An air-gapped backup is a backup copy that is physically or logically disconnected from every network that the production systems use, so that no process, account or attacker on those systems can read, alter, encrypt or delete it. In backup & recovery for servers, the air gap is the last line of defense against ransomware, malicious insiders and compromised administrator credentials, which can otherwise destroy online backups together with the primary data.
The term comes from the literal gap of air between a computer and any network cable. In practice it covers both physical air gaps, such as tapes or removable disks stored offline, and logical or virtual air gaps, in which a vault is reachable only briefly, through a separate control plane, and with credentials that production administrators do not hold.
Why online backups are not enough
Modern ransomware operators deliberately hunt for backups before encrypting. Once they obtain domain administrator rights, they delete snapshots, wipe backup repositories mounted as network shares and reconfigure backup software to expire retention. A backup that the production environment can reach is therefore exposed to the same compromise.
An air gap breaks that chain. Even with full control of the production network, an attacker has no route to the isolated copy, so the organization can rebuild from a known clean state. That is why the extended 3-2-1-1-0 rule adds one offline or immutable copy and zero errors after restore verification to the classic 3-2-1 backup rule.
Types of air gap
Air gaps differ in how complete the isolation is, how fast data can be restored and how much manual work they require. The table below compares the main implementations.
| Type | How isolation is achieved | Restore speed | Main weakness |
|---|---|---|---|
| Offline tape | Cartridges ejected and stored in a vault | Hours to days | Manual handling, slow full restores |
| Removable disk rotation | Drives disconnected and taken offsite | Hours | Handling errors, drive damage |
| Isolated recovery vault | Separate network, connection opened on schedule | Minutes to hours | Complex design, must be tested |
| Cloud vault with separate account | Different tenant, credentials and control plane | Hours, bandwidth-bound | Logical, not physical, separation |
| Tape library with logical eject | Tapes moved to slots without drive access | Hours | Library management remains online |
A physical air gap offers the strongest guarantee because there is no connection at all. A logical air gap trades some of that certainty for automation and much shorter recovery times, provided the isolation is enforced by separate identities, networks and management systems.
How an isolated recovery vault works
In an automated design, backups first land in a normal primary repository for fast operational restores. A replication job then copies selected restore points into a vault in a separate network segment. The connection is opened only during a short replication window, typically a few hours per day, and is initiated from the vault side, so production cannot push commands into it.
Inside the vault, the copies are stored on immutable storage with retention locks, scanned for malware and indicators of encryption, and periodically restored in an isolated test environment. Access to the vault requires separate accounts, often with multi-person approval for any deletion or retention change.
The parameters below determine how much protection and data a vault really provides.
| Parameter | Typical range | Effect |
|---|---|---|
| Copy frequency | Daily to weekly | Sets the worst-case data loss, the RPO |
| Connection window | 1 to 6 hours per day | Shorter window means less exposure |
| Retention period | 30 to 90 days or longer | Must exceed attacker dwell time |
| Restore throughput | Hundreds of MB/s to several GB/s | Determines the realistic RTO |
| Test restore cadence | Monthly to quarterly | Proves the copy is usable |
Retention matters because attackers often remain inside a network for weeks before triggering encryption. A vault that keeps only seven days of copies may contain nothing that predates the intrusion.
Air gap, immutability and offsite copies compared
Several neighboring concepts protect backups in different ways and are often combined. They are not interchangeable: an offsite copy can still be online, and an immutable copy can still be reachable.
| Protection | Defends against | Does not defend against |
|---|---|---|
| Air-gapped backup | Network attackers, ransomware, admin compromise | Physical theft, media decay, bad source data |
| Immutable backup | Deletion and modification until lock expires | Exfiltration, compromise of the storage platform |
| Offsite backup | Fire, flood, site loss | Online attacks if still connected |
| Snapshot | Accidental changes, quick rollback | Loss of the storage system itself |
| Replication | Hardware and site failure | Corruption and deletion, which replicate too |
The strongest designs layer them: immutable storage inside an air-gapped vault at a separate site, with the copy verified before it is trusted.
Limitations and common mistakes
- A permanently mounted drive is not air-gapped: a USB disk that stays connected is just another online target.
- Shared credentials erase the gap: if the same directory accounts manage production and vault, the isolation is only nominal.
- Backing up already infected data: without malware scanning and long retention, the vault may preserve the infection.
- Never testing restores: tapes and disks degrade, and catalogs or encryption keys may be missing when needed.
- Storing encryption keys only in production: the backup becomes unreadable if the key vault is lost in the attack.
- Ignoring recovery time: restoring tens of terabytes from tape can take days, so critical systems may need a faster tier.
An air gap also adds operational cost: media handling, separate infrastructure and a recovery process that must be rehearsed. The investment is justified because it is often the only copy that survives a complete domain compromise.
Put simply
Imagine keeping a copy of every important family document in a safe-deposit box at a bank. If a burglar breaks into the house and burns the papers there, the copies in the bank are untouched, because the burglar has no way to get to them.
An air-gapped backup is that safe-deposit box for company data. It is kept cut off from the everyday network, so even if criminals take over the servers and lock every file, a clean copy remains ready to bring everything back.
In practice
A mid-sized manufacturer runs about 60 virtual servers. Nightly backups go to an on-site repository for quick restores, and every Sunday the backup system writes a full copy to LTO-9 tape. The cartridges are ejected, labeled and taken to a locked offsite vault, where twelve weekly sets are kept in rotation, giving roughly three months of offline history.
Months later, attackers obtain administrator rights, delete the on-site repository and encrypt the servers. Restoring from the most recent tape set takes about two days for the core ERP and file servers, and the company loses up to a week of data, which it partly re-enters from paper records. Without the tapes, the only alternatives would have been paying a ransom or rebuilding from scratch.