discovery Reachable surface is scoped to the named session. Casual discovery has nothing to enumerate. ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock - TA0008 Lateral Movement Inter-zone paths exist only when authorised, and only for the window required. ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate ![FV-Relay module icon](/assets/relay-icon-CVhJDRO7.png)Relay SEC 03 Take or destroy - TA0009 Collection Sensitive stores require an approved Lock event to be reachable. ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate - TA0010 Exfiltration Outbound paths to unmanaged destinations are physically severed. ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak ![FV-Unlink module icon](/assets/unlink-icon-B8GFAVW1.png)Unlink - TA0040 Impact Recovery copies live in an offline vault. The blast stops at the last severed conduit. ![FV-Archive module icon](/assets/archive-icon-B3rc85NY.png)Archive ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak ![FV-Validate module icon](/assets/vault-icon-CD3Pv4ri.png)Validate SEC 04 ATT&CK for ICS - TA0108 Initial Access (ICS) The IT-to-OT conduit is severed by default; vendor reach is time-bound. ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak ![FV-Relay module icon](/assets/relay-icon-CVhJDRO7.png)Relay - TA0107 Inhibit Response Function Safety-related changes are gated by Execute and confirmed by Validate. ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png)Execute ![FV-Validate module icon](/assets/vault-icon-CD3Pv4ri.png)Validate ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock Modules & symbols ![FV-Firebreak module icon](/assets/firebreak-icon-7zSCkB1t.png)Firebreak Physical sever ![FV-Isolate module icon](/assets/isolate-icon-B9t8fl3o.png)Isolate Zone boundary ![FV-Lock module icon](/assets/lock-icon-UU3vOaKE.png)Lock Named access ![FV-Unlink module icon](/assets/unlink-icon-B8GFAVW1.png)Unlink Remove trust ![FV-Execute module icon](/assets/execute-icon-kJl5Gtmk.png)Execute Approved action ![FV-Validate module icon](/assets/vault-icon-CD3Pv4ri.png)Validate Integrity check ![FV-Relay module icon](/assets/relay-icon-CVhJDRO7.png)Relay Time-bound path ![FV-Archive module icon](/assets/archive-icon-B3rc85NY.png)Archive Disconnected copy Direct map Module satisfies clause Featured In [![TechRadar Pro logo](/press/techradar-pro-logo.svg) ](https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough "Read about Firevault on TechRadar Pro") [![Yahoo Finance logo](/assets/yahoo-finance-logo-white-aNkUpCH7.png) ](https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html "Read about Firevault on Yahoo Finance") [![Channel Insider