What is a physical air gap for ransomware protection?

A physical air gap means the storage hardware has no active network connection when offline. There is no IP address, no listening service and no API. Ransomware that operates remotely cannot reach hardware that is not on the network. Firevault Offline Secure Storage provides this Layer 1 disconnection as a service.

Does cloud backup protect against ransomware?

Cloud backup with versioning and Object Lock can stop naive ransomware that only encrypts files. It does not stop a determined operator who reaches the backup console, steals a token or escalates privilege inside the cloud account. For true ransomware protection, you need a copy that cannot be reached over the network at all.

Is immutable cloud storage the same as an air gap?

No. Immutable storage is a logical control that lives on a reachable network. An air gap means there is no network path to the data. Firevault Offline Secure Storage is a physical air gap at Layer 1. An immutable S3 bucket or hardened repository is not.

Why is air gapped storage better for ransomware protection?

Because remote ransomware needs a reachable target. Air gapped storage removes that prerequisite. There is no IP to scan, no service to authenticate to and no credential that can re-enable the network. The attacker would need physical presence inside a Firevault Bunker, which is outside the scope of every remote ransomware playbook.

Will offline storage slow down recovery?

Firevault is designed for scheduled, identity verified online windows, not weekly tape rotations. Restores run at disk speed during a connection window, with a tamper evident audit trail. Most customers use cloud or immutable backup for hot recovery and Firevault for the clean gold copy.

What about ransomware that targets backup software?

Veeam, Rubrik, Cohesity, Commvault and similar platforms have all been targeted in recent incidents. Their hardened repositories help, but they still listen on the network and trust an identity layer. Firevault sits below all of that at Layer 1, so the same attack class does not apply while the storage is offline.

Does Object Lock protect against an attacker with admin rights?

Only inside the configured retention window, and only if the attacker cannot change the clock, the policy or the account that owns the bucket. Several real world cases have shown attackers reaching the account first and weakening protection before encrypting production data.

How does Firevault prove the data has not been touched?

Every connection and disconnection is logged on a separate management plane with identity, timestamp and reason. Customers receive a tamper evident audit trail suitable for insurance, regulatory and board reporting.

How does physical air gap storage compare on cost to immutable cloud?

Firevault Offline Secure Storage is a fixed monthly subscription, VAT inclusive, with no per GB fees and no egress or restore charges. Immutable cloud storage is priced per GB stored, with additional charges for API operations, cross region replication and egress on restore. For long retention gold copies, the physical air gap model is usually the cheaper of the two.

How long does recovery from a physical air gap copy take?

Recovery runs at disk speed during a scheduled, identity verified connection window. There is no bandwidth ceiling and no egress meter. A typical estate can begin restoring within the same working day, and full recovery of the gold copy is bound by disk and receiving system throughput rather than internet bandwidth.

Do cyber insurers reward an offline gold copy?

Increasingly, yes. Underwriters have tightened wording around ransomware cover, and several now specifically ask whether an offline, air gapped copy exists and how it is proven. A tamper evident connection log from Firevault, combined with 3-2-1-1-0 alignment, is designed to satisfy the evidence side of that conversation.

Can Firevault be used alongside Veeam, Rubrik or Commvault?

Yes. Firevault sits below your existing backup platform as the always offline gold copy. Your backup platform continues to service day to day restores from its hot or warm tier. Firevault takes a periodic seal of the clean copy and disconnects, so the two layers protect against different classes of failure.

Does a physical air gap help with a forensic or legal hold?

It does. A sealed offline copy with a tamper evident connection log gives investigators and regulators a stable, verifiable snapshot from a specific moment in time. Because the copy has been offline, it cannot have been altered by the incident, which is a stronger evidentiary position than a same plane log.

How does physical air gap storage map to NIS2, DORA and NCSC guidance?

NIS2 and DORA both require organisations to demonstrate resilience of critical data against destructive attacks. The NCSC ransomware resistant backups guidance calls for a copy that is offline, offsite and out of reach of an attacker who has compromised the estate. A physical air gap at Layer 1 is the most direct way to meet all three, because it removes the network path rather than defending it.

Why OSS

Physical Air Gap Storage for Ransomware Protection

Q: Do I have to choose between cloud backup and Firevault?

No. The recommended pattern is layered. Keep your existing immutable or cloud backup for operational recovery, and add Firevault as the always offline gold copy that survives when the rest is touched. This is the modern reading of the 3-2-1-1-0 rule.

Cloud Object Lock is software pretending to be a wall. A physical air gap is the wall. This is the Firevault buyer's guide to Layer 1 offline storage as the gold copy of last resort.

Corridor of offline storage racks inside a Firevault bunker

What it is

Physical Air Gap for Ransomware Protection

Short, declarative definitions to explain why Layer 1 disconnection is the most reliable ransomware defence.

Removing the cable, not just the permission

Layer 1 physical disconnect

A physical air gap means there is no electrical path between the storage hardware and any network. At Layer 1 of the OSI model, the cable is simply not connected. No IP address can be assigned, no port can be scanned, and no credential can bridge a gap that exists in copper and fibre rather than in software policy.

No network interface when offline
No IP, no listener, no API
Out of band switching only

Gold copy that survives the incident

Physical separation at rest

Firevault Offline Secure Storage keeps your ransomware protection copy on hardware that is physically separated from every production system. While your estate is online and operational, the gold copy is offline. When a connection window is required, it is scheduled, identity verified and audited.

