01Air-gapped is an architecture, not a setting
It is tempting to treat air-gapping as a strict firewall rule. It is not. A genuinely air-gapped deployment has no NAT, no DNS resolution to external hostnames, no public certificate authority chain, and no network path (physical or logical) by which a packet can leave the enclave.
Every dependency the system needs at runtime (the model weights, inference engine, vector store, and user interface) must reside inside the perimeter before it is sealed. Air-gapping cannot be retrofitted onto software architected for continuous cloud connectivity; it must be designed from first principles.
For classified defence workloads, this distinction is critical. An isolated private cloud still carries boundary inspection and remote vendor maintenance vectors. A true air-gap eliminates external attack surfaces entirely by removing network boundaries.
02The update protocol for secure enclaves
A connected AI system downloads vendor updates continuously. An air-gapped system receives updates only when an authorized operator physically transfers cryptographically signed media across the gap. In practice, models, container images, and orchestration templates are bundled, signed with sovereign keys, and verified upon ingestion.
The internal registry remains strictly immutable between update cycles. Release cadences are deliberate and controlled (often monthly or quarterly for sensitive military workloads) because every update is an audited operational event.
This trade-off is the cornerstone of sovereign security. Controlled update cycles ensure systems cannot be reached, altered, or exfiltrated over adversarial networks.
03What actually has to run locally
Running high-assurance models on-premises requires hosting the entire compute stack inside the enclave: quantized open-weight models, local vector stores, inference servers, and role-based access controllers. None of these components can rely on external telemetry or hosted APIs.
04Why human verification remains essential
An air-gapped model cannot query external cloud APIs for secondary verification. Therefore, the cited evidence trail behind every intelligence output is non-negotiable: every operational assessment must trace back to verbatim source documents, sensor tracks, or line items.
In sovereign command workflows, AI accelerates document processing and situational synthesis while trained military operators retain final decision authority, with every confirmation or override immutably logged.
05What this means operationally
Building and acquiring sovereign defence software demands accounting for unique operational constraints:
- Procurement must accommodate structured, deliberate update cycles rather than assuming constant web access.
- Hardware capacity must be sized accurately up front, without reliance on commercial cloud burst compute.
- Every integrated database and sensor feed must be audited for hidden outbound network requests.
- Immutable audit logs and operator verification workflows are foundational to system trust.
Frequently Asked Questions
What does air-gapped AI actually mean?
Air-gapped means an AI system runs with no network route to the outside world: no NAT, no external DNS lookups, and no path for packets to leave the secure enclave. It is a fundamental architecture decision.
Is air-gapped the same as an isolated or private cloud deployment?
No. Private clouds often retain managed vendor connections for monitoring. Air-gapped architectures remove external connections entirely; all runtime dependencies reside strictly within the physical perimeter.
How do you update an air-gapped AI system without internet access?
Updates are packaged into signed container bundles, transferred across the security perimeter on verified physical media, and cryptographically authenticated before deployment.
Why do defence AI systems need a human in the loop?
Air-gapped deployments cannot rely on external corrections mid-operation. A clear audit trail and mandatory operator confirmation guarantee that every tactical decision remains defensible and accountable.