Air-Gapped Deployment

An air-gapped deployment is one with no route to the public network at all. Nothing calls out, nothing calls in, and anything that has to arrive — a software update, a model file, a licence, a set of reference documents — arrives as a file carried across the boundary deliberately by a person or a controlled process. Organisations run this way when the consequence of a leak is severe enough that the cost of the inconvenience is worth paying: some classified and defence work, some industrial control, occasionally a single system inside an otherwise ordinary company. The word is used loosely in sales conversations, and it is worth pinning down. A deployment inside a private network that still reaches a licence server, a telemetry endpoint or a package repository is isolated, not air-gapped, and the distinction matters precisely because the exceptions are where the risk lives. Ask which outbound connections exist and what happens to each of them if the link is cut. The practical costs are predictable and should be planned rather than discovered. Patching is slower because every update is a scheduled import rather than a background event, so the window between a fix existing and a fix being applied is longer. The vendor cannot see your logs, which means diagnosis is your work with their guidance rather than the other way round. Anything that assumed a live network — usage reporting, remote support, retrieval from an external source, a model that is called rather than hosted — either needs a local substitute or has to be given up. And updates to any model running inside the boundary become a supply exercise with an owner and a schedule. None of that argues against the choice. It argues for costing it honestly. One more thing tends to surprise teams the first time: the boundary needs its own operational routine. Somebody has to own the import schedule, verify what is being carried in, and keep a record of which version is actually running inside, because the usual answer of checking the dashboard is not available from the other side of the gap.