Disconnected environments
SIEM collection and correlation, and AI Detection, run inside the site’s own network.
Security that runs with no internet connection
Local SIEM collection, analysis and retention let the team investigate within the site’s network. Deployment also needs a workable process for updates, evidence transfer and recovery when outside services are unavailable.
On-premises SIEM
An on-premises SIEM keeps collection and analysis on infrastructure the organization operates. Capacity, availability and recovery are planned around the site’s sources and workload.
Dropped links
The SIEM agent holds logs while the server is out of reach, then sends them compressed and encrypted when the link returns.
Offline updates
SIEM parsers, rules, reports and queries can be delivered as packages through the site’s approved transfer process. The operating team reviews and installs changes under its own change procedure.
CPU-only AI
AI Detection’s CPU-based behavioral analysis can run alongside local SIEM log collection without requiring a GPU. Size the hardware for the data and workload the site expects to process.
Verifiable logs
Signed exports from a SIEM provide the records and verification material needed for an independent integrity check. That lets an assessor examine the evidence without connecting to the original console.
Local approval
A response that could affect a plant or ship needs the operator’s authority and context. SOAR workflows can gather evidence and request the designated approval, retaining the decision and result.
By scenario
Ship out of contact for days
The SIEM agent holds logs until the link returns.
New parser needed on a classified network
The team carries the Store package in and installs it from the console.
Program office audit
The source exports with its signatures and standalone verifier.
Plant engineer account behaving unusually
AI Detection, running locally, can identify the change and present the source events for review by the site’s security and operating teams.
Remote site goes silent
A source-health threshold makes the interruption visible. The team can distinguish expected loss of connectivity from a collection problem.
Questions
Does Cyberdroid AI Detection need a GPU?
No. Detection runs on CPU hardware sized for the workload. Its current availability is shown in the product card below.
Does anything call home?
Local deployment can keep analysis inside the environment. Review update services, integrations and any optional external model route as part of the site’s connection policy.
Does daily timestamping work offline?
Only with a link to the qualified timestamp authority it uses. Signing and chaining still happen on local servers.
How do updates cross the air gap?
The team carries Store packages in under its own transfer procedure.
Guide
What is an air gap?
A deliberate separation with no direct network connection between environments. Any transfer follows a controlled process, such as approved removable media.
What is a disconnected environment?
A site with no reliable or permitted route to the internet, such as a ship, a plant or a government enclave.
Why do cloud security tools fail when air-gapped?
Any feature that depends on the vendor’s cloud service stops working once the site has no route to it.
How ARRTECH takes care of disconnected environments
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