logo](/assets/channel-insider-logo-white-CFFo4iu7.png) ](https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ "Read about Firevault on Channel Insider") [![Security Buyer logo](/assets/security-buyer-logo-white-o6oIaBWz.png) ](https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ "Read about Firevault on Security Buyer") [![SecurityBrief logo](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAT8AAAA1CAYAAAA3Sux5AAAL+0lEQVR4nO2dT4gdSRnAf++Ri5ODEcTJvoB0PIjgxdkFlejsTkBExFlhzWhEWPDkYWfXxZfoRSK73vKPJQrePHjamLhg5iAswrzNkFVyyBz04kqYJ2tmM6CQS2bxss9Dvcrr6emu+qq7ql/3e/WDZv50dVW9ftVff1Xfn+qMRiMiEY/cBpZTf78M/HpKfYlECukIhd8Z4IalzBbwIjCs2KdIO1kHfmU436mrI5FIih5wKvX3fWAb7MKvrFq4BTxb8tpI++gBDwTlogCM1IFEWVvr5vxzBSX0qsyHl8fX71SoI9IeXvVUz8hyLHlqJ1LMEmrpIn3fH6I0+6ZzGdVfm+ADOJ4Vfn1g02NnEqoJ0Ug7+Jyw3ELFdr5f8frQPMQuwCXHLdSzUzc94B4H12wBFlFLGpdr75Gc2yj5JSYt/NYJ9+GiAJxtficstx+0F9Nn0VM9q6hZ04jqLwwX3rScdxIuNZI1sonQwq+HebHaB1EAzi43BWWeDt6L2eQxShOsA2cB0gDWKdlvLfzu+euLkbhmM7t0gI2Cc+cYW9gipVgF7tTQzl4NbfimrNL2UAs/ibq+gRKWnczRRQ1uCW+59jDSKp5HjYkT40OPlyvT7NSMcIrwU2CbUWMrcPuhyMqtLnCzi+yGrqEGdt7UdYQa3BI3hkTS00jr2R0fcanDL48D138TOEq+BrhG89zXzljO76HkUnYcjgCOAL8UNCJZ0wH1ZmjjukEkEpot4CwHZ1kfB54BnkNNbZvAPnAcpRQdG/9vd2q9MfOK5fwl08kjwJf99YVrzLbwy9Nu50W7yX5235971u/jXSYacZoBk2WBW9iF4Mr4mtDs03zr/Gct539jOpnn5FyF+57rW8fNN6rnse2LOW18lHPoczYVPI12Yyg6XFwKbPclfU8WLGV3OCjkzlD82Ueoe6S549CPvPMSzlvaWBHeE+l31RPUJV2H+0hQ5nlBmWeE7c0DNluFUXh3gT/764s3a5EeWC6WnFVUiFVV3yj9wJ93vO4GcsGVWM67tm3ihdTvn7KUTYCnxr9LPOXT/TxVWEqhHZRDLtr/RFhOEgEgrc+3dnTdcv5/HtpIUC+KPmq81+FL2Bu3tUJD1v67wC8E5aRv5t1xnScMh4nXHNoy8Rjl+OiKNDTGhA6xaSsuhoqmWv+GnuqZhlPvPyzn/57526SVpp+BpdT/d1CRXJdR4/0xSnPvWOqT3o8eh2cCD8ZtbXJ45rMiqLPMbMF4X1ymvdIPP2KytpF3mK674NAfG8uocCMJWtvzSXaq1xZc7oPP78snPjVnE0V+jVX4keX8wKEuvf5+Gbsv71+YaP1FPGc5v4R65h5gnwmk2eTwMkpIloEF1zU/rdX4fiNKhZQri4K6V6iu7RUhyXTSZgbT7kABEu8EWyiXhKse6kjTwV+InOYKsuf1rxXbuYUSsFX6r9d0a0ELP9t0NIsWglpVrsIt/H/haRYxhwdtBmwb2j0FnmW+ZzkviUYaOLRnUzR62I0iZZ416Trofco/h7fx66ozoob0Z/oL2aWcF/4p8i1/UnrIb9qQw9Ela8Jri9qoSzDt1NTOvPN26nfXF3oW2zTR1bjXR72Es8dtJlNFEyGm2Glsa41FPCSMe5vEOl6J9NvoHHZLkwmtsro86NJp4QngZM7/b6KEoKTfWUHnEmd8lcOCtwOcFl6f0O5EnpdQ4+M0Ki09yEMas+yTfy8l9+eS4doOB9PlSxxzXxP3+jBlEjWs5hzL2DWuDWRuMFUoY7XuI9cWhygD2QZyQ1kZo6WUD49k/nEW+DfV1vQSlKDx9YVJHgppvxMmlkBpMocuxRriANW/O9gXeF+ifXtZHOXwQzGgPZ/jOubp7QXyvR0SQd11RT2Yxl9ZrjLp/2XKW8clKfBOUHyv+pY6llHGyJvjej7InLdph3nXPDX+3yhvHeIcfrSUVdSXVvThJALW5e0q0UT0+p708+XFBebxFUGZnwvbbAodmu/hb+NsyeuuWc77NnQUYQzPcmTIREPuo5a5dEx+3qzKhkRrPor5JXFlXMaENkZqFywXV5e8a564cpkWYV3W1EwUSXfJW2PbsS1bf5Pxz5cEdfke4CGNOr5p8xTdlbzlD9s6dF3+f+dR2k3VfH5blBNwJmxuTmvIXp772DXPIOMxO+3NotfUQBZ3WEQfFYfnOg0OZZD4uqCM6wDvYhbooResI/lsYB63P6D5uQb1LKqsEPCdjUXivypNhgLwQ8xeF0GWjGzCL40WXAnlrJerTObv02QB+GKAekP4P06Dl+1FWsVVzMKvz8ElkxVLfVWiWoqulVpLywjAEN/nC/Yi7AAfE9ZnmxV9lSkLP80Q9QUsAK/j9sDfGF+blGjXF8do1xS0brLhU21n4Fj+m5bztvXAIi4BPzWcXwL+hH1sXrTUk+W3DmWlSGZOicf2vuSxridUyeqyz8Q44mr2/0SFdqsSBZ+Z96bdgQAMHcraQuPKzlxsO9xto/Lo2TRL19C9EEarYwHqNJGEqFSb0U2HZLF1G7k6vkB5h0of7OEv8D3SDj5vOe+Sjiw0kvW5NsaMNw6J5udi5JB41f+M6bpQPALen2L7EqTaadwQSoZtvElju6VO7aGxJfEMzaMpt++FMmt+JiSOn19DlkYLwrlc/B77IvMSblbANzE71A7x725Q1657s8AadiFnW78e+OmKlSHmqd4n6+lGIW9jVoqu49ew+a7Hup7gW/hJ+O8U2swi2QbwHm7C1xYonzjUJWHFc32zju1h7NEcV6WkxrbK8BbmRMMrlHcwr40uMtO9z+nVO+OfEi1I4gidRidDNR0g1+h8ptpy9da3rUOFzkYzb9hSXIWOrXXhP1Nu3zbDW8R91rZQcCSunZPSBb4hKCedXkkCkXX2mKGgbB+5hrOAW3JNSRabRew+jXqfBxtvpH4fCsqbpmjzmibrxYrXm15ATdl4S/LdvmMvEhxbMhGXrCwXUdmk844dAhmkusiNDyOUJrSOeuB13v8llEV4hPsAkkwlNsftJgXnk/F5yZ6m6QVraVaShEmMsn6b6f0IdHpuCem3pcRJFCba6kMOpv6eVxY5vN+Ey/4Tb5Rsd1jyOgkJ6gWvnyEJTRgDkmmtpJ/r2N13gq75SffbXUTN9V02FkqTnWIXbYSe166PnHiDzN9PI9dq+5SP4MhawV3DqaJv4oS8l5x0ilU2E4uP6AIdolaVJkXgDLFPS0eo5/7HKBe3Y6jNrNYF14JyTQuSQUcLv2ep522S58PUpYbEheQ/INvIvsAqrNHcTZ/nEVusbx5lEv2GoknpxD6D7NldprxnwvGS11lJ+/mF9mEq8gEcYU9rE6pt8O9+kqXIylgmGeas4yOLkI0mGS5caVq2nRHVM2abCCoX0sJvQLgP0sWs/ewTbuCbkilqOoRZ1zENVq11hqq/jUw76UUedQhkCSGFTBV2CTMOTxM4GCIb4aE/yNBT/UPkCUF1+ixfG5/r1PPSKedJ/Gm/J5ENiJOUv9ezJvg0PsdAES7a/rQFsk442vSlkw5+lgc2xnUNPNRlpCi8TfrwmiibIfY41dTd15lkq3VlQLUkrlrgDh2uOYnqsxTXTNuuvorZtN+++JdD2eOEdSoeei7nmz0mY6nsXim6Hp/l/2k5r8dmmbRfG6jn3mVZYliinSd0RiORnaOH2gLvO+QbB/ZQ2UCu4f9N2Qe+zWFr9B7wISpO94/AH/A/WBPgW6gU9HkW1yHwN1S4j4+F6DPAKxz8rPreXiD/bWhzQM9alk3lq1jWOsAXHPohZR34Lvnf/11UqGSZuiUD31UB6GDf+NvEB7gbHk1tlqnPlDTBdWysoJ6fdP7MR+Of76H2Cn63RL2aSp9dKvwikVkjhPCLtIgq+fwikbYiiUSqkrE50gKi5heZNxJkDvOnqS+LS2QKRM0vMk/0kUcKDQL2I9IAppHSKhIJTQ+Vtux9VO7GT+OW/j2043ukAUThF5lFXkVNbxPck20MidsczAVx2huJHCRqfXNCFH6RyISmhpBFAhCnvZGIQu9kGJkTouYXmXeuI48/j8wQUfhFZpG7gjI6drbxG+1EwhCdnCPzQDpetenZUSI18X+Dj/KN9NJspQAAAABJRU5ErkJggg==) ](https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks "Read about Firevault on SecurityBrief") Capabilities ## What you get with every deployment 01 ### Technique Elimination Rather than detecting techniques after execution, Control eliminates entire technique categories by removing the network paths they require. 02 ### Lateral Movement Prevention Physical zone separation prevents all lateral movement techniques between zones, regardless of the tools or credentials used. 03 ### Living-Off-the-Land Immunity Built-in tools and legitimate credentials cannot be used to cross physical zone boundaries, eliminating the primary advantage of sophisticated attackers. 04 ### Persistence Prevention Time-limited access windows prevent persistent access techniques by physically deactivating paths between authorised sessions. 