An air-gapped environment has no outbound internet by design. Running application security there means every capability - discovery, exploitation, dependency data and AI analysis - must work entirely offline. Most SaaS tools cannot; a self-hosted, local-model platform can.
apPosture deploys with Docker Compose and is functional with no outbound connection. Analysis runs on a local LLM, so there is no cloud AI dependency, and the license is verified with an offline signature rather than a call home. The one optional network step - pulling the model image - can itself be performed through your offline image pipeline. See the sovereign deployment.
Because nothing egresses, data-residency and sovereignty controls are satisfied structurally, and the evidence vault and framework mapping stay entirely within your boundary. There is no sub-processor chain to review for your code, because there are no sub-processors touching it.
Yes. Dynamic testing runs against your own applications inside your network, so it needs no internet. Only OAST-style out-of-band checks require connectivity and are off by default.
Through a controlled offline update channel rather than a live internet feed, on your schedule.
No. A local LLM performs the analysis, so air-gapped deployments keep full AI-assisted triage and remediation.
From discovery to a proven attack chain. A PoC in your own environment.