AI: Security

AI security design and hosting models - air-gapped, private, public

Miro Kosut

Miro Kosut

— 2 min read
Share

Requirement / business driver

The hosting model sets the entire security posture of an AI environment - choose it against sensitivity, sovereignty, and threat exposure, not just cost.

Options

  • Air-gapped - totally isolated, no external connectivity; for classified / sovereign / highly sensitive training. Highest security, lowest agility.
  • Private (on-prem / private cloud) - enterprise control and data gravity behind a controlled perimeter - the home of most enterprise AI.
  • Public cloud - elastic and fast, but internet-exposed and multi-tenant, so it leans on strong IAM, encryption, WAF, and tenant isolation.

One consequence travels with the air-gapped pole: the management plane must follow the hosting model. Cloud/SaaS-managed platforms are excluded unless they ship a disconnected, on-prem appliance variant (Cisco Intersight's Private Virtual Appliance is the pattern - full function, no call-home), and model, licence, and update delivery all become offline, media-based processes the design must budget for.

Comparison

ai-security-hosting-matrix

Recommendation / justification

Match hosting to sensitivity and sovereignty (Service placement - on-prem, cloud, hybrid, distributed, Data sovereignty and data gravity): air-gapped for the most sensitive/regulated training, private for most enterprise AI, public for burst / non-sensitive workloads and inference at scale. A common pattern is hybrid - sensitive training private/air-gapped, public inference - with the security model following the data's sensitivity.

What would change this (mid-scenario twist)

  • Classified / strict-sovereignty data -> air-gapped (accept the cost/agility hit).
  • Need elastic inference at scale -> public, with strong IAM/encryption/WAF + isolation.

Validation checks

  • Does the hosting model match the data's sensitivity and sovereignty?
  • Are the controls appropriate to the exposure (physical for air-gap; IAM/WAF/isolation for public)?

IPv6 / dual-stack note

Posture is independent of the IP stack; apply controls to v4 and v6 alike (a v6 path out of an otherwise-isolated environment is a real gap).

Spaced repetition

Air-gapped vs private vs public for AI: air-gapped = [...]; private = [...]; public = [...].

Air-gapped vs private vs public for AI: air-gapped = totally isolated, highest security, lowest agility (classified/sovereign); private = controlled perimeter, enterprise control/data gravity; public = elastic but internet-exposed/multi-tenant (needs strong IAM/encryption/WAF/isolation).

The hosting model should be chosen primarily on [...], then cost/agility.

The hosting model should be chosen primarily on data sensitivity and sovereignty, then cost/agility.

A common hybrid AI security pattern is [...].

A common hybrid AI security pattern is sensitive training private/air-gapped, inference public - controls follow data sensitivity.

In an air-gapped AI facility, a SaaS-managed platform is usable only if it ships [...] - and updates become offline, media-based processes.

In an air-gapped AI facility, a SaaS-managed platform is usable only if it ships a disconnected on-prem (private appliance) variant - and updates become offline, media-based processes.

Sources

  • Cisco, FlashStack for Generative AI Inferencing design guide - Intersight private (air-gapped) appliance option; passed through the Technology Overview chapter 2026-07-25 (Solution Design and sizing chapters not captured).
  • Cisco AI/ML data-center blueprint; sovereign/air-gapped AI references.

domain: AI-Infra · blueprint-ref: AI-Infra 3.1/3.2 Hosting implications, infrastructure protection (air-gapped/private/public) · type: design-decision · status: complete · tags: [elective/ai-infra, ai/security, tradeoff/security, tradeoff/cost]

Read more