Air Gap Security: How Air Gapped Networks Work?

An air gap is a security architecture in which a computer, network, or system is isolated from less trusted networks, especially the public internet. The term air-gap security refers to this use of deliberate isolation as a security control. NIST defines an air gap as an interface where systems are not physically connected and any logical connection is not automated, meaning that data crosses the boundary manually under human control.

Air gapped environments are used when reducing network exposure is more important than convenience. Typical examples include defense systems, classified networks, industrial control systems, research environments, critical infrastructure, and organizations that need communications or applications to continue without public internet access.

An air gap does not make a system automatically secure. Removable media, supply chain compromises, compromised laptops, malicious peripherals, misconfigured transfer procedures, and human error can still introduce threats. Effective air gap security therefore combines network isolation with strict controls for software, identities, updates, data transfer, endpoints, and administration.

Air Gap at a Glance

Question	Short Answer
What is an air gap?	Isolation between systems that prevents normal automated network communication
Does an air gapped system use a network?	It can use an internal network, but that network is isolated from less trusted networks
Is an air gap the same as a firewall?	No. A firewall controls network traffic, while a true air gap removes normal network connectivity across the boundary
Can data enter an air gapped network?	Yes, but transfer must be deliberately controlled
Where are air gaps used?	Defense, government, industrial systems, research, critical infrastructure, and other high security environments
Is an air gap completely secure?	No. Malware can still enter through removable media, transferred files, peripherals, insiders, or compromised supply chains
Can collaboration software work inside an air gap?	Yes, if the server, clients, identity services, storage, and required dependencies are available locally
What is the main tradeoff?	Greater infrastructure isolation in exchange for more complex operations, updates, and data transfer

How Does an Air Gapped Network Work?

An air gapped network contains the infrastructure needed to operate independently.

Users communicate with these systems through the isolated internal network.

If information must enter or leave the environment, it crosses through a controlled procedure rather than an ordinary internet connection. The process may involve approved removable media, dedicated transfer stations, scanning systems, controlled gateways, or other security mechanisms.

The more isolated the environment becomes, the more supporting services must also be brought inside the boundary.

Physical Air Gap vs Logical Isolation

Not every isolated environment uses the same architecture.

Architecture	Connectivity	Typical Control Model	Main Consideration
Physical air gap	No normal physical network path to less trusted networks	Manual transfer under controlled procedures	Strong isolation but high operational overhead
Isolated internal network	Internal systems communicate, but no public internet access exists	Internal routing and local services	Requires all important dependencies to exist locally
Highly restricted network	Limited external routes are allowed through controlled gateways	Firewalls, allowlists, proxies, inspection	More convenient but not a strict physical air gap
Cross domain environment	Controlled data transfer between networks with different trust levels	Specialized gateways and policy enforcement	Requires careful validation of every transfer path

 

A physical air gap offers the clearest separation, but many organizations use other isolation models because completely manual transfer can make normal operations difficult.

Air Gap vs Firewall

A firewall and an air gap solve different problems.

A firewall creates a controlled network boundary. Systems on both sides can still be connected, but traffic is permitted or blocked according to policy.

An air gap removes the normal communications path entirely.

A firewall may allow administrators to permit HTTPS traffic to selected services, synchronize software repositories, or enable remote management. A strictly air gapped network cannot rely on those paths.

This difference changes how organizations handle software updates, remote support, authentication, collaboration, monitoring, and data transfer.

Air Gap vs Offline System

An offline computer is not necessarily air gapped.

A laptop may simply be disconnected from WiFi for several hours while still being capable of reconnecting later. That is different from a system intentionally designed to remain isolated as part of its security architecture.

Likewise, an internal server that temporarily loses internet connectivity is not automatically part of an air gapped environment.

An air gap is a deliberate architectural and operational control.

Air Gap Security: Current Threat Statistics

Air gaps reduce network exposure, but they do not eliminate malware risk.

Honeywell reported 1,826 unique USB threats detected in the first quarter of 2025 through its Secure Media Exchange technology. Of those, 124 were previously unseen threats. Honeywell also reported that one malware family represented 37 percent of blocked files and had increased sharply compared with the previous quarter.

