A scanner can run air-gapped only if the engine, the vulnerability data, the licence check and the reporting all work without internet access. Ask vendors how updates are carried across the gap, how stale data can get, and what the product does when it cannot reach any server.
Definitions
An air-gapped network has no connection to the internet or other outside networks. Offline scanning means the tool works inside such a network, or at least without calling out during a scan. It is common in defence, industrial, and some financial or healthcare environments.
Four dependencies that break offline
| Dependency | Offline question |
|---|---|
| Vulnerability data | How is it delivered, and how often? |
| Licensing | Does it phone home to validate? |
| Package resolution | Can it resolve dependencies from a local mirror? |
| Telemetry and analysis | Does any feature silently require a cloud service? |
Vulnerability data is the big one. A scanner with a six month old database is worse than none, because it reports a clean result with confidence. Ask for a data package you can import, how it is signed, and how you verify it. Then ask how the product shows the age of its data, so a stale database is visible to everyone.
Features that often quietly need a cloud
Ask specifically about anything described as smart, AI assisted or prioritised. Some such features call a hosted model or lookup service. Ask whether each feature works fully offline, degrades, or turns off. Read the vendor's list in writing. For model transfer in isolated networks, see the air-gapped local model transfer checklist.
Steps for an honest test
- Install the product in a lab network with no outbound route. Block it at the firewall, not just by unplugging, so you see any attempted calls in the logs.
- Import a data package and note its date.
- Scan a project and a container image.
- Review firewall logs for blocked connection attempts, and ask the vendor about each one.
- Wait a week, import a newer data package, and confirm the new advisories appear.
- Record the effort required for each update. If it takes a day, it will not happen monthly.
Update process is a control
For an isolated network, the data transfer path is part of your security model. Define who carries the media, how it is scanned, and how the package signature is checked on the inside. Add a calendar owner and a maximum allowed data age. Treat a missed update like a missed patch.
Quick check
Is a self-hosted scanner automatically air-gap ready?
No. Self-hosted software can still depend on cloud services for data or licensing. Ask directly and test with outbound traffic blocked.
How old can vulnerability data be?
Set your own limit based on risk. Weekly is common to aim for, but the right figure depends on your environment.
Safeguard offers SBOM and dependency scanning and a CLI; ask us about isolated environments directly, and try the free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
