Learn · Architecture

Air-gapped application security: scanning with no egress

An air-gapped environment has no outbound internet by design. Running application security there means every capability - discovery, exploitation, dependency data and AI analysis - must work entirely offline. Most SaaS tools cannot; a self-hosted, local-model platform can.

01What air-gapped actually demands

  • All scanners run locally, container-to-container, with no callback to a vendor.
  • Vulnerability and dependency data ship and update through an offline channel, not a live feed.
  • AI analysis uses a local model - no cloud inference, ever.
  • Licensing verifies offline, without a phone-home.

02How apPosture runs offline

apPosture deploys with Docker Compose and is functional with no outbound connection. Analysis runs on a local LLM, so there is no cloud AI dependency, and the license is verified with an offline signature rather than a call home. The one optional network step - pulling the model image - can itself be performed through your offline image pipeline. See the sovereign deployment.

03Compliance benefit

Because nothing egresses, data-residency and sovereignty controls are satisfied structurally, and the evidence vault and framework mapping stay entirely within your boundary. There is no sub-processor chain to review for your code, because there are no sub-processors touching it.

FAQ

Can DAST work air-gapped?

Yes. Dynamic testing runs against your own applications inside your network, so it needs no internet. Only OAST-style out-of-band checks require connectivity and are off by default.

How do vulnerability feeds update offline?

Through a controlled offline update channel rather than a live internet feed, on your schedule.

Does the AI need the cloud?

No. A local LLM performs the analysis, so air-gapped deployments keep full AI-assisted triage and remediation.

Keep reading
Air-gapped solutionSelf-hosted vs SaaSTrust centerQuickstart

See it on one of your own apps - live in 30 minutes

From discovery to a proven attack chain. A PoC in your own environment.