UPDATE, ISOLATION

Air-Gapped AI Deployment For Defense And Government Sites

A defense network that carries classified traffic has no route to a vendor licence server, no outbound DNS, and no tolerance for a product that phones home on a schedule nobody documented. Most enterprise AI is built on the opposite assumption. This article covers what changes when the AI has to run inside a network that was designed to have no external connection at all, and what an operator has to provide for that to work.

THE CONSTRAINT

What Air-Gapped Actually Means On A Government Site

An air gap is a boundary protection decision before it is a technical one. NIST SP 800-53, control SC-7, requires systems to connect to external networks only through managed interfaces, and the isolation of a high-side enclave is the strongest version of that requirement: there is no managed interface, because there is no connection (NIST SP 800-53 Rev. 5). Where information does have to cross between security domains, it crosses through a cross-domain solution under a separate approval, and that path is deliberately narrow, audited, and slow.

That has three consequences for any software an integrator wants to install. It cannot validate a licence over the internet. It cannot pull a model update. It cannot emit telemetry, crash reports, or usage analytics, because an outbound packet from the high side is an incident regardless of what it contains. A product that treats any of those as mandatory is a product the accreditation will reject, and finding that out during assessment rather than during procurement is expensive.

The second thing an air gap changes is the threat model. Isolation removes the network as an attack path and promotes removable media into the primary one. Honeywell’s 2025 Cyber Threat Report recorded 1,826 unique USB-borne threats in the first quarter of 2025 alone, 124 of which had never been seen before (Honeywell, June 2025). Every model update you carry into a closed network on a drive is a transfer event that has to be scanned, signed, and logged.

WHAT BREAKS

The Three Dependencies That Stop Cloud-Shaped AI At The Boundary

Licence Activation

Most commercial AI software checks a licence against a vendor endpoint, either at install or on a heartbeat. Inside an enclave that check fails permanently, and the usual workaround of a long grace period leaves the operator with a system that stops on a date nobody is tracking. Offline activation has to be a supported path with a documented key file, and it has to survive a hardware replacement.

Model Updates

Detection accuracy drifts as a site changes: new uniform colours, a re-lit bay, a camera moved during construction. An air-gapped system still needs updates, so the vendor has to deliver them as signed offline packages that the customer’s own approved media process carries across. ARSA delivers Sovereign model updates this way, as signed packages transferred by the customer’s media procedure.

Telemetry And Fleet Management

Remote diagnostics are useful on a connected estate and prohibited on a classified one. The question to ask a vendor is whether the management channel can be disabled entirely rather than merely encrypted. For ARSA Sovereign the encrypted fleet management channel is optional and can be switched off for air-gapped deployments, which means support arrives as instructions to your staff instead of as a session on your network.

THE ARSA POSITION

What Runs With No Outbound Connection

ARSA operates no cloud inference service for any product, so isolation is the default posture rather than a hardened variant. Video analytics on the AI Box Series run detection on the device next to the cameras and function with no network at all. The self-hosted analytics software runs in containers on servers the customer owns. The Face Recognition and Liveness SDK is air-gap capable with the face database under the customer’s control.

ARSA Sovereign is the document and language side of the same principle, and it is in pilot. Its product page states that no outbound connection is required at inference time, that no document, query, or result reaches ARSA, that the vector index and document vault sit on encrypted local storage, and that every write into a connected ERP is staged for explicit human approval before it commits. There is no autonomous write mode to enable. The platform is built on a hardened Linux host with FIPS 140-3 validated cryptographic modules and CIS and DISA-STIG hardening profiles applied at build. Beyond what that page states, treat any specification you read elsewhere as unverified.

One more boundary is worth stating plainly. Sovereign runs an open-weight model of a size that fits in a rack appliance, which performs well on document extraction, structured summarisation, form generation, and ERP workflow execution. On the hardest open-ended reasoning tasks it will trail a frontier hosted model. Organisations that can send data outside the building and need maximum raw capability are better served by the cloud. Organisations that cannot send data outside the building do not have that option in the first place, which is the whole reason this class of appliance exists.

THE NUMBERS

What The Site Has To Provide

Isolation changes nothing about physics. A camera that cannot resolve a helmet on a connected network cannot resolve it on an isolated one either, so the site requirements standard applies unchanged. ARSA-CVS-001 sets these figures, and they are the same everywhere they are published.

The reference case is the geometry ARSA accepts without further argument. Positions that depart from it are assessed individually against the standard, which is what the Remote Camera Design Review produces: a pass or fail per position, $1,500 for up to 20 cameras over one week, or $4,500 plus travel for an on-site survey of up to 50 cameras. Either fee is deducted from the project fee if you contract within 90 days. The full figures and the distance tables behind them are published at system requirements.

SCOPE

What Air-Gapped Deployment Does Not Give You

Isolation is a control against network-borne compromise and exfiltration. It does nothing about an insider with legitimate access, a mislabelled drive, or a badly configured approval workflow, and it does not by itself satisfy an accreditation. The Risk Management Framework still requires categorisation, control selection, independent assessment, and an authorising official’s signature, and an air gap is evidence toward some of those controls rather than a substitute for the process.

ARSA also holds no certification it has not been granted. FIPS 140-3 validated cryptographic modules and STIG hardening profiles describe the build of the Sovereign platform. They are not a claim that your deployment carries an ATO, and any vendor who tells you their box arrives accredited is describing something that does not exist.

Air-gapped and classified deployments are quoted after a site survey, for both the analytics software and the Face SDK. That is a scoping requirement rather than a sales gate, because the media transfer procedure, the update cadence, and the physical access controls differ at every facility and they determine the work.

FAQ

Does ARSA Sovereign Require An Internet Connection To Run?

No. No outbound connection is required at inference time. Licence activation and model updates are delivered as signed offline packages and transferred by your own approved media process.

Can The Fleet Management Channel Be Turned Off Completely?

Yes. The management channel is encrypted by default and can be disabled entirely for air-gapped deployments. Fleet management, model updates, and remote diagnostics are included in the support term, and an isolated site simply receives them offline.

What Happens To Documents Processed On The Appliance?

They stay on it. Text extraction, embedding, indexing, and reasoning all run locally on encrypted storage. Nothing is transmitted to ARSA or to any third party.

Can An AI Agent Write To Our ERP Without A Human Approving It?

No. Every connector is read-only by default and every write is staged for explicit human approval before commit. There is no autonomous write mode available to enable.

Do The Video Analytics Products Work Offline Too?

Yes. The AI Box runs offline by default, the self-hosted software runs in containers on your own servers, and the Face Recognition and Liveness SDK is air-gap capable. Air-gapped and classified deployments are quoted after a site survey.

How Long Does Delivery Take?

Sovereign appliances ship three to four weeks from order, from Surabaya. Import duty, VAT, customs clearance, and rack installation are the buyer’s responsibility. Camera-led work starts with a design review, which takes one week remotely.

READY TO SCOPE IT

Start With The Boundary, Then The Hardware

If your enclave has no route out and your documents cannot leave the building, the specification to read first is ARSA Sovereign, which sets out the appliance, the hardened platform, the approval gate on every ERP write, and the offline update path. If cameras are in scope as well, a design review against ARSA-CVS-001 tells you which positions work before anything is ordered. Talk to us with your isolation requirement written down, and we will tell you where it fits and where it does not.