These figures are relevant to air gapped environments because removable media is one of the mechanisms commonly used to move files, patches, configuration data, and software across isolated boundaries.

A 2025 academic survey of malware attacks against industrial air gap systems similarly notes that isolated systems remain vulnerable to attack vectors such as removable media and other physical transfer mechanisms.

The important conclusion is that isolation changes the attack surface rather than removing it.

Air Gapped Software Deployment

Installing software inside an air gap requires a different process from ordinary server deployment.

Mattermost, for example, documents an air gapped deployment process in which software packages, container images, plugins, desktop applications, and documentation are prepared outside the isolated network, transferred across the boundary, and then hosted or installed from local resources.

A local package mirror or private container registry is particularly useful for larger environments because administrators can maintain approved software inside the isolated network instead of repeatedly transferring individual dependencies.

This pattern applies beyond collaboration software. Any application that normally downloads dependencies during installation must be adapted so that every required component is available locally.

Air Gapped Software and Collaboration Platforms

Communication software is particularly important inside isolated environments because employees still need messaging, meetings, files, directories, and administrative tools even when cloud collaboration services are unavailable.

The following platforms document support for air gapped or fully isolated deployments.

Mattermost

Mattermost provides dedicated documentation for self-hosted air gapped environments. The vendor defines such an environment as one where systems cannot access public package repositories, container registries, app stores, or SaaS APIs.

The platform supports channels, direct messages, threads, file sharing, calls, integrations, plugins, and enterprise collaboration workflows. In an air gapped deployment, the Mattermost server and supporting infrastructure operate entirely within the isolated boundary.

The deployment process can use Linux packages, Kubernetes, or containers. Administrators prepare application packages, images, plugins, and documentation before transferring them into the protected environment.

Some features need adjustment. Public push notification services, internet link previews, GIF services, hosted AI models, telemetry, and external email cannot work normally without appropriate local replacements. Mattermost recommends disabling or replacing these dependencies in an isolated deployment.

Element

Element provides an air gapped deployment option for Element Server Suite Pro and documents installation into isolated Kubernetes environments. Air gap bundles can be imported into a local private registry so the platform can be deployed without pulling components from the public internet.

Element positions its air gapped architecture for restricted, classified, and high security networks and states that it can operate without public internet connectivity.

The platform is based on the Matrix communication ecosystem and can provide messaging, rooms, file sharing, voice and video communication, and other collaboration functions depending on the deployed configuration.

A private registry becomes an important part of the architecture because the Kubernetes cluster must be able to retrieve all required application images from within the isolated environment.

TrueConf Server

TrueConf Server is a video conferencing and corporate messaging platform designed for deployment inside organization controlled infrastructure. The full version can operate autonomously within a corporate network without requiring an internet connection.

The platform combines personal and group chats, channels, file exchange, audio and video calls, video conferences, screen sharing, recording, corporate address books, and centralized administration. Conferences can support up to 2,000 participants in supported configurations, and SIP and H.323 integration allows existing video conferencing equipment to connect to the server.

TrueConf Server can be configured for internal network access without external server addresses. Client applications connect directly to the server over the corporate network, while LDAP or LDAPS can provide directory integration.

For systems without access to the vendor registration service, premium or qualifying trial licenses support offline registration through a controlled file exchange process. The full version does not have the periodic connectivity requirement applied to TrueConf Server Free.

Rocket.Chat

Rocket.Chat provides a specific air gapped deployment model for isolated environments. Its documentation states that the workspace can run without a connection to the public internet, with the organization responsible for infrastructure and local application dependencies.

Administrators can deploy Rocket.Chat using transferred Docker images and configuration files or through a private Docker registry hosted inside the isolated network.

Rocket.Chat provides messaging, channels, file sharing, voice and video integrations, application extensions, identity integrations, audit capabilities, and security controls depending on the selected plan.

Cloud dependent functions require changes. Standard mobile push notifications, marketplace access, and applications that call external services may not function in a completely isolated environment. Rocket.Chat documents alternatives such as custom internal push mechanisms and offline application installation.

Air gapped commercial deployments require an appropriate paid license, while offline registration uses a transfer procedure involving a separate connected device.

