Air-gapped servers exist for a reason: production lines, clinical systems, energy control networks and classified environments are sealed off so that nothing from the internet can reach them. The same isolation that protects them also makes them the hardest systems to patch — and, too often, the most out of date.
For years the default answer was a disconnected WSUS server fed by manual exports. With WSUS now deprecated, many teams are re-examining that process. Here is what a sound air-gapped Windows patching process looks like, with or without WSUS.
Why air-gapped patching breaks down
- Manual transfer. Updates are downloaded on a connected machine, copied to removable media and carried across — slow, error-prone and hard to audit.
- No verification. Without a consistent integrity check, there is no proof that what was installed is exactly what Microsoft published.
- Long exposure windows. When each cycle takes weeks, known vulnerabilities stay open on the servers that matter most.
- Weak evidence. Auditors ask what was patched, when and by whom. Spreadsheets and screenshots rarely satisfy ISO 27001, NIS2 or PCI-DSS reviews.
A better process: bring verified updates to the servers
The principle is simple: never bring the servers to the internet — bring verified updates to the servers. In practice that means:
- Collect the updates you need on the connected side, from the vendor’s official sources.
- Verify every package with a digital fingerprint before it crosses into the isolated zone.
- Move updates through a single, controlled doorway rather than ad-hoc USB drives.
- Approve and schedule deployments inside the isolated network, with maintenance windows and staged rollouts.
- Record every step automatically so the audit trail exists the moment patching finishes.
With WSUS or without it
JetPatch supports both. If your isolated sites run WSUS today, JetPatch can govern patching through it. If you want to retire WSUS, JetPatch Offline Windows Patching delivers verified updates to isolated servers from the JetPatch repository — with zero new internet exposure and audit-ready records by default. You can run the two side by side while you migrate.
The same console also patches Linux, AIX and Solaris servers in the same isolated environments, so OT, infrastructure and Unix teams work from one compliance view.
Checklist for your next air-gapped patch cycle
- Do you know, per server, which updates are missing right now?
- Can you prove each installed package matches the vendor original?
- Is there one documented path into the isolated zone — and only one?
- Are deployments staged (test → staging → production) with maintenance windows?
- Can you hand an auditor a report for the last cycle in minutes, not days?
If any answer is “no,” see how Offline Windows Patching works, compare WSUS replacement options, or book a call with our team.
