Vulnerability Management in Air-Gapped Environments: A Practical Guide

Air-gapped environments, networks with no direct internet connectivity, are common in critical infrastructure, defense, government agencies, financial institutions, and industrial control systems. These networks exist for good reason: isolation is one of the most effective security controls available.

But isolation creates a challenge: how do you keep track of known vulnerabilities when your systems can’t reach the internet?

Most vulnerability scanners assume internet connectivity. They need to download signature updates, sync with cloud platforms, and phone home for licensing. In an air-gapped environment, these tools either don’t work at all or require complex workarounds.

The air-gapped vulnerability management challenge

In a connected environment, vulnerability management follows a straightforward workflow:

1. Scanner downloads latest vulnerability signatures
2. Scanner scans your systems
3. Results are uploaded to a cloud dashboard
4. Team triages and remediates

In an air-gapped environment, every step becomes manual:

1. Download vulnerability data on a connected system
2. Transfer it to the isolated network via approved media (USB, optical disc, data diode)
3. Import it into your scanning tool
4. Run the scan locally
5. Export results for reporting (if needed outside the air gap)

This manual process is error-prone, time-consuming, and often falls behind. Many air-gapped environments end up with vulnerability data that’s weeks or months out of date.

Exploited first: what to look at when data is days old

An air-gapped network always runs a little behind the outside world, so the order in which you work matters more than anywhere else. The CISA Known Exploited Vulnerabilities (KEV) catalog is the place to start: about 1,500 vulnerabilities confirmed to be exploited in the wild, each with a remediation deadline.

That does not mean ignoring the rest. A vulnerability that nobody exploits today can be on the list next week, and an air-gapped network will only find out at the next import. So the data you bring in should cover every known vulnerability, and the exploited ones should come first in the list you work from:

• Clearer prioritization: every entry in the KEV catalog has a confirmed exploitation and a remediation deadline
• A list that is complete: the rest is there too, ranked below, so nothing is missing when it becomes exploited
• A regular cadence: CISA adds a few new entries every week, which is the rhythm an import should follow

How SentriKat handles air-gapped deployments

SentriKat was designed from the ground up to support air-gapped environments. Here’s how each component works without internet access:

1. Deployment

SentriKat runs entirely on your infrastructure via Docker Compose. The deployment process:

1. Download the SentriKat Docker images on a connected system
2. Export them as tar archives: docker save
3. Transfer to the air-gapped network
4. Load the images: docker load
5. Start the application: docker compose up -d

No internet access is required from the air-gapped network at any point.

2. License activation

SentriKat supports offline license activation:

1. In SentriKat, open Settings > License and copy the Installation ID
2. On a connected machine, sign in to the SentriKat portal, go to Downloads and bind the license to that Installation ID
3. Download the signed license file (or copy the license key)
4. In Settings > License > Activate Offline, paste the key and click Activate License

The license is signed and valid for its full term without calling home.

3. Vulnerability data: the signed offline bundle

The vulnerability data, the software identities and the exploit probabilities travel as one signed bundle:

1. On a connected machine, download the latest bundle from the portal, under Downloads
2. Move it into the air-gapped network the way you move any file there
3. In SentriKat, go to Settings > Sync & Updates: the Offline Updates (air-gapped) panel is at the bottom, below Advanced Maintenance

The bundle is verified against its signature before anything is written: a bundle altered in transit is refused and nothing changes. From 22 October 2026, downloading offline bundles from the portal requires a Professional license. The step-by-step guide is in the air-gap documentation.

We recommend importing a new bundle at least weekly, so the vulnerabilities, and which of them are being exploited, stay current.

4. Agent communication

SentriKat agents communicate only with your local SentriKat server, never with any external service. In an air-gapped environment, agents connect to the SentriKat instance on your internal network. No firewall exceptions for external addresses are needed.

5. Backup and restore

SentriKat includes built-in backup and restore functionality. Backups can be stored on the local filesystem or transferred to external storage via your approved data transfer procedures.

Best practices for air-gapped vulnerability management

Based on our experience with air-gapped deployments, here are practical recommendations:

Establish a regular sync cadence

• Weekly minimum: Import a new bundle at least once per week
• After major incidents: When a widely exploited vulnerability is in the news, import the latest bundle as soon as practical
• Document the process: Write a step-by-step procedure for the import that any authorized operator can follow

Use the three-tier confidence system

SentriKat’s three-tier confidence system (Affected / Likely Resolved / Resolved) is especially valuable in air-gapped environments. Even if your KB is a few days behind, the confidence tiers provide context:

• AFFECTED: This vulnerability has no known vendor fix, investigate immediately
• LIKELY RESOLVED: A vendor fix exists but hasn’t been verified on this endpoint, check the installed version
• RESOLVED: The fix is confirmed via version comparison, no action needed

Leverage compliance reporting

NIS2 Article 21 and CISA BOD 22-01 compliance reports can be generated entirely within the air-gapped environment and exported as PDFs for external reporting needs.

Plan for updates

When SentriKat releases software updates, the same Docker image transfer process applies. We recommend testing updates in a staging environment before deploying to production, which is standard practice in air-gapped environments.

Conclusion

Air-gapped vulnerability management doesn’t have to mean flying blind. With complete vulnerability data brought in on a regular cadence, the exploited ones first, and a tool designed for offline operation, you can maintain effective vulnerability oversight even in the most isolated environments.

SentriKat’s air-gapped deployment model is included in every Pro license at no additional cost. Request a demo to see how it works with your infrastructure.