Pexip Infinity

Pexip Infinity is a self-hosted enterprise video conferencing platform that can be deployed on organization controlled infrastructure.

Its architecture supports private network deployments where conferencing nodes remain within internal addressing, while organizations can choose how and whether external connectivity is provided.

Pexip is primarily focused on enterprise video conferencing and interoperability rather than team messaging. It supports professional meeting room systems and can be distributed across multiple locations to place conferencing resources close to users.

This architecture can be relevant when an isolated environment needs video communication between sites without relying on an external meeting service.

Air Gapped Software Comparison

Platform	Primary Focus	Air Gap Approach	Key Local Capabilities	Main Operational Requirement
Mattermost	Team collaboration	Dedicated air gap deployment process	Messaging, channels, calls, files, integrations	Local package and application distribution
Element	Secure Matrix communications	Air gap bundles and private registry	Messaging, rooms, files, voice and video	Kubernetes and private registry infrastructure
TrueConf Server	Video conferencing and messaging	Autonomous corporate network operation	Chats, conferences, files, SIP and H.323	Server administration and offline license workflow
Rocket.Chat	Team messaging and collaboration	Docker or private registry based air gap deployment	Messaging, channels, files, applications	Local alternatives for cloud dependent functions
Pexip Infinity	Enterprise video conferencing	Private self-hosted infrastructure	Video conferencing and room system interoperability	Enterprise deployment and capacity planning

The products address different operational needs. Messaging platforms, Matrix based communications, unified conferencing systems, and enterprise video platforms should not be treated as interchangeable simply because they can operate inside isolated infrastructure.

Risks and Limitations of an Air Gap

Air gaps create significant operational costs.

Software updates take longer. Administrators cannot rely on public package repositories. Remote vendor support becomes harder. External collaboration may require additional transfer processes.

Removable media can also become a major attack vector. Honeywell’s detection of more than 1,800 unique USB threats in a single quarter demonstrates why removable media cannot be assumed to be safe simply because it is used inside an isolated environment.

Other risks include compromised administrator devices, malicious insiders, supply chain attacks, unauthorized wireless connections, infected peripherals, configuration errors, and outdated software.

An air gap should therefore be understood as one security layer within a broader architecture.

How to Evaluate Software for an Air Gapped Network?

The most important question is not simply whether a product can be installed locally.

Ask whether every required capability can operate with no public internet connectivity.

A vendor that explicitly documents air gap deployment is easier to evaluate than one that only advertises self hosting.

FAQ

What Does Air Gap Mean in Cybersecurity?

An air gap is a separation between systems that prevents normal automated network communication across the boundary. In a strict architecture, systems are physically disconnected and data transfer occurs only through controlled manual processes.

Is an Air Gapped Network Completely Offline?

It is isolated from less trusted external networks, but systems inside the environment may still communicate with each other over an internal LAN. An air gap therefore does not necessarily mean that every device is standalone.

Can Malware Infect an Air Gapped Network?

Yes. Malware can enter through removable media, software packages, administrator devices, peripherals, compromised hardware, or other controlled transfer paths. Air gaps reduce remote exposure but do not eliminate all attack vectors.

Is an Air Gap Better Than a Firewall?

They perform different functions. A firewall controls allowed network traffic between connected systems, while an air gap removes normal automated connectivity across the boundary. Some environments use both isolation and internal firewalls as separate security controls.

Can Collaboration Software Work in an Air Gapped Network?

Yes, if the collaboration server and all necessary dependencies operate locally. TrueConf Server, Mattermost, Element, Rocket.Chat, and other self-hosted platforms provide different approaches to communication inside isolated infrastructure.

Can TrueConf Server Work in an Air Gapped Environment?

The full version of TrueConf Server can operate autonomously inside a corporate network without public internet connectivity, and supported licenses can be registered offline. This allows TrueConf to provide local video conferencing, messaging, file exchange, and connections to SIP and H.323 systems inside isolated infrastructure.

What Is the Biggest Limitation of an Air Gap?

The main limitation is operational complexity. Updates, software dependencies, file transfer, support, certificate management, and external collaboration require controlled offline processes that are slower and more resource intensive than standard connected environments.