An air-gapped network is a network physically isolated from the public internet and all external networks. No wired, wireless, or cellular path exists between the isolated environment and outside systems. Moving data in or out requires physical media such as a USB drive, an optical disc, or a serial console connection.
What is an air-gapped network?
The air gap is the empty space where a network cable would normally be. Switches and routers inside the isolated zone have no uplink to the corporate LAN or an internet gateway. Wi-Fi radios are disabled or removed. Cellular modems are banned. The only way data crosses the gap is a deliberate, documented media transfer with a chain of custody.
For decades this was treated as the strongest form of network security. The logic was simple: if an attacker cannot reach the network over any channel, remote exploitation is impossible. That assumption made air-gapping the default for classified military networks, nuclear plant control systems, and high-security government enclaves.
How does an air-gapped network work?
Isolation comes from eliminating every physical and logical route to the outside. There is no gateway, no VPN concentrator, no cloud tunnel. A device that needs a firmware update or a data export waits for a technician to carry the file across on approved media, often through a scanning kiosk or a data diode that enforces one-way flow.
The tradeoff is operational. Most modern security tools assume connectivity: threat intelligence feeds, signature updates, and cloud management consoles all expect the internet. Inside an air gap, those tools either stop working or depend on a manual update process that is tedious and, in practice, frequently skipped. The isolation that keeps attackers out also keeps defenders' telemetry in.
Is air-gapping enough to secure a network?
No, and the record is clear on this. Stuxnet, discovered in 2010, crossed the air gap into Iran's Natanz enrichment facility on infected USB drives carried by personnel doing routine transfers, then sabotaged the centrifuge controllers. Since then, researchers have shown exfiltration across air gaps using electromagnetic emissions, acoustic signals, thermal gradients, and blinking LED status lights on network gear.
Every USB drive is a potential attack vector. Every maintenance laptop brought inside the perimeter can carry malware. Supply chain tampering can plant compromised firmware before the equipment is ever installed. And because the interior was assumed safe, air-gapped networks are often flat and unsegmented, so once something gets in, lateral movement is unrestricted and no monitoring team sees it happen.
Who uses air-gapped networks?
Defense manufacturers that handle classified or export-controlled technical data run air-gapped networks for CNC machines, test benches, and design workstations. Nuclear power plants operate safety-critical control systems on air-gapped networks under NRC rules. Utilities, water treatment plants, and pharmaceutical production lines use them for the most sensitive process control. In every case the operator still owes access control, audit logging, and segmentation inside the gap. Regulators do not accept the air gap as a substitute for those controls.
How is air-gapping different from zero trust?
Air-gapping is a perimeter strategy: keep threats out by cutting every wire. Zero trust assumes the threat is already inside and verifies every request by identity, regardless of location. They are not rivals. The strongest isolated environments run zero-trust controls inside the air gap, so a piece of USB-borne malware cannot roam freely once it lands. Identity-enforced network segmentation limits lateral movement, encrypted tunnels protect east-west traffic, and local authentication enforces policy with no cloud dependency.
Why does air-gapping matter for compliance?
Isolation does not exempt a network from its obligations. NIST SP 800-171 still requires account management, audit events, and boundary protection regardless of internet connectivity. IEC 62443 demands defense-in-depth inside isolated zones, not just at their edge. NERC CIP treats some air-gapped systems as low-impact BES cyber assets that still need controls under CIP-003. CMMC assessors evaluate compensating controls for air-gapped enclaves the same way they would for connected ones.
How Access Gate helps
Access Gate runs fully air-gapped using a self-hosted Headscale coordination server, so you get zero-trust overlay networking and microsegmentation inside a physically isolated network with no cloud dependency. See Air-gapped deployment.
