TL;DR: Air gaps no longer guarantee safety for OT assets because malware can enter through hardware interfaces, maintenance laptops, and supply-chain contamination, according to TXOne Networks. In practice, isolation without inspection and update-capable scanning leaves legacy and stand-alone machines exposed to modern threat paths.
At a glance
What this is: TXOne Networks argues that air-gapped environments still face malware exposure through hardware, maintenance access, and infected supply chains.
Why it matters: OT and IAM teams should treat air gap isolation as one control layer, not a complete security boundary, especially where portable maintenance devices and unmanaged media cross trust zones.
Context
An air gap is physical or logical separation from the internet, but separation alone does not stop malware from crossing through removable media, wireless interfaces, or maintenance workflows. In OT environments, the security gap is often governance, not geography: trusted devices, contractors, and supplier workflows can all reintroduce risk into systems that cannot tolerate disruption.
This article sits at the intersection of OT security and identity governance because the main exposure points are maintenance laptops, external peripherals, and supplier-delivered devices. Those are access and trust problems as much as they are malware problems, which is why air gap strategy has to include inspection, lifecycle control, and operationally safe scanning.
Key questions
Q: What breaks when an OT air gap is treated as complete protection?
A: An air gap breaks down when teams assume isolation alone blocks malware. In practice, removable media, wireless interfaces, technician laptops, and supplier-delivered devices create entry paths that bypass the network boundary. Security has to focus on controlled ingress, inspection, and trust validation, not just on disconnecting the machine from the internet.
Q: Why do maintenance devices increase risk in isolated industrial networks?
A: Maintenance devices increase risk because they often move between connected and disconnected environments. If a technician laptop carries malware into an isolated plant, the infection can spread once the device is trusted on the intranet. The risk is driven by borrowed trust, so the control point is device assurance before access, not after compromise.
Q: Where does air gap protection fail in practice for OT assets?
A: It fails at the boundary points teams overlook, especially USB ports, wireless radios, and third-party service workflows. Those paths can transfer code even when the core system never touches the internet. The practical test is whether every route into the environment is inspected, limited, and justified by operations.
Q: How should teams govern supplier access to stand-alone machines?
A: Teams should treat supplier access as a lifecycle control, not a one-time trust decision. Receiving checks, malware inspection, and supplier security questions should happen before installation, because a machine can arrive already compromised. If a supplier path cannot be verified, the asset should not be trusted by default.
Technical breakdown
Why air gaps fail at the interface layer
An air gap only prevents direct internet reachability. It does not prevent code transfer through Wi-Fi adapters, Bluetooth, USB storage, external keyboards, or any other peripheral that can bridge the boundary. In industrial environments, these interfaces are often present for maintenance, diagnostics, or operator convenience, which makes them operationally necessary and security-relevant at the same time. The real issue is that once a trusted interface is allowed across the boundary, malware only needs one successful transfer path to defeat the isolation model.
Practical implication: treat every cross-boundary interface as a controlled ingress point, not as a harmless convenience.
How maintenance devices become the delivery path
Maintenance workflows are especially risky because third-party or internal technicians often bring laptops and tools that have already been used on connected networks. Those devices can carry malware into the isolated environment and spread it once attached to the intranet or local machine. This is not a theoretical bypass, it is a trust problem created by borrowed endpoints crossing into a zone that assumes cleanliness. In OT, the maintenance process is frequently the weakest link because it mixes operational urgency with incomplete device assurance.
Practical implication: require device inspection and controlled scanning before any maintenance asset crosses into an isolated zone.
Why supply-chain inspection matters for stand-alone machines
A device can arrive compromised before it is ever installed. If the supplier’s build, staging, or shipping systems were infected, the malware may already be present when the asset reaches the plant floor. Air gaps also become less effective when systems cannot update signatures, cannot host security software, or must remain untouched to preserve operational stability. That combination turns prevention into blind trust. In practice, the security boundary moves upstream to the supplier, the inbound receiving process, and the ability to inspect without altering the machine.
Practical implication: add inbound verification and portable malware inspection to the asset acceptance process.
Threat narrative
Attacker objective: The attacker objective is to establish persistent malware presence on isolated OT assets without needing direct internet access.
- Entry occurs through removable media, wireless interfaces, or maintenance tools that cross the isolation boundary and introduce malicious code into the OT environment.
- Credential or trust escalation happens when a technician laptop or supplier-delivered device is trusted inside the isolated network and allowed to execute normally.
- Impact follows when malware spreads to legacy or stand-alone machines that cannot easily be patched, updated, or instrumented without disrupting operations.
Breaches seen in the wild
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Air gap security has become an access-control problem disguised as network design. The article shows that isolation fails when hardware interfaces, maintenance workflows, and supplier trust paths are allowed to cross the boundary unchecked. For OT programmes, the decisive question is no longer whether the network is disconnected, but whether any trusted ingress path can carry malicious code into machines that cannot be easily remediated.
Portable inspection is more defensible than static isolation alone. Air-gapped systems that cannot update signatures or host full security tooling need a control that can move across the boundary without breaking operations. That makes portable scanning, inbound verification, and controlled media handling part of the governance model rather than optional hygiene. Practitioners should treat inspection capability as a compensating control for immutable or difficult-to-patch assets.
Supply-chain trust is part of OT threat modelling whether teams acknowledge it or not. The article’s core warning is that a machine can arrive infected before deployment, which means the security programme has to extend to supplier assurance and receiving checks. This is especially relevant where OT and NHI governance intersect, because maintenance identities, service laptops, and external support access often carry the privilege that makes the compromise useful.
Legacy OT environments need a zero-disruption security pattern, not a perfect isolation myth. The practical goal is to reduce exposure without introducing operational instability, because many machines cannot tolerate intrusive agents or frequent changes. That means teams should build layered trust boundaries, inspection points, and controlled exception processes instead of assuming the absence of internet connectivity is enough.
Air gap failure illustrates hidden trust debt in industrial operations. The article’s named concept is the trust debt created when teams rely on separation but leave interfaces, devices, and suppliers outside governance. The practitioner takeaway is simple: if a machine must remain untouched, the surrounding process has to become more controlled, not less.
What this signals
Air gap security now depends on trust-path governance. For OT programmes, the meaningful control is no longer only segmentation but the ability to inspect every device, peripheral, and maintenance path that can cross the boundary. Where those paths cannot be fully controlled, the programme has to compensate with stronger receiving checks and portable inspection.
Portable inspection should be treated as a resilience control for legacy assets. Machines that cannot host modern endpoint tooling still need a way to be examined without disrupting operations. That makes portable malware scanning, controlled media handling, and supplier verification part of operational resilience rather than an afterthought.
For practitioners
- Inspect every cross-boundary maintenance device Require malware checks and device hygiene validation before technician laptops, service tools, or removable media enter isolated OT zones.
- Use portable scanning on stand-alone assets Deploy update-capable portable scanners to inspect machines that cannot host conventional endpoint tools or frequent software changes.
- Control wireless and peripheral ingress paths Inventory Wi-Fi, Bluetooth, USB, and external keyboard pathways on air-gapped assets and disable any interface that is not operationally required.
- Add supplier receipt checks to asset intake Verify new machines for hidden threats at receiving and require evidence of supplier-side security routines before deployment.
- Document exception handling for legacy OT systems Define how teams will inspect, approve, and re-isolate devices when software installation or signature updates are not possible.
Key takeaways
- Air gaps reduce exposure, but they do not stop malware from crossing through trusted interfaces, maintenance devices, or supplier-delivered equipment.
- The article’s central warning is that isolated OT assets can still be compromised before installation or during routine servicing.
- Portable scanning and inbound verification are the controls that matter most when machines cannot safely run conventional security software.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Air-gap failures here are driven by trusted access paths crossing the boundary. |
| Recommendation — Limit OT ingress paths to explicitly approved devices, media, and maintenance workflows. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article highlights control over trusted maintenance and supplier access in OT zones. |
| Recommendation — Review and remove unnecessary trusted access paths for maintenance and support devices. | ||
| MITRE ATT&CK | TA0001;TA0006 — Initial Access; Credential Access | The threat pattern is malware entry through trusted transfer paths into isolated environments. |
| Recommendation — Map boundary-crossing malware paths to Initial Access and Credential Access detections. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Trusted service devices and maintenance workflows rely on credential and access lifecycle control. |
| Recommendation — Apply authenticator management to service devices and reset trust after boundary crossings. | ||
| ISO/IEC 27001:2022 | A.8.24 — Use of Cryptography | The article is about protecting operational systems through inspection and controlled handling, not cryptography specifically. |
| Recommendation — Use cryptographic integrity checks where OT asset intake and media verification allow them. | ||
Key terms
- Air Gap: An air gap is a separation strategy that reduces exposure by keeping recovery copies or protection tiers isolated from normal operational access paths. In practice, it strengthens ransomware recovery by limiting attacker reach, improving retention control, and protecting backup data from direct tampering.
- Malware Scanning: Malware scanning is a security control that compares file content, metadata, or behavior against threat intelligence and detection logic to identify malicious files. In application workflows, it is commonly used at upload time to reduce the chance that infected content propagates into business systems or shared environments.
- Cross-Boundary Trust: Cross-boundary trust is the decision to allow a device, person, or process from one security zone into another. In industrial environments, the risk is that trusted maintenance or supplier paths can carry malicious code, so trust has to be verified each time the boundary is crossed.
- Supply Chain Infection Vector: A supply chain infection vector is the path attackers use to place malicious code into software dependencies and reach downstream users. In Python package attacks, the vector may be a tampered source distribution, a built wheel, or a package import path that executes hidden code automatically.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect trust boundaries to the controls that govern access.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org