05 ### Technique Mapping Reports Automated reports map Control module deployments to specific ATT&CK technique mitigations for risk assessment and audit. 06 ### Impact Technique Immunity Verified control-plane baselines are immune to ransomware, data destruction, and recovery inhibition techniques that only affect network-connected systems. Demo to Live ## Adoption Guide Step 1 #### Technique Exposure Assessment Map your critical assets against ATT&CK techniques that rely on network reachability to identify where physical prevention provides the greatest risk reduction. Step 2 #### Prevention Architecture Design Design physical zone boundaries that eliminate the highest-risk technique categories while maintaining operational functionality. Step 3 #### Red Team Validation Deploy Control in a test environment and run a red team exercise to validate that physical boundaries defeat the techniques your detection cannot reliably catch. Step 4 #### Production Deployment Full deployment with automated technique mapping, continuous prevention evidence, and verified control-plane baseline restoration for impact technique immunity. Step 1 #### Technique Exposure Assessment Map your critical assets against ATT&CK techniques that rely on network reachability to identify where physical prevention provides the greatest risk reduction. Step 2 #### Prevention Architecture Design Design physical zone boundaries that eliminate the highest-risk technique categories while maintaining operational functionality. Step 3 #### Red Team Validation Deploy Control in a test environment and run a red team exercise to validate that physical boundaries defeat the techniques your detection cannot reliably catch. Step 4 #### Production Deployment Full deployment with automated technique mapping, continuous prevention evidence, and verified control-plane baseline restoration for impact technique immunity. [Organise a Demo](/contact) ## Explore More [ ### Ransomware Containment Sever the path before ransomware spreads. Learn more about Ransomware Containment ](/control-for-ransomware-containment)[ ### Insider Threat Remove persistent access outside operational windows. Learn more about Insider Threat ](/control-for-insider-threat)[ ### NIST CSF Framework Identify, protect, detect, respond, recover alignment. Learn more about NIST CSF Framework ](/solutions/control/frameworks/nist-csf) Questions ## Frequently Asked Does Control replace our existing detection tools? Which ATT&CK tactics does Control address? How does the technique mapping work? Can attackers bypass physical zone boundaries?