An air-gapped backup is a copy of data stored on media or a network that is physically or logically isolated from the production environment and the internet, so an attacker who has compromised the primary network still cannot reach, encrypt, or delete it.
The term “air gap” comes from the physical world — a literal gap of air between a system and any network, so nothing can cross it electronically. Applied to backup, an air gap means at least one copy of critical data sits somewhere a remote attacker, or malware spreading through a compromised network, simply cannot get to, no matter whose credentials it has stolen. That property has made air-gapped copies a cornerstone of ransomware defense, even as most day-to-day backup and replication has moved to always-connected cloud infrastructure.
How Air-Gapped Backups Work
An air-gapped backup breaks the continuous network path between production systems and a protected copy of their data. Traditionally this meant physically removing a tape or disk from the network after a backup job completed and storing it offline — in a vault, a safe, or an offsite facility — until it was needed again. While disconnected, the copy is completely unreachable: there is no IP address, no open port, and no credential that can touch it remotely.
Modern implementations extend the same idea to disk and cloud-based storage through scheduled or on-demand connectivity: a backup target only opens a network connection during a defined transfer window, pulls or receives the latest data, and then closes the connection again, leaving the copy isolated the rest of the time. The security property is the same as with tape — whatever happens on the production network in between transfer windows cannot reach the isolated copy.
Physical vs. Logical Air Gaps
A physical air gap is a true absence of any network connection — media such as tape or removable disk that is disconnected and stored offline, with a human or robotic process required to reconnect it. It offers the strongest possible isolation but is slower to recover from, since reconnecting and restoring takes real time.
A logical air gap uses software-defined isolation instead of physical disconnection — a backup target that stays powered and reachable only through a tightly controlled, intermittent connection window, with strict authentication and no persistent network path from production systems the rest of the time. Logical air gaps recover faster than physical ones since nothing has to be physically reconnected, but they depend on the isolation controls being correctly configured and maintained.
Air-Gapped Backup vs. Immutable Backup
The two are frequently paired but solve slightly different problems. An immutable backup is reachable over the network but cannot be modified or deleted once written, thanks to a storage-enforced retention lock. An air-gapped backup may or may not be individually locked, but it cannot be reached over the network at all outside its transfer window. Many resilience strategies layer both: an immutable, always-reachable copy for fast day-to-day recovery, and a periodically air-gapped copy as a last line of defense in case a sophisticated attack somehow reaches or disables the immutability controls themselves.
| Aspect | Air-Gapped Backup | Immutable Backup |
|---|---|---|
| Protection mechanism | Physical or logical network isolation | Storage-enforced retention lock (e.g., WORM/Object Lock) |
| Reachable over the network | No, except during a controlled transfer window | Yes, but cannot be altered or deleted |
| Recovery speed | Slower for physical air gaps; faster for logical | Fast — always online and reachable |
| Primary risk it defends against | Any network-based attack, including infrastructure-level compromise | Deletion or encryption via compromised credentials |
Key Benefits
Strongest Ransomware Defense
An attacker cannot encrypt, delete, or exfiltrate a copy they have no network path to, regardless of how deeply they’ve compromised the rest of the environment.
Protection Against Infrastructure-Level Compromise
Unlike controls that rely on the storage platform staying trustworthy, an air gap remains protective even if the primary backup infrastructure itself is compromised.
Regulatory and Insurance Alignment
Many cyber-insurance policies and compliance frameworks now explicitly ask about offline or air-gapped copies as part of underwriting or audit requirements.
A True Last Resort
Even organizations with mature immutable-backup programs keep an air-gapped copy as a final fallback in case every network-reachable defense somehow fails at once.
Common Implementation Approaches
Organizations typically choose one of a few established patterns, often combining more than one.
Tape Rotation
The original air gap: backups are written to tape, then physically removed and stored offsite, with a rotation schedule determining how many generations are kept.
Removable or Disconnected Disk
Similar to tape rotation but using removable disk media, offering faster restore speed than tape while keeping the same physical-disconnection guarantee.
Scheduled-Connectivity Cloud Vaulting
A cloud or secondary-site backup target that only accepts an inbound connection during a defined window, then closes it — a logical air gap that removes manual media handling.
Separate Credentials and Network Domain
Isolating the air-gapped target under its own authentication domain, with no shared credentials or trust relationship with production, so a compromise of production credentials can’t be used to reach it even during a connectivity window.
Common Use Cases
Ransomware Last Line of Defense
The primary modern driver: guaranteeing at least one recovery point survives even a worst-case scenario where every network-connected defense is bypassed.
Regulated Industries
Financial services, healthcare, and government organizations often face explicit regulatory or audit expectations for offline data copies.
Critical Infrastructure
Utilities and industrial environments use air gaps to isolate operational technology from IT-network-borne threats entirely.
Long-Term Archival
Offline media is also a cost-effective way to retain long-term archival copies that rarely need to be accessed, independent of any ransomware motivation.
Considerations and Tradeoffs
Recovery Time
A physical air gap adds the time needed to physically reconnect media before a restore can even begin, which must be factored into recovery-time planning.
Operational Overhead
Tape rotation and offsite storage require ongoing physical process discipline; a missed rotation undermines the whole strategy.
Data Freshness
Because air-gapped copies update only during scheduled windows, they typically have a wider recovery-point gap than continuously replicated or snapshotted data.
Logical Air Gaps Require Discipline
A logical air gap is only as strong as its connectivity and credential controls; misconfiguration can quietly turn it into an always-reachable target.
Air-Gapped Backup in a Modern Data Protection Strategy
As ransomware groups have grown more sophisticated at hunting down and destroying network-reachable backups before triggering encryption, air-gapped copies have shifted from a niche compliance checkbox to a standard layer in enterprise resilience planning. They work best as one layer among several — paired with immutable backups for fast day-to-day recovery, frequent snapshots for tight recovery points, and a tested disaster recovery plan for the broader failover process. Zadara builds air-gapped and immutable options into its backup and archival storage so customers can layer network isolation on top of locked snapshots, giving them a guaranteed-clean recovery point as part of an overall cyber resilience posture rather than a separately bolted-on process.