Network security monitoring for networks with no internet.
SAMURAI is a self-contained network security and monitoring platform built to run in air-gapped, classified, and restricted environments. Once the image is on the network, it needs zero external connectivity: no license server, no telemetry, no update checks, no cloud APIs. It discovers endpoints, analyzes firewall and network configuration, and detects changes across Cisco, Palo Alto, FortiGate, and Juniper, entirely behind your perimeter.
Updated July 2026
Built for zero connectivity
No internet required after install
Transfer the Docker image across your boundary once, run it, and it operates fully offline. No calling out for license validation, updates, or analytics.
Offline endpoint discovery
A 39,000-entry IEEE OUI database ships embedded in the image, so vendor identification resolves locally in microseconds with no external lookup.
No telemetry or license server
Nothing phones home. Authentication and licensing run locally; the only traffic SAMURAI generates is to the devices you monitor, on ports you configure.
Self-signed TLS by design
Air-gapped networks live on self-signed certificates and internal CAs. SAMURAI is built for that reality, and you can bring your own PKI for its own HTTPS.
Sneakernet-friendly deployment
Pull the image on a connected machine, move it with docker save and docker load, and run it inside the enclave. The whole platform is one container on one VM.
Full capability offline
Endpoint correlation, firewall config analysis, change detection with admin attribution, path simulation, and compliance checks all run with no connectivity.
Why most tools cannot go air-gapped
Most modern monitoring and policy tools assume an internet connection for licensing, updates, threat feeds, or a cloud backend. In an air-gapped network, that assumption makes them unusable. SAMURAI was designed from the opposite starting point.
Connectivity needed
SAMURAI
None after the image is transferred
Cloud-dependent tools
License checks, updates, or cloud backend
Vendor lookups
SAMURAI
Offline embedded OUI database
Cloud-dependent tools
External API calls at runtime
Deployment
SAMURAI
docker save and load across the boundary
Cloud-dependent tools
Online installer or SaaS onboarding
Data residency
SAMURAI
Everything stays inside the enclave
Cloud-dependent tools
Data or metadata sent to the cloud
If your network has reliable internet, plenty of tools work. If it does not, most simply cannot run. SAMURAI treats the air gap as the default, not the exception.
Frequently asked questions
Can SAMURAI run in a fully air-gapped network?
Yes. After the Docker image is transferred across your boundary, it needs no internet at all: no license server, no telemetry, no update checks, no external lookups. Everything runs on one VM inside your perimeter.
How do I install it without internet?
Pull the image on a connected machine, move it across with docker save and docker load, and run it inside the enclave. There is nothing else to fetch; all dependencies and databases are embedded.
How does endpoint vendor lookup work offline?
SAMURAI ships a 39,000-entry IEEE OUI database embedded in the image. MAC-to-manufacturer resolution is a local map lookup, so no external API or DNS is involved.
Does it need to call out for licensing or updates?
No. Licensing and authentication are validated locally, and there are no update or telemetry callbacks. The only network traffic it generates is to the devices you register.
What about TLS with self-signed certificates?
Air-gapped networks almost always use self-signed certificates or internal CAs. SAMURAI is built for that: it reads device APIs that use them, and you can install your own certificate for the platform HTTPS from Settings.
Which environments is this for?
Government, defense, OT and industrial, financial, and critical-infrastructure networks that are isolated from the internet by policy, plus any segment where firewall configuration must not leave the perimeter.