Solutions · Air-gapped estates

Built for the network with no way out.

Air-gapped is not a mode that was bolted on afterwards. What works offline is listed here, and so is what does not.

What is asked of you

Why most tools do not survive here.

They assume a callback

A verdict that depends on a lookup against a vendor service is a verdict you cannot get behind an air gap.

Updates arrive as files

Everything that crosses the gap crosses it as a file somebody carries, which means every artefact has to be verifiable on the inside.

Nobody outside has an account

The person checking your evidence will not log in to a console to do it.

Our answer

What works with no route out.

  1. The install is a bundle you carry

    One bundle carries the chart and every image with its signature and a software bill of materials, and the install refuses any image that is not on your own mirror.

    Where it runs

  2. Licences activate from a file

    A signed licence file is verified locally against a bundled public key. No activation call, no phone home.

    Where it runs

  3. The verdict is answered locally

    Whether a file is the original is answered inside your network, by a local copy of the legitimacy database, which is why the product works with no route out.

    The first question: is it the original?

  4. Evidence checks itself

    The audit bundle carries a manifest, a signature and a verifier script that never contacts us and never contacts a timestamp authority.

    Evidence an auditor verifies offline

  5. Removal without the console

    Uninstalling can be authorised with a signed token the agent verifies offline, so a host that lost its link can still be cleaned up.

    Install and lifecycle

RuleEvery detection runs behind your air gap.

Offline is a setting, not a different product.

One setting declares the install offline. Every detection keeps running against the local copy of the legitimacy database; only the features that need a route out go quiet, and they are listed below.

the offline install setting
airGap: trueSee the proof: Every detection runs behind your air gap.
Control catalogues

Mapped to ISO 27001, NIST SP 800-53 and national rules.

  • ISO/IEC 27001:2022
  • NIST SP 800-53 Rev 5
  • Information and Communication Security Guide
  • Turkish Cyber Security Law 7545

Control statuses are filled in by telemetry from the estate itself, which is the only source an air-gapped site has.

Evidence

Evidence that does not need us.

  1. 01Reports export as PDF, CSV or JSON and can be Ed25519 signed.
  2. 02The audit chain can be verified on your side with keys you hold.
  3. 03Exports carry the hash, the collection time and the expiry of every artefact.
  4. What is handed overEverything an assessor needs travels as files.
Each piece of evidence leads to what is handed over at the end.
Boundaries

What does not work offline.

RuleEvery detection runs behind your air gap.

  • Vulnerability and end-of-life data does not refresh by itself; plan how it will be brought in.

  • Reputation lookups and trusted timestamping need a route out, and both are off in an air-gapped install.

  • It detects, explains and evidences. It does not block, isolate or quarantine.

Plan an air-gapped pilot.

Signed bundles, an offline licence and a local copy of the legitimacy database, carried in on your terms and scoped in writing.

Plan a pilot