Air Gap Software: What It Is, How It Works, and How to Choose an Air Gap Solution

Air gap software is software designed to operate in an isolated environment without requiring a connection to the public internet, external cloud services, or other untrusted networks. Organizations use air-gapped software when sensitive systems and data must remain physically or logically separated from outside networks.

An air gap solution can be used for everything from cybersecurity and data protection to business applications, workflow automation, forms, IT help desks, and other systems that need to operate in disconnected environments.

For organizations running Microsoft SharePoint Server in highly secure environments, NITRO Studio with NITRO Secure provides an air-gapped software option for forms, workflows, business applications, and automation without requiring outbound cloud connectivity.

What Is Air Gap Software?

Air gap software is software that can function within an isolated network where there is no normal connection to the internet or other external networks.

A true air-gapped environment is more than simply using a firewall or putting a system on a private VLAN. NIST defines an air gap as an interface where systems are not physically connected and automated logical connections are not present, with data transferred manually under human control.

In practice, air gap software must be designed or configured so that its core functionality does not depend on:

• Internet connectivity
• External cloud services
• Vendor-hosted APIs
• Automatic software updates
• External authentication services
• Continuous outbound connections
• Cloud-based data processing

This distinction is important because many modern SaaS applications assume that systems have continuous internet access.

An application may be described as “secure,” “private,” or “on-premises” while still requiring external connectivity. That does not necessarily make it suitable for a fully air-gapped environment.

What Is an Air Gap Solution?

An air gap solution is a technology, architecture, or combination of technologies designed to protect systems and data by isolating them from external networks.

Depending on the organization’s requirements, an air gap solution may include:

• Air-gapped software
• Isolated servers
• Network segmentation
• Physically disconnected networks
• Secure data transfer processes
• Removable media controls
• One-way data transfer mechanisms
• Offline authentication
• Offline software installation and updates
• Monitoring and auditing within the isolated environment

Air gap solutions are particularly important when an organization cannot allow sensitive information to leave a controlled environment.

NIST recommends considering an air gap around cyber-attack recovery copies of sensitive data and notes that strict implementations provide physical and network-level separation.

How Does an Air Gap Work?

The basic concept is straightforward: remove the network pathway that an attacker or unauthorized external system could use to reach the protected environment.

A simplified architecture looks like this:

External Network → No Network Connection → Air-Gapped Environment

Instead of continuously communicating with external systems, the isolated environment operates independently.

If information needs to cross the air gap, the organization uses a controlled process. Depending on the security requirements, this could involve approved removable media, controlled transfer stations, or other organization-specific mechanisms.

The important point is that the transfer is deliberate and controlled rather than an application automatically communicating with an external service.

Air Gap vs. Firewall

A firewall controls network traffic.

An air gap removes the normal network connection altogether.

A firewall can be an important security control, but a firewall does not automatically create a true air gap.

Air Gap vs. Offline

“Offline” and “air-gapped” are sometimes used interchangeably, but they are not always the same.

A system might be temporarily disconnected from the internet and still reconnect periodically.

A true air-gapped architecture requires significantly stronger isolation and controls.

NIST specifically distinguishes strict physical and network-level air-gapping from less strict isolation technologies that may periodically reconnect for synchronization.

Why Do Organizations Use Air Gap Software?

Organizations typically consider air gap software when the consequences of external connectivity are too significant to accept.

Common reasons include:

1. Protecting sensitive information

Air-gapped environments can help protect classified, confidential, proprietary, or otherwise sensitive information by eliminating normal network pathways to external systems.

2. Reducing attack surfaces

An internet-connected application has potential exposure to threats originating outside the organization.

Removing external connectivity can eliminate entire categories of network-based attack paths.

3. Supporting highly regulated environments

Some organizations have security, regulatory, contractual, or mission requirements that make disconnected operation necessary.

Air-gapped environments are commonly associated with:

• Defense
• Government
• Intelligence
• Aerospace and space operations
• Nuclear operations
• Critical infrastructure
• Financial services
• Healthcare
• Industrial control systems
• Research environments

4. Protecting critical systems from ransomware

Air-gapped systems can provide an additional layer of isolation against attacks that spread through connected networks.

For example, organizations may maintain isolated recovery infrastructure so that a compromised production network cannot automatically reach protected recovery systems.

5. Maintaining operational independence

Some facilities cannot depend on internet connectivity because of their physical location, security requirements, or mission.

Air gap software allows important applications to continue operating inside the isolated environment.

What Software Can Run in an Air-Gapped Environment?

Air-gapped software is not limited to cybersecurity tools or backup systems.

Organizations may need disconnected versions of everyday business applications, including:

• Workflow automation software
• Forms software
• Help desk software
• Ticketing systems
• Document management applications
• Asset management software
• Business process applications
• Case management systems
• Manufacturing applications
• Operational databases
• Monitoring systems
• Development and DevOps tools

This creates an important challenge.

