The network has no internet, the findings describe how to break a mission system, and every change needs an owner. Tooling that needs a cloud connection somewhere does not survive that environment. Neuron was designed to run where nothing leaves.
An air-gapped install, step by step, as the Neuron customer installation guide describes it.
On a connected workstation, download the release from my.neuron.ws with its SHA256SUMS file and signature. Check the hash and verify the signature against the Neuron release signing key before anything crosses.
Move the files on approved media and run the hash check again on the server, to prove nothing changed in transit.
Point the server at your internal time source, because Neuron refuses to start if its clock is more than 24 hours behind the latest time it has seen. Issue certificates from your internal CA, and the AI host and portal verify Core against it.
With Offline Mode on, Neuron writes fingerprint.txt and waits. Carry that one file out, submit it on my.neuron.ws and bring the license key back. The fingerprint holds no customer data, and the license is checked locally from then on.
Neuron AI models install from transferred files and run on a GPU or CPU on your own host. Only official Neuron models load. A model without the official marker is refused.
Updates follow the same path: download, verify, carry across. Offline Mode suspends update checks, threat-intelligence syncs and model downloads, and says why on each page.
Summarized from the Neuron Air-Gapped Deployment Guide.
Offline Mode is a superadmin-only switch that blocks every outbound internet connection, and asks for confirmation before it is turned off again. License activation becomes manual.
Some integrations exist to reach a network, such as SMTP, SSO and workflow integrations. Neuron does not hide that: it flags each one that still connects while Offline Mode is on, so you decide.
Track changes attributes every insertion, deletion, formatting change and caption edit to a named person. Every finding field records where its content came from. Reviewer and approver must be different people, and nobody approves their own work.
SAML 2.0 or OIDC to your own identity provider, with no auto-provisioning: an administrator creates every account. A break-glass superadmin signs in with a local password only and cannot reach day-to-day work or manage API tokens.
The Configuration / Hardening Review template records the baseline, the control ID, the current setting and the expected one, mapped to CIS Benchmarks and DISA STIG rule IDs.
The Operational Technology template maps to MITRE ATT&CK for ICS and includes a section for safety considerations.
Neuron AI runs on your own GPU or CPU and makes no outbound calls during inference. It sends no usage telemetry, and PenTest.WS does not train on customer data. Every finding it drafts goes through the same review and approval as one a person wrote.
We do not host Neuron. It runs inside your boundary, under your controls and your authorization process.
Air-gapped updates are manual by design. Someone downloads, verifies and carries each release across.
We cannot reach your deployment. Support works from what you tell us and the diagnostics you choose to share.
No. Neuron installs, activates, runs and updates with no outbound connection. Offline Mode blocks outbound connections and flags any integration you configure that still needs a network.
One file: fingerprint.txt, a hardware fingerprint with no customer data in it. You carry it out, submit it on my.neuron.ws, and bring the license key back. The license is checked locally after that.
Every download comes with a SHA256SUMS file and a signature you verify against the Neuron release signing key, before transfer and again on the server. The AI host installs only updates carrying Neuron's signature, and loads only official Neuron models.
Yes. Issue Core's certificate from your internal CA, and the AI host and Delivery Portal verify Core against your CA's root certificate.
No. Neuron AI makes no outbound calls during inference, emits no usage telemetry, and PenTest.WS does not train on customer prompts or completions.
CIS Benchmarks, DISA STIG, MITRE ATT&CK and ATT&CK for ICS, the OWASP Top 10 family, MITRE ATLAS and others, depending on the assessment template. Starter playbooks include PTES and NIST SP 800-115.
Yes. Our technical whitepaper, data sovereignty and responsible AI documents, and our security policy set are available during procurement. See Trust.
Tell us about the environment. We will walk you through installing, activating and running Neuron with nothing leaving it.