Always offline by default
Scheduled connection windows
Tamper evident audit trail

Where cloud backup falls short

Why Immutable Cloud Backup Is Not Ransomware Proof

The failure modes ransomware operators exploit on the way to your cloud backups.

Object Lock and WORM are logical controls

Immutable does not mean unreachable

Cloud backup platforms advertise Object Lock, versioning and WORM as ransomware protection. These are logical controls on a network that remains connected. An attacker who reaches a privileged account can weaken, disable or wait out the policy. The data is still physically reachable.

Reachable over the internet
Defended by identity and policy
Admin compromise defeats logic

Identity is the attack surface

Credential theft is the entry point

Modern ransomware operators do not brute force encryption. They phish, buy or steal credentials into cloud consoles. Once inside, backup APIs are the first target. Session tokens, service accounts and cross-account roles all provide a path to the immutable copy.

Phished console access
Session token theft
Backup role escalation

Ransomware crews hunt backups first

Backup console targeting

Incident reports from NCSC, CISA and major cyber insurers show a consistent pattern: attackers identify backup infrastructure early, then disable or encrypt it before touching production. A reachable backup console is a single point of failure disguised as protection.

Backup infrastructure mapped first
Retention rewritten or poisoned
Mass deletion before lock window

Why physical air gap wins

Layer 1 Disconnection Removes The Attacker's Prerequisite

Remote ransomware needs a reachable target. Firevault Offline Secure Storage removes the path before the playbook starts.

Remote ransomware needs a target

No reachable surface

Every remote ransomware playbook begins by reaching the victim. A physically disconnected Firevault disk has no NIC, no IP and no service to authenticate to. The attacker cannot scan what is not on the network, and cannot authenticate to hardware that is not listening.

No NIC, no IP, no listener
No credential to compromise
Out of band switching only

Independent of identity systems

Privilege cannot reattach a cable

Logical immutability collapses when an attacker gains sufficient privilege. Physical disconnection does not depend on privilege at all. No domain admin, storage admin or cloud root account can connect hardware that is physically unplugged. The boundary is physics, not policy.

No domain admin path
No storage admin abuse
Insider risk reduced to physical access

The gold copy that outlasts the attack

Survives the rest of your estate

Most organisations keep their existing cloud or immutable backup for fast operational recovery, and add Firevault as the always offline gold copy. When ransomware reaches the hot and warm tiers, the offline copy remains untouched, unchanged and verifiable.

Layered alongside cloud backup
Tamper evident audit trail
Clean restore point of last resort

Compare the approaches

Physical Air Gap vs Immutable Cloud vs Tape vs Logical Air Gap

Five approaches to a ransomware resistant backup copy, side by side on the criteria that decide whether the copy survives the incident.

Approach	Reachable surface	Admin compromise resistance	Recovery speed	Cost model	Audit evidence
Physical air gap (Firevault OSS)	None while offline	Physics, not policy	Disk speed in scheduled window	Fixed monthly, VAT inclusive	Tamper evident connection log
Immutable cloud (Object Lock, WORM)	Always reachable over the internet	Retention weakened or bypassed	Egress limited by bandwidth and cost	Per GB plus egress and API fees	Cloud audit log on same plane
Hardened backup appliance	Reachable on management network	Repository credentials are the target	Fast local restore when intact	Capex plus support contracts	Appliance log on same plane
Tape rotation	None between rotations	Physical handling risk	Slow, manual, error prone	Media, drives, offsite courier	Manual chain of custody
Logical air gap (VLAN, firewall)	Reachable through misconfiguration	Firewall rule change reopens path	Fast when policy holds	Existing network kit	Network device logs

Buyer checklist

Ten Questions to Ask Any Air Gap Storage Vendor

Use this checklist to separate a genuine physical air gap from a marketing term applied to a hardened network appliance.

The storage has no network interface enabled while offline (Layer 1, not VLAN)
Connection windows are switched out of band, not from the production network
Every connect and disconnect event is logged on a separate management plane
Chain of custody from ingest to sealed offline state is provable to insurers
Fits the 3-2-1-1-0 rule as the one offline copy, not a duplicate hot tier
Recovery time meets your RTO when a connection window is scheduled
Deployment model matches your risk appetite (on-site, Firevault Bunker, hybrid)
Pricing is predictable with no per-GB egress or restore fees
Encryption keys are held separately from the storage, not on the same plane
The vendor will attend an incident and provide the clean gold copy in person

Where Firevault sits

Mapping to the 3-2-1-1-0 Backup Rule

The modern reading of the 3-2-1 rule adds two numbers that matter after a ransomware event: one offline copy, and zero recovery errors.

Copies of your data

Different media

Copy offsite

Copy offline (Firevault)

Errors on recovery

Firevault is designed specifically as the fourth number, the one offline copy, so the other four numbers are free to stay online and operational.

Read the full 3-2-1-1-0 rule guide

Continue reading on the architecture, the standards and the compare set.

For OT and ICS estates Air gap vs immutable backup The 3-2-1-1-0 backup rule Offline vs cloud backup Physical vs logical air gap What is Offline Secure Storage

Questions

Physical Air Gap Ransomware Protection, Common Questions

Straight answers on how Offline Secure Storage® behaves in practice.

Add an offline gold copy to your ransomware protection

Talk to the Firevault team about layering a physically disconnected gold copy alongside your existing cloud or immutable backup.

Takes about 2 minutes. No account needed.

Free2 minsNo sign-up