Air-Gapped Network Tracking

Traditional tracking pixels require internet connectivity to phone home when accessed. But what about networks that are intentionally isolated from the internet? Signal Canary's Air-Gap Mode solves this challenge.

What is an Air-Gapped Network?

An air-gapped network is a computer network that is physically isolated from unsecured networks, including the public internet. These networks are used in:

Government & Military - Classified systems and sensitive operations
Critical Infrastructure - Power grids, water treatment, industrial control systems
Financial Institutions - Trading systems and core banking platforms
Research Facilities - Sensitive R&D and intellectual property
Healthcare - Medical devices and patient data systems

Air-gapped networks are considered one of the most secure environments because attackers cannot remotely access them over the internet. However, they are not immune to insider threats or physical breaches.

The Challenge: No Internet = No Tracking?

Standard canary tokens and tracking pixels rely on making an HTTP request to Signal Canary's servers when triggered. In an air-gapped environment, this is impossible by design.

This creates a significant security gap:

Insider threats can access sensitive files undetected
Physical intruders with network access leave no trace
Compromised credentials may be used without alerting anyone
Lateral movement within the isolated network goes unmonitored

Many organizations assume air-gapped networks are inherently secure, but some of the most damaging breaches in history (Stuxnet, for example) targeted air-gapped systems.

How Signal Canary Solves It

Signal Canary provides a complete offline detection solution through deployable canary appliances that operate entirely within your isolated network.

1 Build Your Canary Appliance

Using the Signal Canary dashboard, configure and download a custom canary appliance tailored to your environment. Choose your deployment profile, target services, and detection scenarios.

2 Deploy to Your Air-Gapped Network

Transfer the appliance to your isolated network via approved secure media. Deploy it as a virtual machine, container, or on dedicated hardware. No internet connection is ever required.

3 Canaries Monitor Silently

The appliance monitors for suspicious activity across multiple vectors. All events are logged locally with full forensic detail including timestamps, source information, and access patterns.

4 Secure Log Export

When ready, export encrypted logs via approved transfer methods. Import them into Signal Canary for analysis, correlation, and AI-powered insights - all while maintaining your network's isolation.

What You Can Detect

Air-Gap canaries can monitor for a variety of suspicious activities:

Detection Type	What It Catches
Honeypot Files	Access to decoy documents, spreadsheets, and sensitive-looking files
Network Shares	Connections to fake file shares with enticing names
Credential Usage	Attempts to use planted fake credentials
Service Probing	Connection attempts to honeypot services
Document Canaries	Opening of tracked documents even without internet

The most effective air-gap deployments combine multiple detection types. An attacker exploring your network will likely trigger several canaries, making their activity unmistakable.

Deployment Options

Signal Canary air-gap solutions are flexible to meet various compliance and infrastructure requirements:

Virtual Appliance

Deploy as a VM on existing virtualization infrastructure

Container

Lightweight container deployment for modern environments

Dedicated Hardware

Install on physical servers for maximum isolation

Security Considerations

Encrypted Logs - All logged events are encrypted at rest
Tamper Detection - Log integrity is cryptographically verified
No Phone Home - Appliances never attempt external connections
Minimal Footprint - Designed to be invisible to network users

Common Use Cases

Scenario	How Air-Gap Canaries Help
Insider Threat Detection	Catch employees or contractors accessing files outside their role
Physical Security Testing	Detect if a physical intruder gains network access
Compliance Monitoring	Document that sensitive areas are monitored, even without internet
Supply Chain Security	Monitor isolated build environments for unauthorized access
Red Team Exercises	Validate detection capabilities in isolated test environments

Air-Gap Mode is available on Enterprise plans. Contact our team to discuss your specific requirements and compliance needs.

Getting Started

If your organization operates air-gapped networks and needs breach detection capabilities:

Upgrade to an Enterprise plan or contact sales
Access the Air-Gap section in your dashboard
Configure your first canary appliance
Follow the secure deployment guide provided

Our team can also assist with deployment planning for complex environments and compliance requirements.