What Is Air-Gapped Backup, and Do You Need It?

Air-gapped backup is one of the strongest protections against ransomware and also one of the most misunderstood terms in the category. Here’s what it actually means, how it differs from “offsite” and “immutable,” and practical approaches for smaller organizations.

“Air-gapped” gets used loosely in backup marketing, sometimes interchangeably with “offsite” or “immutable” terms that describe genuinely different levels of protection. This article covers what air-gapping actually means technically, how it compares to related terms, and practical approaches for organizations that don’t have enterprise-scale security infrastructure.

What Air-Gapped Backup Actually Means Technically

Air-gapped backup means a copy that’s physically or logically isolated from your network genuinely unreachable by an attacker who has compromised your systems, not merely stored in a different location. The isolation is the defining characteristic, not the distance or the storage medium.

How it differs from just “offsite” or “immutable”

The table below compares air-gapped backup with offsite and immutable storage.

Who genuinely needs air-gapped backup

Organizations where a ransomware event would be existential rather than merely painful should seriously consider genuine air-gapping. For many smaller organizations, offsite storage combined with immutability delivers most of the practical protection with meaningfully less operational overhead — the full isolation of air-gapping is the strongest option, but not always the most practical starting point.

Practical air-gap approaches for smaller organizations

1. Rotating offline media: Periodically writing a backup copy to media that’s then physically disconnected a genuinely simple, low-tech approach that smaller organizations can implement without complex infrastructure.
2. A dedicated, isolated backup account with strict access separation: Using a backup provider account with credentials and access completely separate from your primary systems, so a compromise of your main network doesn’t automatically grant access to the backup.
3. Immutable storage as a strong middle ground: When true air-gapping isn’t practical, immutable storage (which can’t be altered or deleted even with admin access) delivers much of the practical benefit against ransomware specifically.
4. Scheduled, deliberate disconnection windows: For organizations with critical on-site backup infrastructure, physically or logically disconnecting it outside of scheduled backup windows achieves a practical approximation of air-gapping.

Common misconceptions about air-gapping

The most common misconception is assuming that “offsite” or “cloud-based” automatically means air-gapped — it doesn’t. A cloud backup account is still network-reachable by default unless specific isolation measures (separate credentials, strict access controls) are deliberately put in place. Distance and network isolation are different properties, and a vendor conflating the two is worth questioning directly.

Frequently asked questions

Q: Is air-gapped backup only relevant for large enterprises?

Not exclusively — while large enterprises with high-value targets often need the strongest possible isolation, smaller organizations facing a genuinely existential ransomware risk can benefit too. For many smaller organizations, though, offsite plus immutable storage delivers most of the practical benefit with meaningfully less operational complexity.

Q: Does cloud backup count as air-gapped?

Not automatically — a cloud backup account is still network-reachable unless specific measures (separate credentials, strict access isolation) are in place. The physical or logical isolation is what makes something genuinely air-gapped, not simply being in a different location.

Q: How often should air-gapped backups be updated if they’re disconnected most of the time?

This depends on your risk tolerance and how much data you could afford to lose between updates a common approach is a scheduled, brief reconnection window specifically for the update, followed by disconnection again.

Q: Is air-gapping only useful against ransomware?

Ransomware is the most commonly cited reason given current threat patterns, but air-gapping also protects against other scenarios where an attacker gains broad network access — insider threats, compromised credentials, or a compromised backup software supply chain, for example.

Conclusion

Air-gapped backup represents the strongest end of the backup isolation spectrum, but it’s not an all-or-nothing decision understanding where offsite, immutable, and genuinely air-gapped protection sit relative to each other lets you choose the right level of isolation for your actual risk, rather than relying on marketing language alone.