Air-gapped cloud environments — cloud tenancies with no internet connectivity — are increasingly common in government, defence-adjacent and national security environments. They are used for environments processing OFFICIAL-SENSITIVE, SECRET and above, where the network isolation requirement is non-negotiable.
Cloud governance in air-gapped environments presents a specific set of challenges that most governance tools are not designed to handle. SaaS governance platforms require internet connectivity by design — they need to reach their cloud APIs, update their rule libraries and return results to their hosted dashboards. In an air-gapped environment, these tools simply do not work.
Self-hosted as a hard requirement
ZAP's self-hosted architecture becomes a hard requirement in air-gapped environments, not a preference. Because ZAP runs entirely within the tenancy and does not require any external connectivity to operate, it functions correctly in network-isolated environments. The governance capabilities — scanning, evidence generation, ITSM integration, ZAP AI — all operate within the isolated network.
Compliance framework updates
Compliance framework updates — the rule libraries that define CIS controls, DORA requirements and other framework checks — are delivered via a secure offline package process rather than automatic update. Zentej provides signed framework packages that are transferred to the isolated environment through approved channels. The update cadence is compatible with most government secure package processes.
ZAP AI in air-gapped environments
ZAP AI in air-gapped environments uses a locally deployed model rather than connecting to Azure AI Foundry, AWS Bedrock or GCP Vertex AI. The model is deployed within the isolated network on appropriate GPU infrastructure. Query latency is higher than cloud-hosted model deployments, but the capability — live infrastructure queries, shadow AI analysis, IaC fix generation — remains fully functional.
ITSM and SCM integration
ITSM integration in air-gapped environments uses an on-premises message queue to relay ZAP findings to ServiceNow or Jira instances running within the secure perimeter. The integration architecture requires specific configuration but maintains the full incident auto-raise and auto-close capability.
SCM integration with GitHub Enterprise Server or Azure DevOps Server on-premises works natively in air-gapped environments. The PR-based approval workflow and full Git audit trail are unaffected by network isolation.
Complete governance capability
For organisations deploying in air-gapped environments, the governance capability set is complete. The architecture adapts to the network constraint. The compliance evidence, ITSM integration, ZAP AI and PR-based deployment governance all work within the isolated network.
ZAP's self-hosted architecture is not just compatible with their requirements — it is the architecture they were trying to build themselves before they found ZAP.
The organisations we work with in air-gapped environments consistently note that ZAP's self-hosted architecture is not just compatible with their requirements — it is the architecture they were trying to build themselves before they found ZAP. The zero data egress property, the absence of internet connectivity requirements and the in-tenancy AI capability are exactly what government and defence-adjacent organisations need.
See ZAP live
Book a 30-minute session with the Zentej team. We show you ZAP live on our instance — landing zone, compliance scan, evidence generation, ZAP AI. No commitment.