In May 2026, West Pharmaceutical Services faced the choice every leader dreads.

West makes components that drug and vaccine makers depend on. On May 4, the company detected an intrusion. Within days it knew data had been taken and some systems had been locked up by the attackers.6

So West did the responsible thing. It took systems offline around the world to contain the attack.6 That stopped the spread. It also meant manufacturing, receiving, and shipping had to restart site by site as systems came back. By May 20, the company said it was fully operational again across its manufacturing, supply chain, and commercial sites.7

West handled a hard situation well, and it was back to full operation in about two weeks. But look at the tool it had to reach for. When you can't tell which systems are safe, the safest move is often to pull the plug on everything.

That's the trade many companies are stuck with today. Stop the attack, and you stop the operation. Keep the operation running, and you leave the door open.

I started NetOps IQ to break that trade.

Let's go back to the camera in the loading yard. 2:17 a.m.

Illustrative scenario

Findavi has been listening to that camera for months. It knows what normal looks like: video to the recorder, nothing else. Tonight the camera reaches for an outside address. That's new.

What happens next takes seven steps.

First, Findavi spots the change and checks it against what the camera has always done. Second, it checks your rules. Is this a device you've agreed can be isolated at night without a phone call? Third, if the rules say ask, it sends the on-call person a clear recommendation: cut this camera off from everything except its video recorder. One tap to approve.

Fourth, it acts. Fifth, it checks that the door is really closed, and the camera can no longer reach anything it shouldn't.

Sixth, and this is the step that often gets skipped, it checks that the camera still works. Is video still reaching the approved recorder? Is the yard still being watched? A fix that blinds your yard is just a different kind of problem.

Seventh, it writes everything down. What it saw. What it recommended. Who approved it. What changed. The proof that the path is closed. The proof that the service still works. And anything left to do in the morning.

At 6 a.m., the trucks roll in. Nobody on the dock knows anything happened.

That's the whole idea. Contain the device, not the building.

A word on what this takes, because you should hear it straight. Findavi can block a device, isolate a port, or push a configuration change. It does this only for the device types, models, and software versions we support, through integrations you approve, and under your rules. We confirm what’s supported at your site before anything is switched on. Nothing happens without someone saying yes, or without a rule you approved in advance. And you can stop, undo, or switch off any agent at any time.

Controlled demonstration

Observed in a NetOps IQ demonstration

We have shown this in a controlled demonstration on a real operator's equipment. For a company that runs RFID infrastructure, Findavi detected and stopped a test attack on the RFID system, then a second test attack on the building's heating and cooling controls. These were demonstrations, not live incidents.

Questions for your team

If one device in your busiest building were taken over tonight, could you cut off just that device? Or would your only option be to shut down much more? Who would approve it, and how would you prove the operation still works?