Air-gapped network security that never calls home.
SAMURAI provides air-gapped network security monitoring for classified, industrial and restricted networks. Once the image is inside, it needs no outside connection at all: no license server, no telemetry, no update checks, no cloud APIs. It discovers endpoints, analyzes firewall and network configuration and detects changes across Cisco, Palo Alto, FortiGate and Juniper, all behind your perimeter.
Updated July 2026
Built to run with no connectivity
Offline after install
Carry the Docker image across your boundary once and run it. It never calls out for license checks, updates or analytics.
Vendor lookup without the internet
A 39,000-entry IEEE OUI database is built into the image, so matching a MAC address to its manufacturer happens locally and instantly.
No license server
Authentication and licensing run locally. The only traffic SAMURAI sends goes to the devices you monitor, on ports you choose.
Self-signed certificates are fine
Isolated networks run on self-signed certificates and internal CAs, and SAMURAI expects that. You can also install your own certificate for its HTTPS.
Sneakernet install
Pull the image on a connected machine, move it with docker save and docker load, and run it inside the enclave. It’s one container on one VM.
Nothing held back offline
Endpoint correlation, firewall configuration analysis, change detection with admin attribution, path simulation and compliance checks all work without a connection.
Why most tools can’t run air-gapped
Most monitoring and policy tools assume an internet connection for licensing, updates, threat feeds or a cloud backend. In an air-gapped network that assumption makes them useless. SAMURAI started from the opposite one.
Connectivity needed
SAMURAI
None once the image is inside
Cloud-dependent tools
License checks, updates or a cloud backend
Vendor lookups
SAMURAI
Built-in offline OUI database
Cloud-dependent tools
External API calls at runtime
Deployment
SAMURAI
docker save and docker load across the boundary
Cloud-dependent tools
Online installer or SaaS onboarding
Data residency
SAMURAI
Everything stays inside the enclave
Cloud-dependent tools
Data or metadata sent to the cloud
On a network with reliable internet, plenty of tools will do. Without it, most won’t even start. SAMURAI treats the air gap as the normal case.
Frequently asked questions
Can SAMURAI run in a fully air-gapped network?
Yes. Once the Docker image is across your boundary it needs no internet: no license server, no telemetry, no update checks, no external lookups. Everything runs on one VM inside your perimeter.
How do I install it without internet?
Pull the image on a connected machine, move it across with docker save and docker load, and run it inside the enclave. There’s nothing else to download; every dependency and database is in the image.
How does endpoint vendor lookup work offline?
The image includes a 39,000-entry IEEE OUI database, so matching a MAC address to its manufacturer is a local lookup. No external API or DNS is involved.
Does it need to call out for licensing or updates?
No. Licensing and authentication are checked locally, and there are no update or telemetry callbacks. It only talks to the devices you register.
What about TLS with self-signed certificates?
Isolated networks almost always use self-signed certificates or an internal CA. SAMURAI reads device APIs that use them, and you can install your own certificate for its web interface from Settings.
Which environments is this for?
Government, defense, OT and industrial, financial and critical-infrastructure networks that are cut off from the internet by policy, and any segment where firewall configuration isn’t allowed to leave.