Airgap Networks

A bet that became a feature

Airgap Networks no longer exists as a standalone company. As of April 2024 it lives inside Zscaler, the cloud-security giant, as the engine behind a feature called Zero Trust Device Segmentation. Visit airgap.io today and you don't land on a scrappy startup page - you land in Zscaler's product catalog.

That is, in the unsentimental arithmetic of enterprise software, a happy ending. Airgap had a sharp idea about a stubborn problem, built it into a product, sold it to enough customers to matter, and got acquired by the company best positioned to scale it. The technology didn't die. It graduated.

Ransomware doesn't break in. It spreads.

Here is the uncomfortable truth Airgap built a company around: most security spending guards the front door, but ransomware does its real damage after it's already inside. One compromised laptop, one unpatched IoT sensor, one forgotten factory controller - and the malware walks laterally across a flat internal network, encrypting everything it can reach.

The traditional fix is segmentation: chop the network into zones so a breach in one can't infect the rest. Sensible in theory. Miserable in practice. It means east-west firewalls, network access control appliances, VLAN gymnastics, and a maintenance burden that grows with every new device. And the devices that need it most - headless IoT, legacy servers, operational-technology gear in factories and hospitals - are exactly the ones that can't run a security agent.

Two networking lifers, one contrarian idea

Ritesh Agrawal spent the better part of two decades at Juniper Networks, much of it running product management for the company's security portfolio. His co-founder Satish Mohan brought deep networking architecture chops. Between them they had seen enough firewall rule sets to develop a healthy allergy to them.

Their bet was almost cheeky: what if segmentation didn't need agents, APIs, or a forklift upgrade of the network at all? What if you could enforce zero trust using a protocol that was already running on every network on earth - the humble, 30-year-old DHCP that quietly hands out IP addresses?

Four numbers that bracket a company's entire life. The middle two are the ones investors care about.

A network of one

The clever bit works like this. Airgap's DHCP proxy intercepts every device's request to join the network and hands it a /32 address - a subnet containing exactly one host - plus a default gateway pointing at Airgap itself. The result: each device thinks it is alone on the network. Every conversation it tries to have routes through Airgap first, where identity and context decide whether it's allowed.

No agent on the endpoint. No change to the existing switches and routers. It works on the printer, the MRI machine, the PLC on the factory floor, the static-IP server nobody dares reboot. Then there's the headline act: the Ransomware Kill Switch, a one-click control that severs all non-essential device-to-device traffic the instant an attack is detected - stopping the spread without unplugging the business.

The money followed the logic

Investors are not a moral authority, but they are a useful skeptic. Airgap raised a $13.4M Series A led by Storm Ventures in April 2022, on top of earlier rounds from Cervin Ventures, Engineering Capital, and Sorenson Ventures - $18.6M in total. The cap table also picked up notable security operators as angels, including Manoj Apte, Josh Leslie, Anuj Kapur, and Robert Tinker.

The bigger validation came from the buyer. Zscaler doesn't acquire often, and when it does, it's filling a specific gap. Airgap filled the east-west one - the lateral traffic inside a network that Zscaler's cloud-delivered security historically didn't touch.

Make the hard thing boring

Strip away the acronyms and Airgap's mission was almost modest: simplify and secure the infrastructure businesses can't afford to lose. The radical part wasn't ambition - it was the refusal to accept that good security had to be complicated. Segmentation, they argued, should be something you turn on, not a multi-year project staffed by a firewall priesthood.

The devices most likely to get a network compromised - unmanaged, legacy, headless - are precisely the ones legacy tools can't protect. Airgap's answer was to protect them anyway, without asking them to change.

For security teams, that translated to practical things: discover every device on the network, contain a ransomware outbreak before it metastasizes, and do it without ripping out the switches. Boring, in the best possible way.

The idea outlived the logo

Airgap competed in a crowded field - Illumio, Akamai Guardicore, Cisco, Zero Networks, Elisity, Forescout - all chasing the same goal of stopping lateral movement. Most of them still ask you to deploy something on the endpoint or rebuild your network policy. Airgap's wager was that the winning approach would be the one that demanded the least.

That wager is now Zscaler's to scale. As factories, hospitals, and offices fill with billions of devices that will never run a security agent, agentless segmentation stops being clever and starts being necessary. The startup is gone; the architecture is spreading.

So return to that Santa Clara office in 2019. Two networking veterans, tired of firewall spreadsheets, sketching a way to give every device its own private network using a protocol everyone else ignored. The office is closed now. The whiteboard idea ships inside one of the largest security platforms in the world. The sideways problem they set out to solve is, increasingly, somebody else's solved problem.

Things worth knowing

Interviews & demos

Direct video links weren't confirmed at publish time, so these point to fresh searches rather than a dead URL. Honest is better than broken.