In August 2025, the FBI identified Russia's FSB targeting Cisco infrastructure inside US critical facilities using custom tools. CISA documented Chinese groups Volt Typhoon and Salt Typhoon using living-off-the-land tactics — legitimate system tools repurposed to evade detection — inside power grids, water systems, and pipeline networks. The attack surface is not theoretical. It is active, state-sponsored, and targeting the systems that keep the lights on. Every cloud-connected AI system deployed inside critical infrastructure adds another network path that adversaries can traverse. Air-gapped AI eliminates that path entirely — the AI runs on hardware that has never been connected to the internet, processes data that never leaves the facility and delivers predictive maintenance and anomaly detection without introducing a single new attack vector into the OT network. Sign up free to evaluate air-gapped AI for your critical infrastructure.
Five Attack Surfaces Air-Gapped AI Eliminates
Every cloud-connected AI system introduces attack surfaces that did not exist before the AI was deployed. Air-gapped AI delivers the same predictive maintenance, anomaly detection, and process optimization capabilities — while removing each of these vectors from the threat model entirely. Sign up free to map your current AI attack surface.
01
INTERNET-FACING API ENDPOINTS
ELIMINATED
THREAT Cloud AI platforms expose REST APIs, authentication endpoints, and data-ingestion URLs on the public internet. Every endpoint is a target for credential stuffing, API abuse, and exploitation of unpatched vulnerabilities in the cloud platform's web stack.
AIR-GAPPED No API endpoints exist on any network outside the facility. The AI's interfaces exist only on the plant's isolated OT network. There is no URL to attack because there is no URL.
02
LATERAL MOVEMENT FROM IT TO OT
ELIMINATED
THREAT Cloud-connected AI requires a network path from the OT sensor network through a DMZ to the internet. Volt Typhoon and Salt Typhoon use exactly this path — moving laterally from compromised IT systems through the DMZ into OT networks. The cloud AI's data path becomes the APT's movement corridor.
AIR-GAPPED No network path between OT and IT. No DMZ traversal. No internet connection. The air gap is physical — there is no cable, no wireless link, no logical bridge between the AI system and any external network. The corridor does not exist.
03
CLOUD CREDENTIAL COMPROMISE
ELIMINATED
THREAT Cloud AI platforms require API keys, service accounts, and IAM credentials that can be stolen via phishing, insider threat, or supply-chain compromise. A stolen credential grants full access to the AI platform — and to every piece of OT data that was uploaded to it.
AIR-GAPPED No cloud credentials exist. No API keys. No service accounts on external infrastructure. Authentication is physical — badge access to the server room, biometric access to the console. The credential that matters is the one that opens the door, not the one stored in a password manager.
04
SUPPLY-CHAIN SOFTWARE COMPROMISE
ELIMINATED
THREAT Cloud AI platforms auto-update dependencies, libraries, and model versions over the internet. A compromised dependency (SolarWinds-style) or a malicious model update propagates automatically to every connected deployment. The CrowdStrike incident proved that a single bad update can crash 8.5 million machines.
AIR-GAPPED Updates arrive via physical media (verified USB, secure transfer station) after offline validation in a staging environment. No automatic updates. No internet-delivered packages. Every update is manually reviewed, hash-verified, and tested before it touches production. The supply chain terminates at a physical boundary.
05
DATA EXFILTRATION VIA AI TELEMETRY
ELIMINATED
THREAT Cloud AI systems continuously upload sensor data — vibration signatures, process parameters, equipment utilization patterns — that reveal operational capabilities, production rates, and infrastructure vulnerabilities. For critical national infrastructure, this telemetry is intelligence. Adversaries do not need to hack the AI. They need to intercept the data stream the AI creates.
AIR-GAPPED No data leaves the facility. No telemetry stream to intercept. No upload to analyze. The operational data that reveals infrastructure capability stays inside the air gap. The intelligence value of the data is protected by the same mechanism that protects the operations: physical isolation.