It is relatively easy to say that a server is air-gapped. It is much harder to find modern software that was actually designed to operate there.

Many modern applications depend on cloud services for authentication, licensing, updates, AI processing, integrations, analytics, or other functionality.

That makes air gap compatibility an architectural requirement, not simply a checkbox on a deployment sheet.

What to Look for in Air Gap Software

If you are evaluating air gap software, don’t stop at the words “on-premises.”

Ask these questions before selecting a platform.

1. Does it operate without internet connectivity?

The software should support its core functions without requiring continuous access to the internet.

Ask the vendor:

Can the application operate with zero outbound network connectivity?

2. Does it require vendor cloud services?

A product may be installed on your own servers but still depend on a vendor’s cloud.

Ask whether the application makes outbound connections for:

• Licensing
• Authentication
• Telemetry
• Updates
• Analytics
• AI
• Notifications
• API calls
• Support services

3. Where does the data go?

Understand exactly where application data is stored and processed.

For a highly secure environment, the answer should be clear and verifiable.

4. Can updates be installed offline?

Software still needs security patches and updates in an air-gapped environment.

Ask how updates are transferred into the isolated network and whether the vendor provides a supported offline update process.

5. Can authentication work inside the isolated environment?

Authentication requirements can become a major issue in disconnected networks.

Determine whether the application depends on external identity providers or can use authentication infrastructure available inside the isolated environment.

6. Does the software have an air-gapped deployment model?

A vendor saying “you can probably make it work offline” is very different from a vendor offering a supported air-gapped deployment.

Look for a documented architecture and deployment process.

7. What happens to integrations?

Integrations are one of the biggest challenges in an air-gapped environment.

A workflow application that normally connects to dozens of cloud APIs may require a fundamentally different architecture when deployed in a disconnected network.

Determine which integrations are supported inside the air gap and which require controlled data transfer.

Air Gap Software vs. On-Premises Software

These terms are related, but they are not synonymous.

The key takeaway is simple:

On-premises does not automatically mean air-gapped.

An application can run on your own servers and still require an external connection.

Air Gap Software for Microsoft SharePoint

Organizations using Microsoft SharePoint Server can face a particular challenge when they need business applications inside a disconnected environment.

Traditional SharePoint forms and workflows may rely on technologies or integrations that are no longer ideal for modern application development.

At the same time, many cloud-first automation platforms assume access to Microsoft cloud services.

For organizations that must keep SharePoint applications inside an isolated network, the software needs to support the deployment architecture itself rather than simply provide an on-premises installation.

NITRO Studio as an Air Gap Solution

NITRO Studio is a no-code/low-code application development and workflow automation platform for Microsoft SharePoint.

For organizations that need fully disconnected SharePoint applications, NITRO Secure provides an air-gapped deployment option for NITRO Studio.

NITRO Studio can run on SharePoint Server 2016, 2019, and Subscription Edition in on-premises environments, including a fully air-gapped deployment through NITRO Secure.

This allows organizations to build and run applications such as:

• Electronic forms
• Approval workflows
• Business process automation
• Request management
• Custom SharePoint applications
• Dashboards and reports
• Departmental applications
• Automated notifications
• Workflow-driven business processes

The important distinction is that NITRO Secure is designed for disconnected environments, rather than simply being a standard cloud application installed on a local server.

For organizations replacing legacy SharePoint workflows or forms in highly secure environments, this can be especially important.

NITRO Help Desk for Air-Gapped Environments

Air-gapped environments still need IT support.

Users need to report problems, IT teams need to track tickets, requests need to be routed, and support teams need visibility into service performance.

That’s where NITRO Help Desk can fit.

NITRO Help Desk is built natively on SharePoint, Microsoft 365, and Teams and provides ticket management, automated routing, forms, workflows, reporting, and other help desk capabilities.

For organizations operating SharePoint Server in highly secure environments, NITRO Help Desk can be deployed using NITRO Secure for air-gapped environments. Crow Canyon specifically lists NITRO Secure as an air-gapped deployment option for NITRO Help Desk.

This gives organizations a way to maintain help desk operations without introducing a cloud-based ticketing system into an isolated network.

NITRO Studio vs. Traditional Cloud-First Automation

For organizations with normal internet connectivity, cloud automation can be a good fit.

For organizations with disconnected networks, the requirements are different.

The right choice depends on the organization’s security architecture and deployment requirements.

For organizations that cannot connect their systems to external services, however, an air-gapped deployment can eliminate an entire category of cloud dependency.

Who Needs an Air Gap Solution?

An air gap solution is most appropriate when network isolation is a core security requirement rather than simply a preference.

Organizations that may benefit include:

Government agencies

Government environments may have systems containing sensitive or classified information that require strict network separation.

Defense and intelligence organizations

Defense environments often operate networks with highly restricted connectivity and require applications that can function without external services.

