Recent Breaches
Breaches
View All →
Server rack dissolving behind a glowing magenta padlock
Threat Response

Contain Ransomware Through Physical Path Severance

Ransomware relies on network reachability to spread, encrypt, and extort. When the paths it depends on are physically severed, lateral movement stops. Recovery assets remain beyond reach.

Back to Control

Key threats addressed

Lateral movementBackup destructionDouble extortionVendor supply chain compromiseLong dwell-time intrusions

Overview

Take reachability away from the ransomware playbook.

Ransomware is a network problem. Without paths between segments it cannot spread, and without a path to backups it cannot destroy the route to recovery. Firevault Control sits at every zone boundary and hardens recovery infrastructure behind physical disconnection, so a single intrusion cannot become an enterprise-wide encryption event.

Threat Response

If ransomware can reach your backups, you do not have backups. If it can traverse between network segments, containment is theoretical. Physical disconnection makes containment absolute.

73%

Of ransomware attacks involve lateral movement across network segments

21 days

Average dwell time before ransomware detonation

Zero

Recovery assets reachable from network-connected infrastructure

Minutes

From detection to complete path severance across all zones

The Threat

Ransomware exploits the connections organisations depend on.

Lateral Movement

Once inside the perimeter, ransomware traverses network segments through legitimate pathways, escalating privileges and encrypting systems faster than response teams can isolate them.

Backup Destruction

Modern ransomware specifically targets backup infrastructure. Network-connected recovery systems are encrypted alongside production data, eliminating the primary recovery mechanism.

Dwell Time Exploitation

Attackers spend weeks mapping the network before detonation, identifying backup schedules, disabling security tools, and positioning encryption payloads across every reachable system.

Pain points

  • Flat networks let a single compromised endpoint encrypt every reachable system.
  • Online immutable backups are still online and still reachable by the attacker.
  • Detection windows are too short to relocate critical recovery infrastructure by hand.
  • Insurers and regulators want continuous evidence of segmentation, not point-in-time snapshots.

The Scenario

Scenario: Ransomware Detonation in a Multi-Site Enterprise

A logistics company detects ransomware encryption beginning on a file server at 02:14 on a Saturday morning. The malware has been resident for 18 days, during which it mapped network shares, identified backup schedules, and deployed encryption payloads to 340 systems across four sites. The attackers disabled volume shadow copies and encrypted the backup server before detonating the primary payload. With Firevault Control, the Firebreak module severs all inter-site connectivity within 90 seconds of the SOC alert. Verified control-plane baselines held by the Archive module are not reachable from the production network, so the ransomware cannot touch them. By 06:00, the company is restoring from known-good copies while the encrypted segments remain physically isolated for forensic analysis.

"We had backups. We had immutable storage. We had network segmentation. The ransomware encrypted all of it because every system was reachable from every other system. Physical disconnection is the only thing that would have stopped it."

Ransomware kill chain

Where Control breaks the ransomware chain.

Ransomware operators rely on a predictable sequence: get in, get quiet, get everywhere, then encrypt. Firevault Control removes the network reachability each stage depends on, so the chain cannot complete even when individual hosts are compromised.

Mapped to MITRE ATT&CK Enterprise tactics TA0001 to TA0040, NCSC ransomware guidance and the CISA #StopRansomware playbook.

  1. ST 01

    Initial Access

    TA0001

    ◤ Attacker

    Lands on a user endpoint through phishing, an exposed remote service or a trusted third-party route, then waits for a callback.

    ◢ Control breaks it

    Crown jewel systems sit behind a severed conduit. The initial foothold has no path to the assets that matter.

    FirebreakIsolate
    ✕ Break here
  2. ST 02

    Persistence and Privilege Escalation

    TA0003 / TA0004

    ◤ Attacker

    Adds scheduled tasks, services and stolen credentials so the foothold survives reboots and is harder to evict.

    ◢ Control breaks it

    Named, time-bound access is enforced for any administrative reach. Trust to the protected zone is revocable, not implicit.

