AirGapNet AGN1
Service path controller
Default-closed access window
Three pilot customers, in their own words. Names anonymised at their request; quotes translated from the original deployments.
Three pilot customers — technology, healthcare, finance — in their own words. Names anonymised at their request.
The core idea
Customer path
Users, customers, employees, and production traffic keep moving.
Service path
Vendor, admin, update, and backup access becomes time-boxed.
Service paths open only for an approved window, then auto-close.
Not the firewall. A vendor VPN, an update channel, a remote-support session — paths the network leaves reachable by default. AirGapNet makes those paths physically absent.
U.S. avg breach cost · 2024
$4.88M
A physical break costs less than the first hour of most incident response. Source: IBM Cost of a Data Breach Report 2024
See AGN1$4.4M ransom
A single exposed VPN account let DarkSide ransomware halt the largest US fuel pipeline for six days.
Source: CISA AA21-131A
$870M impact
NotPetya tore through always-connected production systems, halting manufacturing and disrupting global supply for weeks.
Source: Wired
$67M impact
Ryuk ransomware forced 400 hospitals into paper workflows and delayed critical care across the United States.
Source: BleepingComputer
Near miss
An attacker used always-on remote support to raise sodium hydroxide in drinking water before an operator caught it.
Source: CISA AA21-042A
Use cases
Six common paths where always-on reachability creates unnecessary exposure.
Take a server off the public internet between active sessions. The line returns only for approved windows — backups, updates, vendor jobs.
Open admin access to a server during a scheduled maintenance slot. The path closes automatically when the window ends.
Backup targets stay disconnected from the production network and only open when the backup job runs. Ransomware cannot follow what is not connected.
Pair AGN1 with an air-gapped backup target so the vault is reachable only on explicit, time-limited writes. Combine with WORM storage for true immutability.
Disconnect cameras, sensors, displays, or kiosks from the network when they aren't actively in use. Reduces the lateral-movement surface from edge devices.
External technicians get scoped access to one device during a defined window. No on-site escort, no entire-network exposure.
Product family
Start with one device today. Add rack hardware as you grow. Manage the fleet from one place.
“Firewalls, EDR, training — all in place, and the attacker still walked in through a path that should not have been open at all.”
Markus Roth
Co-Founder
