Platform · Feb 11, 2026 · 5 min read

Air-gapped AppSec with no phone-home

Full coverage offline - your data never leaves.

For finance, government and critical infrastructure, data residency is not a feature on a checklist - it is the condition that decides whether a tool is allowed inside the building at all. The question these teams ask first is not "how good is the detection" but "where does my source code, my traffic, my finding data go." If the honest answer is "to a vendor cloud for analysis," the conversation is over before it starts. apPosture is built to give a different answer: nothing leaves your network, because nothing needs to.

Most security tools that call themselves self-hosted still keep one foot in the cloud. The scanner runs on your infrastructure, but the AI analysis goes to a hosted model, the vulnerability database is fetched live, the license is validated by a call home, and usage telemetry streams out by default. Each of those is a thread back through the perimeter, and in an air-gapped environment every one of them is a failure point. The design goal here was to cut all of them.

01Everything that thinks runs inside the boundary

The parts of an AppSec platform that are tempting to host elsewhere are exactly the parts that touch your most sensitive data: the engine that reads source for SAST, the AI layer that reasons over findings, and the gate that decides whether a build ships. In apPosture all three run on customer infrastructure. The scanners (DAST, SAST, SCA, container, IaC, secrets) execute locally. The AI engine is a local LLM served on your own hardware, not an API key pointed at someone else's. The CI gate evaluates policy in your pipeline. There is no step in the pipeline that requires reaching the public internet.

┌─ CUSTOMER NETWORK ──────────────────────────────────────┐ scanners AI engine CI gate DAST SAST SCA ──► local LLM ──► policy decision IaC secrets (on-prem) block / pass reads from curated CVE / threat-intel cache (local, no fetch) └────────────────────────────┬────────────────────────────┘ phone-home telemetry / cloud AI / license call ╳ BLOCKED AT THE PERIMETER
Every component that processes your data sits inside the network boundary. The only arrow that crosses the perimeter is the one that is never sent.

02How detection stays current with no outbound connection

The usual objection to going fully offline is that a security tool goes stale: new CVEs land daily, and a scanner that cannot fetch them is blind to last week's vulnerability. apPosture answers this with a curated CVE and threat-intelligence cache that ships and updates as a controlled artifact rather than a live feed. Detection content - vulnerability records, dependency advisories, the data the engine matches against - is packaged and brought across your own boundary on your own terms, the same way you already move signed software into a sensitive environment.

This matters beyond the air gap. A live feed is itself an attack surface and a dependency: if the upstream is down, poisoned, or rate-limiting you, your scan quality moves with it. A cache that you import deliberately is auditable - you know exactly which content version produced a given finding, which is the kind of provenance a regulator or an incident reviewer will eventually ask for.

03Local versus phoned-home, component by component

The clearest way to see the difference is to lay out what a typical cloud-backed tool sends outward against what apPosture keeps in place:

ComponentTypical cloud toolapPosture
Source / traffic analysisuploaded to vendor backendprocessed locally, never leaves
AI reasoninghosted model APIlocal LLM on your hardware
CVE / advisory datalive fetch from the internetcurated cache, imported offline
License / entitlementperiodic call-home checklicense file, no validation call
Usage telemetrystreamed out by defaultnone emitted

There is no row where the offline answer is a degraded version of the online one. The engine, the AI analysis and the gate are the same code regardless of whether the host can see the internet - air-gapped operation is the default posture, not a stripped-down mode you fall back to.

04No telemetry, by construction

"No telemetry" is easy to claim and hard to verify when a product is built to call home and then has the calls switched off by a flag. The more durable position is to not build the outbound paths in the first place. apPosture has no cloud dependency to disable: there is no analytics endpoint waiting for a configuration toggle, no model gateway that a misconfiguration could re-enable. A network team can confirm this the direct way - put the host behind an egress-deny policy and watch the platform keep working with nothing leaving.

05Why the pricing follows the architecture

An honest air-gapped product almost has to be licensed rather than metered. Metered consumption pricing - per scan, per finding, per token - requires the vendor to count what you do, and counting means reporting, and reporting means a connection out. You cannot sell a no-phone-home platform and bill by phone-home usage. apPosture is therefore a license, not metered consumption: you run it as much as you need on infrastructure you control, and the commercial model never becomes a reason for data to cross the boundary.

For a regulated buyer this closes the loop. The same property that satisfies the auditor - that nothing about your code, your findings, or your usage leaves the network - is the property that keeps the bill predictable and the deployment self-contained. Data residency stops being a compromise you negotiate against capability, because the full platform, AI included, already lives on your side of the wall.

Evidence over heuristicsReachable beats foundMonitor → Block: rolling out a gate without slowing teamsIaC-grounded threat modelingOne platform vs three toolsOWASP Top 10 2025: what actually changed
See it on your own app →