Every backup protection ultimately answers one question: can an attacker who owns your network reach this copy? Most modern answers involve clever software — immutability locks, separated credentials. The air gap is the blunt, ancient, still-undefeated answer: the copy isn’t connected to anything. No network path, no credentials, no API — a drive in a fire safe, a tape in a drawer, a device that spends its life unplugged. You cannot hack a cable that isn’t attached. Here’s where that bluntness still earns a place in a modern backup design, and the human failure mode that ruins it.

What “air-gapped” actually means (and the imitations that don’t count)

A true air gap is physical separation: between backup cycles, the media has no electrical or network connection to any system an attacker could compromise. That definition immediately disqualifies the most common imposter — the external drive that lives plugged into the server. Permanently attached USB drives are encrypted right alongside everything else in a ransomware detonation; they’re not air-gapped, they’re just slow internal storage with a handle. Same verdict for the NAS on the same network with the same admin password. If your network credentials can reach it, the attacker’s stolen copy of your credentials can too — and that’s the entire test.

You’ll also hear “logical air gap” — cloud copies isolated by separate credentials, different systems, and immutability. That’s a legitimate and often more practical design (and for most small businesses, the recommended one), but it’s a different protection with a different trust chain: it relies on the vendor’s lock working as promised. The physical gap relies on physics. Knowing which one you have is the point.

Where the old-school approach still wins

For most businesses, immutable cloud copies deliver the protection with far less labor — so why does the air gap survive in serious backup designs? Four situations:

  • The trust-nothing tier. Immutability is software, and software has vendors, bugs, and support lines that can be social-engineered. An offline copy is the one backup whose safety doesn’t depend on anyone’s implementation. For the truly irreplaceable — the engineering archive, the corporate records, the crown jewels — a periodic offline copy is the deepest layer of 3-2-1-1-0.
  • Bandwidth reality. Shops with terabytes of data and modest internet connections can’t push full backups to the cloud on any useful schedule. Rotated offline media still solves problems fiber hasn’t reached — a live consideration outside the metro.
  • Compliance and contract language that specifically requires offline copies — some insurers and frameworks still name the words.
  • The long-tail archive. Data you must keep for years but will almost never touch (retention obligations) is a natural fit for offline media: cheap, durable, unreachable.

The failure mode: air gaps run on discipline

Here’s the honest catch, and it’s not technical: an air gap is a chore, and chores decay. The rotation that was weekly becomes monthly becomes “whenever someone remembers”; the drive that should go to the fire safe lives in a laptop bag; the copy nobody has test-restored turns out to have been failing silently since spring. An air-gapped backup is exactly as strong as its most recent successful rotation — which means the design has to include the humans:

  • A named owner and a calendar, not a good intention — rotation day is an appointment with a checklist
  • At least two media in rotation, so one is always offline while the other updates (a single drive is connected during every backup — precisely when ransomware would strike it)
  • Real off-site storage for one copy — the fire safe defends against fire; the drive in the desk drawer doesn’t defend against the building being the problem
  • Encryption on the media itself — an unencrypted backup drive is your entire company, stealable in a jacket pocket
  • A periodic restore test from the offline copy specifically, because the copy of last resort is the one whose failure you can least afford to discover last
  • An honest gap-size decision: media rotated weekly means up to a week of data loss on this tier — fine for the archive layer it usually is, as long as your RPO math says so out loud

The bottom line

The air gap is the one backup protection that owes nothing to software promises: unplugged is unhackable. For most small businesses it’s the supplement — an offline layer under an immutable cloud copy for the data that can never be lost — rather than the whole strategy, because its real cost isn’t hardware, it’s discipline. Automate what can be automated, calendar what can’t, and let the oldest trick in data protection do what it’s always done: sit in a safe, connected to nothing, immune to everything.