Air-gapped OT networks: what security teams are missing

TL;DR: Air gaps no longer guarantee safety for OT assets because malware can enter through hardware interfaces, maintenance laptops, and supply-chain contamination, according to TXOne Networks. In practice, isolation without inspection and update-capable scanning leaves legacy and stand-alone machines exposed to modern threat paths.

Editorial analysis by NHI Mgmt Group, based on content published by TXOne Networks: “What Is Air Gapped Network in Cyber Security, and Why Is It Not Enough?”.

Key questions

Q: What breaks when an OT air gap is treated as complete protection?

A: An air gap breaks down when teams assume isolation alone blocks malware.

Q: Why do maintenance devices increase risk in isolated industrial networks?

A: Maintenance devices increase risk because they often move between connected and disconnected environments.

Q: Where does air gap protection fail in practice for OT assets?

A: It fails at the boundary points teams overlook, especially USB ports, wireless radios, and third-party service workflows.

Practitioner guidance

• Inspect every cross-boundary maintenance device Require malware checks and device hygiene validation before technician laptops, service tools, or removable media enter isolated OT zones.
• Use portable scanning on stand-alone assets Deploy update-capable portable scanners to inspect machines that cannot host conventional endpoint tools or frequent software changes.
• Control wireless and peripheral ingress paths Inventory Wi-Fi, Bluetooth, USB, and external keyboard pathways on air-gapped assets and disable any interface that is not operationally required.

Bottom line: Air gaps reduce exposure, but they do not stop malware from crossing through trusted interfaces, maintenance devices, or supplier-delivered equipment.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →