The security boundary is a room, not a password
An air-gapped computer is separated from other computers by design: it has no active connection to a network that could carry commands or data in and out. That removes a major route for remote attackers. Someone on the internet cannot simply scan the machine, exploit a network service, or send it a file over Wi-Fi if those paths truly are absent.
But isolation does not mean the computer has no way to receive information. In many workplaces, people still move software updates, documents, or diagnostic files between machines using removable media such as USB drives. That handoff becomes the bridge across the gap.
How a drive can carry an attack
A malicious drive does not have to make the computer “connect” to anything. It can bring an infected file into the room. If a person opens that file, or if the computer’s software has a flaw in how it reads that kind of file, the malware may run and begin affecting the isolated system. A drive can also be deliberately prepared to imitate a keyboard or other device, making its behavior harder to recognize than an ordinary storage device.
The key mechanism is trust: the computer may be disconnected from the outside world, yet still trust data introduced by an authorized person. Even a routine update can be risky if its source and contents are not checked carefully.
The gap changes the job of security
Air-gapped systems therefore depend heavily on controlling physical access and the movement of files. Organizations may restrict which drives are allowed, scan media on separate machines, verify software before installation, and limit who can connect devices. These steps reduce risk, but they also add friction: updates and data transfers become slower, more manual tasks that need clear procedures.
The practical lesson is that an air gap blocks a route, not every route. A computer can be cut off from the network and still inherit whatever someone carries through its door.
