Cisco announced general availability of the Cisco IQ Air-gapped Virtual Appliance, letting organizations run Cisco IQ's AI-powered infrastructure lifecycle intelligence, security assessments, and analytics entirely inside their own network with no data leaving the environment. It uses a local Small Language Model for AI features, supports CPU-only or optional GPU-based inference, and includes SAML, PKI/CBA authentication, FIPS 140-3 and DISA STIG compliance. Updates like security advisories and assessment rules can be manually transferred without full platform upgrades or internet connectivity. A future 'Tethered Virtual Appliance' will add an outbound-only connection for automated updates while keeping data on-premises.
Table of contents
1. Intelligence Without Tradeoffs2. Engineered for Absolute Isolation3. Bringing AI to Where the Data Lives4. Staying Current, Even When You’re Disconnected5. Security and Control by DesignComing Soon: Cisco IQ Tethered Virtual Appliance for On-Premises DeploymentsThe Foundation for Sovereign IntelligenceQuestions this post answers
Is there a way to run Cisco IQ's AI features without sending data to the cloud?
Yes, the Cisco IQ Air-gapped Virtual Appliance is generally available for on-premises deployment, keeping all network telemetry, device configurations, and assessment data inside the customer's environment. It uses a local Small Language Model for features like 'Ask AI' and risk analysis, so no external LLM APIs or internet connectivity are required at runtime. daily.dev surfaces releases like this for engineers evaluating on-prem AI options under strict sovereignty rules.
Do I need a GPU to deploy Cisco IQ's air-gapped appliance?
No, the core virtual appliance can run on CPU-only infrastructure and still deliver lifecycle intelligence, predictive asset insights, and infrastructure assessments. A modular AI Inference Infrastructure add-on can be layered in later for localized AI inference once GPU resources become available, so AI readiness does not have to be an all-or-nothing decision. Teams planning phased AI infrastructure rollouts can track these tradeoffs via daily.dev.
How does an air-gapped Cisco IQ appliance stay updated with new security advisories without internet access?
Administrators can securely transfer updated assessment artifacts, such as Cisco Security Advisories, hardening guidance, and Field Notices, directly into the appliance without reconnecting it to the internet or upgrading the entire platform. Application capabilities, assessment rules, and feature entitlements follow independent release cycles for this purpose. Security teams managing isolated networks can follow update workflows like this through daily.dev.