5
Attack surfaces eliminated entirely
0
External network connections
Physical
Updates via verified media only
100%
AI capability · zero connectivity
The five attack surfaces are not mitigated by better firewalls, stronger encryption, or more sophisticated intrusion detection. They are eliminated by the absence of a connection. Air-gapped AI does not defend against network attacks. It makes network attacks irrelevant — because there is no network to attack. Book a free assessment to identify which attack surfaces your current AI introduces.
Two Real Air-Gapped AI Scenarios
Two real scenarios from critical infrastructure operators that deployed air-gapped AI to maintain operational capability without introducing cyber risk. Sign up free to evaluate air-gapped deployment for your facility.
SCENARIO 01 · POWER GENERATION
"Our CISO blocked every cloud AI proposal because any internet connection to the turbine control network violated our NERC CIP requirements. Air-gapped AI gave us predictive maintenance without opening a single port."
THE PROBLEM
Combined-cycle gas turbine power plant. 600MW capacity serving 400,000 homes. The maintenance team wanted predictive AI for turbine bearing monitoring, generator vibration analysis, and heat recovery steam generator (HRSG) tube leak detection. Three cloud AI vendors were evaluated and rejected by the CISO: every proposal required an internet connection to the OT network for data upload, violating NERC CIP-005 (Electronic Security Perimeter) and CIP-007 (System Security Management). The CISO's position: "No internet connection to any system that touches turbine controls. Non-negotiable."
THE AIR-GAPPED DEPLOYMENT
OT Edge (Jetson)
Jetson boxes connected to vibration sensors, thermocouples, and pressure transmitters on the isolated OT network — the same network the DCS uses. No connection to IT, no connection to internet, no connection to anything outside the plant's electronic security perimeter.
AI Engine (RTX)
RTX server in the plant control room on the same OT LAN. Predictive models for turbine bearing, generator vibration, and HRSG tube leak run entirely on-prem. Alerts displayed on the DCS operator workstation — not on a cloud dashboard. The CISO reviewed and approved the network diagram: zero external connections.
Model Updates
Model updates delivered quarterly via verified USB through the secure transfer station (the same mechanism used for DCS firmware updates). Each update hash-verified, tested on the staging RTX in the engineering office, then deployed to production during a planned maintenance window. NERC CIP-compliant at every step.
THE RESULT
Predictive maintenance live on 3 turbine assets + HRSG. Zero new network connections. NERC CIP audit passed clean. CISO approved. First bearing alert: 6 weeks before failure. Estimated avoided outage: $1.8M.
SCENARIO 02 · WATER UTILITY
"After the Oldsmar water treatment hack attempt, our board mandated zero internet connectivity for anything touching SCADA. We still needed AI for pump degradation monitoring. Air-gapped AI was the only option that satisfied both requirements."
THE PROBLEM
Municipal water treatment facility serving 180,000 people. After the 2021 Oldsmar incident (attacker remotely accessed a water plant's SCADA and attempted to increase sodium hydroxide to lethal levels), the utility board mandated complete network isolation for all SCADA-connected systems. The operations team needed AI for pump bearing degradation, chemical dosing optimization, and membrane fouling prediction — but every AI vendor required internet connectivity. The board's mandate was absolute: nothing touching SCADA connects to the internet. Period.
THE AIR-GAPPED DEPLOYMENT
OT Edge (Jetson)
Jetson boxes on the SCADA network monitoring pump vibration, motor current, chemical feed rates, and membrane differential pressure. Connected to existing 4-20mA and Modbus sensors. No IP connectivity outside the SCADA VLAN.
AI Engine (RTX)
RTX server in the plant's control building on the same isolated network. Pump degradation model, chemical dosing optimizer, and membrane fouling predictor all running locally. Operator sees AI alerts on the SCADA HMI alongside process data — single interface, zero context-switching.