Aerospace and space organizations

Mission-critical systems may operate in environments where security, reliability, and connectivity restrictions make cloud-dependent applications inappropriate.

Nuclear and critical infrastructure organizations

Operational systems may require isolation from corporate or public networks to reduce cybersecurity risk.

Financial institutions

Financial organizations may use isolated environments for highly sensitive systems, recovery infrastructure, or specific regulated workloads.

Healthcare organizations

Some healthcare environments have strict requirements around data protection, system architecture, and operational continuity.

Challenges of Deploying Software in an Air-Gapped Environment

Air gaps provide strong isolation, but they also introduce operational challenges.

Software updates

You cannot simply click “Update” and download a new version from the internet.

Organizations need a controlled method for obtaining, validating, transferring, and installing updates.

Dependency management

Applications may depend on third-party libraries, packages, certificates, APIs, or services.

Those dependencies need to be available inside the isolated environment.

Licensing

Some software licensing systems require periodic internet communication.

Air-gapped organizations should verify that licensing can operate without external connectivity.

Support

Vendor support processes may need to account for the fact that support engineers cannot remotely access the environment.

Data transfer

When data needs to move across the air gap, the organization needs documented procedures governing what can cross the boundary and how it is inspected.

These challenges are why organizations should evaluate air gap software before deployment rather than attempting to retrofit an ordinary cloud application into a disconnected network.

How to Choose the Best Air Gap Solution

There is no single best air gap solution for every organization.

The right solution depends on what you are trying to protect and what application you need to operate inside the isolated environment.

Use this checklist when evaluating vendors:

Security

• Does the software require outbound connectivity?
• Does it communicate with vendor infrastructure?
• Can all data remain inside the isolated environment?
• Does it support your organization’s security architecture?

Deployment

• Is fully air-gapped deployment officially supported?
• Which versions of your operating system and SharePoint are supported?
• Can the software be installed without internet access?
• Can updates be transferred securely?

Functionality

• Does the application provide the features your users actually need?
• Do workflows operate without cloud services?
• Can forms operate offline?
• Can reporting and administration operate inside the environment?

Integration

• Does it integrate with the systems available inside your air gap?
• Which integrations require external connectivity?
• Can necessary data transfers be controlled?

Vendor support

• Does the vendor have experience supporting air-gapped environments?
• Is there a documented deployment process?
• Can the vendor support customers without remote access?

Frequently Asked Questions About Air Gap Software

What is air gap software?

Air gap software is software designed to operate in an isolated environment without requiring normal internet or external network connectivity. It is used when organizations need to protect sensitive systems and data from external network access.

What is an air gap solution?

An air gap solution is a technology or architecture that isolates systems and data from external networks. It can include physically disconnected networks, isolated servers, controlled data transfer, and software specifically designed for disconnected operation.

Is air-gapped software the same as on-premises software?

No. On-premises software runs on infrastructure controlled by the organization, but it may still require internet or external services. Air-gapped software is designed to operate without those external connections.

Is an air gap more secure than a firewall?

An air gap and a firewall provide different types of protection. A firewall controls network traffic, while a true air gap eliminates normal network connectivity between systems. Air gaps can therefore remove attack paths that a firewall would otherwise have to control.

Can Microsoft SharePoint run in an air-gapped environment?

SharePoint Server can be deployed on-premises, and solutions such as NITRO Studio with NITRO Secure can provide business application, forms, and workflow capabilities in fully air-gapped SharePoint environments.

Can workflow automation run in an air-gapped environment?

Yes, provided the workflow platform is specifically designed to operate without external connectivity. NITRO Studio supports fully air-gapped SharePoint Server deployments through NITRO Secure.

Can a help desk operate in an air-gapped network?

Yes. An air-gapped help desk can run entirely within the isolated environment, allowing users and IT staff to create, manage, route, and resolve tickets without relying on an external SaaS platform. NITRO Help Desk supports air-gapped deployment through NITRO Secure.

What industries use air-gapped systems?

Air-gapped environments are commonly used in government, defense, intelligence, aerospace, nuclear, critical infrastructure, financial services, healthcare, and other environments where network isolation is important.

The Bottom Line

Air gap software is designed for a fundamentally different security environment from ordinary cloud software.

The goal is not simply to host an application on your own server. The goal is to operate the application without requiring an automated connection to external networks or services.

For organizations using Microsoft SharePoint Server, this makes deployment architecture particularly important.

NITRO Studio with NITRO Secure provides an air gap solution for SharePoint forms, workflows, and business applications, while NITRO Help Desk extends the same approach to IT ticketing and service management. Both provide options for organizations that need modern business software while keeping operations inside a disconnected environment.

If your organization is evaluating air gap software for SharePoint, workflow automation, or help desk operations, the most important question to ask vendors is simple:

Can the software operate completely inside our isolated environment, without requiring outbound connectivity?

For organizations where the answer must be yes, that requirement should be established before comparing features, pricing, or integrations.