Blog

Writing on the physics of network access.

Long-form primers, engineering notes, and field reports — for OT operators, security teams, and MSPs working through what physical isolation looks like in practice.

ConceptMay 20266 min read

How AirGapNet works: a 6-minute primer

What the AGN devices physically do, where they sit alongside your firewall, and why "online when needed" is a different category of control.

Read article

EngineeringMay 20267 min read

Why our control plane runs on cellular, not your LAN

If the device that gates a network is reachable from that network, the gate is not really there. Why we put the control channel on GSM — and what that buys you.

Read article

ConceptApril 20266 min read

When a firewall fails, the path stays up. A hardware switch is different.

Every software control assumes the path exists. When the rule misfires, traffic still has somewhere to go. A relay on the line fails the other way — and that changes the security outcome.

Read article

Field notesApril 20267 min read

How to retire the always-on vendor VPN

The vendor account that opens one CNC in practice has line-of-sight to the whole subnet. A field guide to replacing the permanent integrator tunnel with a scheduled physical window.

Read article

EngineeringMarch 20268 min read

Air-gapped backups: when "immutable" is not enough

Storage-layer immutability slows down the attacker. A line that does not exist between backup windows stops them. The difference matters during a live incident.

Read article

IndustryMarch 20266 min read

MSPs: sell physical isolation as a feature, not a footnote

MSPs spend QBRs explaining how vendor access is controlled. Per-tenant physical isolation, scheduled from the NOC, is a feature you can put on the one-pager — not an apology in the footnotes.

Read article

ConceptFebruary 20267 min read

Air gap vs network segmentation: when to use which

Both isolate, but they answer different questions. Segmentation asks who may use a path; an air gap asks whether the path exists. Pick the right tool — usually both, in different parts of the diagram.

Read article

EngineeringFebruary 20267 min read

Purdue model: which conduits actually need a physical break

The Purdue model names the layers; the conduits between them are where attackers actually move. A short map of which conduits earn a hardware break and which do not.

Read article

Field notesJanuary 20268 min read

SCADA vendor accounts: why "disabled" usually isn't

Every SCADA operator has a story about a vendor account that quietly stayed up after the last service call. Why VPN + jump host leaves the path live, and what a scheduled physical window changes.

Read article

IndustryJanuary 20266 min read

HIPAA and medical devices: what hardware can — and can't — claim

HIPAA does not certify hardware. It asks for outcomes. Where physical isolation contributes to the technical safeguards a hospital already runs — and where the "HIPAA-compliant device" pitch is wrong.

Read article

IndustryDecember 20257 min read

IEC 62443: where the standard meets a hardware switch

62443 was written for the kind of control AirGapNet provides. Which Security Requirements a relay contributes to, which it does not, and how integrators wire it into the conformity narrative.

Read article

Field notesDecember 20256 min read

OT maintenance windows: closing is the hard part

Opening a maintenance window is easy. Closing it on time, every time, is the part incidents are made of. The pattern where the close runs on a timer, not on an operator remembering.

Read article

Skip the article

See it on your network instead.

30 minutes on the call, a real AGN1 on your bench, one maintenance window on your equipment. Most demo requests get a confirmed slot within a week.

Book a demo