    LockUnlinkValidate
    ✕ Break here
  3. ST 03

    Lateral Movement

    TA0008

    ◤ Attacker

    Walks the network with stolen credentials, abusing SMB, RDP and management tooling to reach the file servers and hypervisors.

    ◢ Control breaks it

    Inter-zone paths exist only when explicitly opened, and only for the window required. No standing reachability to traverse.

    FirebreakIsolateRelay
    ✕ Break here
  4. ST 04

    Backup and Recovery Sabotage

    TA0040

    ◤ Attacker

    Deletes shadow copies, encrypts backup catalogues and disables recovery agents so the only way out is to pay.

    ◢ Control breaks it

    Recovery copies are held in an offline vault that is not on the live network. The attacker cannot reach what is not reachable.

    ArchiveTransfer
    ✕ Break here
  5. ST 05

    Detonation

    TA0040

    ◤ Attacker

    Triggers encryption across every reachable system, then drops the ransom note and starts the leak-site countdown.

    ◢ Control breaks it

    The Firebreak module severs every governed conduit on alert. The blast radius stops at the last open boundary.

    FirebreakExecuteValidate

Outcome · outcome block

Even if the attacker completes initial access, the chain stalls at the first severed conduit. Recovery copies remain intact in the offline vault, ready for a clean restore.

Modules & symbols

FirebreakPhysical sever
IsolateZone boundary
LockNamed access
UnlinkRemove trust
ValidateIntegrity check
RelayTime-bound path
ArchiveDisconnected copy
TransferControlled move
ExecuteApproved action
✕
Break hereChain severed by Firevault
◤
Attacker stepMITRE ATT&CK tactic

Featured In

TechRadar ProSecurity BuyerYahoo FinanceSecurityBriefChannel Insider

Key Capabilities

Sub-Minute Severance

Physical path disconnection across all network zones completes within 90 seconds of an authorised command, stopping lateral movement faster than any software-based containment.

Unreachable Control-Plane Baselines

Verified control-plane baselines held by the Archive module have no live network path to production. Ransomware cannot encrypt what it cannot reach.

Pre-Positioned Segmentation

Network segments are physically separated during normal operations, limiting the blast radius before an incident occurs.

Multi-Party Authorisation

Emergency severance and recovery operations require multiple authorised parties, preventing a single compromised account from interfering with the response.

Tamper-Proof Forensics

All network path changes, access events, and recovery operations are logged to physically disconnected storage that cannot be altered by the attacker.

Regulatory Evidence

Automated compliance logging provides the evidence required for ICO notification, NIS2 incident reporting, and cyber insurance claims.

Demo to Live

Adoption Guide

Step 1

Lateral Movement Audit

Map every network path that ransomware could traverse between segments, identifying backup infrastructure reachability and inter-site connections.

Step 2

Containment Architecture

Design physical segmentation zones with Firebreak points at every critical boundary and Archive positions for verified control-plane baselines.

Step 3

Tabletop Exercise

Simulate a ransomware detonation scenario with physical path severance, testing response times, multi-party authorisation, and restoration from verified control-plane baselines.

Step 4

Production Deployment

Deploy across all network zones with automated alerting integration, continuous compliance evidence generation, and scheduled recovery copy rotation.

Step 1

Lateral Movement Audit

Map every network path that ransomware could traverse between segments, identifying backup infrastructure reachability and inter-site connections.

Step 2

Containment Architecture

Design physical segmentation zones with Firebreak points at every critical boundary and Archive positions for verified control-plane baselines.

Step 3

Tabletop Exercise

Simulate a ransomware detonation scenario with physical path severance, testing response times, multi-party authorisation, and restoration from verified control-plane baselines.

Step 4

Production Deployment

Deploy across all network zones with automated alerting integration, continuous compliance evidence generation, and scheduled recovery copy rotation.

Questions

Frequently Asked

    Your privacy matters

    We use cookies to keep the site running smoothly and to understand how you use it. You are in control. Privacy Charter · Cookie Policy

    Ransomware

    Protecting operational technology from ransomware through physical isolation and modular security.

    © 2026 Firevault Limited. Disconnect to Protect®