Board Compliance
Network diagram verified by the utility's cybersecurity consultant: zero external connections. Board mandate satisfied. AI capability delivered without reversing the post-Oldsmar network isolation mandate. Quarterly model updates via the same sneakernet process used for PLC firmware.
THE RESULT
AI predictive maintenance live on 12 pumps + membrane train. Zero internet connections. Board mandate fully satisfied. First pump bearing alert saved $45K in emergency repair. Membrane fouling predicted 3 weeks ahead — chemical costs reduced 12%.
Frequently Asked Questions
The questions CISOs, OT security managers, and infrastructure directors ask when evaluating air-gapped AI for critical facilities. Book a free air-gap assessment for your facility.
How does the AI get data if it has no network connection to IT systems?
The AI connects directly to OT sensors on the same isolated OT/SCADA network — vibration sensors via IEPE/4-20mA, motor data via Modbus RTU, process data via OPC-UA on the local control network. It does not need IT connectivity because the data it processes already exists on the OT network. The Jetson edge boxes and RTX server are OT devices on the OT VLAN — they talk to sensors and DCS, not to email servers and cloud portals. The air gap is between OT and everything else, and the AI lives on the OT side of that gap.
How do model updates reach an air-gapped system?
Via physical media through a secure transfer station — the same mechanism most critical infrastructure facilities already use for PLC firmware updates and DCS patches. The model update package is downloaded to a verified USB drive on an isolated workstation, hash-verified against the vendor's published checksum, scanned for malware on the transfer station, tested on a staging RTX in the engineering office, and then deployed to the production RTX during a planned maintenance window. Quarterly update cadence is typical. No automatic updates. No internet-delivered packages.
Does air-gapped AI sacrifice accuracy compared to cloud AI?
No — in fact, air-gapped AI often improves accuracy. Cloud AI downsamples sensor data for upload (10kHz → 1Hz), losing the high-frequency signatures that vibration analysis needs. Air-gapped AI processes full-resolution data on-site because there is no bandwidth constraint. The AI models are the same — trained on the DGX Station (which can be air-gapped or briefly connected for retraining), then deployed to the RTX via physical media. The inference accuracy is identical. The data quality is better because nothing is lost to compression or batching.
Which compliance frameworks require or recommend air-gapped AI?
NERC CIP (power generation/transmission) requires electronic security perimeters that air-gapped AI satisfies natively. NIST SP 800-82 (ICS security) recommends network segmentation that air-gapping implements completely. TSA Security Directives for pipelines (post-Colonial Pipeline) mandate cybersecurity measures for OT systems. CISA's 2026 AI-in-OT guidance warns against AI implementations that introduce new data-breach vectors. DOD CMMC for defense facilities requires controlled environments. No framework explicitly says "air-gap your AI" — but every framework's requirements are architecturally easiest to satisfy when the AI has no external connection.
How fast can we deploy air-gapped AI?
Eight to twelve weeks. Weeks 1-2 — OT network survey, sensor inventory, SCADA integration points identified, cybersecurity review of the proposed deployment (critical step — CISO approval before any hardware arrives). Weeks 3-4 — Jetson edge boxes installed on the OT network, RTX server deployed in the control building, sensor connections validated. Weeks 5-8 — AI models loaded via secure transfer station, baseline data captured, first predictive alerts flowing on the OT HMI. Weeks 9-12 — model tuning on site-specific data, operator training, update procedure documented and tested. NERC CIP / security audit documentation generated.
Air-Gapped · Zero Attack Surface · Zero Connectivity Required
The Most Secure AI Deployment Is the One With No Network Connection. That Is What Air-Gapped AI Delivers.
Book a 30-minute call with our critical-infrastructure deployment engineers. Walk through your OT network topology, your security mandates, and your predictive maintenance requirements. See how air-gapped AI delivers full capability with zero connectivity — and zero new attack surface. Perpetual license, source code included, $0/mo.
