"Air-gapped," object lock, and what actually survives
The market has stretched the word "air-gapped" to cover almost anything: a separate VLAN, a cloud tier, a retention flag. Buyers deserve a plainer taxonomy. Here is one, ordered by what it takes to defeat each level.
Level one: network separation
A firewall rule, a VLAN, a dedicated segment. Defeated by whoever controls the network, which after compromise is the attacker. This is the level most often sold with the words "air gap." A packet can reach it. That is the whole story.
Level two: logical immutability
Object lock, WORM flags, retention policies. Real protections, governed by software and identity. Defeated by administrative access, and harvesting administrative access is what crews do for weeks before you notice them. A setting protects you from mistakes. It protects you less from an adversary holding root.
Level three: physical isolation
No standing connection. No shared credentials. Immutability enforced by the hardware itself, a one-way path by construction, nothing to misconfigure and nothing to flip. Defeating it requires physical presence in your building. That is a different crime, with different economics, and it is not how ransomware works.
How to tell which one you bought
Ignore the datasheet adjectives and ask five questions: Is there a path? Do your credentials unlock it? Is the immutability physics or a setting? Can the person on shift restore? Was the restore rehearsed this quarter? Levels one and two fail on the first or second question. Only level three passes all five.
This is physically isolated recovery: the copy participates in nothing, so it survives everything the network cannot.