For years, air-gapped environments have been the gold standard for protecting classified systems and critical infrastructure. Isolate the network, remove the path, reduce the risk. The logic held, and it still does. An air gap does exactly what it was designed to do.
The problem was never that isolation failed. The problem is that isolation was only ever half of a control. It governs the path. It says nothing about the payload.
And in an environment where software now arrives as vendored source, container images, language packages, and increasingly model weights, the payload is where the risk lives.
The first is that the Department of Defense told itself to move faster. The 2026 AI Acceleration Strategy shifts the emphasis away from governance frameworks and toward speed, iteration, and operational integration, with seven Pace-Setting Projects administered by the Chief Digital and Artificial Intelligence Office. This is a deliberate posture change, and defensible on its own terms. Adversary capability is not waiting on our review cycles.
The second is that the assurance floor under federal software procurement was lowered. OMB Memorandum M-26-05, issued in January 2026, rescinded the mandatory secure software attestation memoranda and moved civilian agencies to a risk-based, agency-led model. Attestations are now optional. The Common Form is no longer mandatory.
National security systems are a different story, and it is worth being precise about that: programs operating under ICD 503 and CNSSI 1253 answer to an authorizing official, and nothing about that accreditation regime was loosened in January. But those programs do not build their software from scratch. They consume the same open source ecosystems, the same commercial products, and increasingly the same publicly trained models as everyone else. When the government-wide procurement floor drops, what changes for a classified program is not its own rigor. It is the assurance level of everything arriving at its boundary.
Those two developments describe an environment where software is expected to move faster into mission systems, and where the upstream software supply chain is subject to less mandatory scrutiny than it was a year ago. That is not an argument that the policy is wrong. It is an argument that the discipline now has to justify itself on engineering grounds rather than compliance grounds.
In a disconnected environment, nothing arrives by accident. Software enters through accredited cross-domain solutions, assured file transfer processes, one-way diodes, and, where still permitted, controlled media. The mechanisms vary. What they share is that every transfer is a discrete, deliberate, enumerable event through a controlled point. That is the property that matters, and it is the property connected environments spend millions trying to approximate.
Today, that intake process inspects each artifact for malware, validates its file type and origin, and enforces two-person integrity where required. What it does not establish is what the software is made of. Content inspection and composition analysis are different disciplines. A transfer process can verify that a file is what it claims to be and carries no known malicious signature, and still admit a component whose contents, dependencies, and vulnerability posture nobody has enumerated. Origin and hygiene are checked. Composition is assumed.
Four classes of artifacts now cross that air gap boundary, and they are not equally well governed.
The first is open source packages, including the ones an AI coding assistant selected. An assistant recommends dependencies from a static snapshot of the ecosystem, not from its live state, and it has no mechanism to distinguish a legitimate package from a typosquat published last week. The developer who used to type the package name was, incidentally, a review step. That step is gone, and nothing structurally replaced it.
The second is model weights. Classified environments are adopting self-hosted open-weight models precisely because they cannot call a hosted API, which means the model arrives as a file, from a public hub, with a license, a provenance history, and a set of dependencies of its own. Congress has noticed: Section 6603 of the FY2026 National Defense Authorization Act addresses the use of publicly available AI models in classified environments directly. Admission decisions about models are being made at the level of national origin and malware hygiene. What almost no environment yet performs is composition-level admission: license position, training data provenance, embedded dependencies, and a durable record of which weights, at which version, entered which enclave.
The third is credentials. The most instructive intrusion of the past year involved an autonomous agent that moved from single-pod code execution to cluster administrator across multiple clusters in under thirteen hours, largely by minting, replaying, and re-minting valid tokens. No vulnerable open source component was involved. No software bill of materials (SBOM) would have stopped it. And the attack's escape path ran through a connected artifact proxy with the open internet on the far side, a path that does not exist in a properly disconnected environment. What those programs lack is not the isolation. It is visibility into what the isolation admits.
The fourth is the record of what the AI actually produced. This is the least mature of the four and the one moving fastest. The joint guidance released last month by CISA, the National Security Agency, the Federal Bureau of Investigation, and international partners, which replaces the 2021 NTIA minimum elements for an SBOM, notes explicitly that some software types, including artificial intelligence, may require additional elements.
Here is the part that matters for a program office being told to field capability faster inside a disconnected environment.
Prevention is not a gate that slows delivery. It is the cheapest possible place to absorb a problem. Blocking a malicious or non-existent component at intake costs seconds. Discovering it during an authorization review costs a release cycle. Discovering it after deployment into a disconnected enclave costs whatever your transfer cadence costs, because remediation cannot move faster than the boundary. In a program with a disciplined weekly update rhythm, that is days. In a program that treats transfers as exceptional events, it is a quarter. The economics of prevention improve as connectivity decreases.
Governance is what keeps the finding count from becoming a staffing problem. In a recent analysis of an open source flight control stack, our pipeline surfaced forty-seven policy violations in the supporting toolchain and correctly determined that the dominant finding, a critical vulnerability in an end-of-life cryptographic library, was a build-time test dependency that never links into the firmware. That determination was recorded as a Vulnerability Exploitability eXchange (VEX) annotation and the finding was suppressed with evidence.
In a disconnected environment, that distinction matters because every unnecessary remediation can carry the additional cost of another controlled transfer across the boundary.
The scan of the components that actually ship in the binary returned zero violations. Every component matched an identity in the vulnerability data. None generated a finding. It's natural to read that as a clean bill of health, but it was not. A third of those components carry no resolvable version, because the repositories they come from declare none, and a component whose version is a placeholder can be matched to a name while never falling inside any vulnerable version range. Identified, but inert. No version, no range, no finding, no violation, green.
Proof exists because of that. An SBOM is not a deliverable you produce for someone else's file. It is the artifact that tells you what your own tooling could and could not see, and in a disconnected environment it is the only durable record of what you shipped. Without it, a green dashboard is indistinguishable from an incomplete one.
Every vendor writing about air-gapped security promises continuous monitoring. Almost none explain the mechanism. Continuous monitoring requires new information arriving continuously, and an enclave receives new information only when a transfer event delivers it.
The same controlled channels that admit software also admit intelligence about software. Signed vulnerability data, carried across the boundary on a defined cadence, through a diode or an assured transfer process or approved media, and evaluated against a frozen bill of materials, is what continuous revalidation actually looks like when there is no wire. The bill of materials stops being a static snapshot and becomes the thing that gets re-scored as the outside world learns more. A component that was unremarkable at admission can become the most urgent item in the enclave without anything inside the enclave changing.
That is achievable today, at whatever cadence the boundary already supports. It is not achievable if nobody knows what is in the enclave to begin with.
Offline is not the same as secure, and that has been true long enough that it is no longer an insight.
An air gap does not remove the software supply chain. It concentrates it. Every dependency, every model, every update, and every piece of vulnerability intelligence still crosses the boundary.
That decision point is the most valuable piece of security real estate in a classified program. Today it establishes origin and hygiene. It could also establish composition, apply policy, and record provenance for everything that enters and everything built from it, using tooling that runs entirely inside the boundary and updates through the same channels the program already trusts.
What that requires is treating the intake decision as an engineering control rather than an administrative one. In an environment being asked to field AI-enabled capability at wartime speed, while the procurement floor beneath the broader supply chain drops, that is not a compliance argument. It is the only way the schedule holds.
To learn how Sonatype brings software supply chain visibility and governance into disconnected environments, explore Sonatype Air-Gapped Environment (SAGE).