Air-Gap Drift

What Air-Gap Drift Means in Practice

Air-gap drift is the slow loss of a true isolation boundary. It happens when exceptions for updates, vendor access, file transfer, backups or remote support turn a separated environment into one with hidden trust paths.

The important point is that the environment may still be described as isolated long after its operational reality has changed. That gap between policy and actual connectivity is what makes drift dangerous, because teams can rely on a control that no longer exists in full.

Why Air-Gap Drift Happens

Drift usually begins with legitimate pressure rather than a malicious act. Maintenance windows, software patching, safety monitoring and production support often create temporary bridges, and those bridges tend to stay in place because they are useful, poorly documented or no longer reviewed.

Over time, convenience becomes architecture. Shared jump hosts, removable media, ad hoc vendor tunnels, emergency accounts and one-off synchronization jobs can all introduce pathways that are easy to forget and hard to audit. The result is not always a fully connected network, but an environment whose isolation is only partial and increasingly informal.

Why Air-Gap Drift Is Security-Relevant

Air-gap drift matters because it undermines the core assumption that isolation limits blast radius. Once pathways exist, an attacker who reaches a connected system can use them to move into a supposedly separated zone, stage payloads, or reach high-value operational assets that were meant to be harder to access.

It also weakens governance. If the control is treated as binary, organisations may stop testing assumptions, validating exceptions or tracking whether the original separation still exists. A useful analogue is the way token theft can bypass intended separation in a SaaS integration, as shown by the Salesloft OAuth token breach, where trust and access expanded beyond the organisation’s expected boundary.

How Organisations Recognise and Reduce Drift

The first step is to verify the actual state of connectivity, not the intended one. Asset inventories, network path reviews, vendor access logs and change records should be used together to identify where the “air gap” is now only logical or procedural. In practice, this is where Backup Security and Immutable Backup Guide becomes relevant, because backup systems are a common place where air-gap assumptions quietly fail.

Defenders should then decide which bridges are justified, which are temporary, and which should be removed or replaced with tightly controlled transfer methods. Where full isolation is not possible, compensating controls such as strict segmentation, monitored jump access, approval-based transfer workflows and strong restore testing become the practical substitute for a perfect gap.

Risk and Threat Considerations

Air-gap drift creates a false sense of protection. The main risk is not that an isolated network suddenly becomes public, but that small, repeated exceptions create hidden ingress, egress and persistence paths that attackers can abuse without the organisation realising the boundary has changed.

Failure mechanism: Temporary operational links become permanent, undocumented pathways, and those pathways carry data, credentials, update channels or remote access into an environment that was expected to remain separate.

Impact: A compromise in a trusted connected system can propagate into the separated zone, expose sensitive operational assets, and invalidate recovery assumptions that depended on isolation.

Practitioner Guidance

Governance implication: Treat air-gapped status as a continuously verified control, not a design label. Ownership should sit with the teams that can see both the technical pathways and the operational exceptions, because drift is usually introduced by business convenience rather than by deliberate redesign.

What to watch for: Repeated “temporary” vendor access, unreviewed transfer tooling, backup exceptions, and support pathways that nobody can fully explain are all strong signals that the boundary has already weakened.

Related resources from NHI Mgmt Group

• How should security teams secure connected OT devices without relying on the old air gap?
• How should security teams detect Kubernetes configuration drift before it becomes a security gap?
• How should teams deploy and manage applications in air gapped environments without creating operational drift?
• What is the difference between a USB air-gap sandbox and a USB sanitiser that converts files automatically?