Updated July 2026 · 7 min read · Adente Vision Engineering Team
Why do some plants forbid a vision system from touching the network?
Some production environments do not allow any device on the line to open an outbound connection. Defense manufacturing, pharmaceutical production, contract manufacturing under a customer NDA, and any plant with a strict operational-technology security policy treat an outbound link as an attack surface and a data-leak path. For a vision system that is a problem, because many AI inspection tools were designed to ship images to a server or a cloud region for inference. If the line cannot reach that server, the inspection stops.
The question a plant IT or OT owner asks is direct: can we run full AI quality inspection on a line that has no route to the internet, and keep it running. The answer turns on where the model and the compute actually live. If they live off-site, an air gap breaks the system. If they live on the unit, the air gap changes nothing about how inspection works. That single design decision is the whole story of air-gapped inspection.
How does on-device compute remove the network dependency?
On-device compute removes the network dependency by carrying everything the decision needs inside the enclosure. Adente Vision is an edge-AI visual inspection unit built by ADENTE Advanced Engineering Technologies, part of the Aden Group, sold through automation system integrators. It runs inference on a fanless Jetson-class board with 8-16 GB inside the same box as the camera and lighting. The model is stored locally, the image is captured locally, and the pass or fail is decided locally in about 30 ms per part. No frame is uploaded, and no server is contacted to reach a verdict.
That is what makes "offline" a non-event rather than a limitation. The decision path never crossed the plant boundary in the first place, so removing the internet route subtracts nothing from the inspection. The unit still runs its four modes, Anomaly, Defect, Counting and Quality, still combines classical computer vision with AI inference so the result is auditable rather than a black box, and still sends pass/fail to your PLC over the protocol it already speaks. Being air-gapped does not cost accuracy either: on a delivered cap-inspection line, an on-device unit reached a 99.65% F1-score with a 0.69% false-negative rate at about 30 ms per part.
How do you update an air-gapped inspection model safely?
Model updates are the one place a network usually earns its keep, so an offline line needs a deliberate path. On an air-gapped line the model is retrained away from the cell, on captured good images, and the new version is carried to the unit on a USB stick. Nothing about the update requires connecting the line to a wider network, which is exactly what the OT security policy demands.
The workflow is a change-control step, not an engineering project. Capture about 20 good reference images of the part, train the model (training completes under 48 hours), validate the new version against known-good and known-bad samples, then deploy it by USB and keep the previous version for rollback. Because training needs good parts only, there is no catalogue of defects to collect or stage before you can improve the model. The line stays disconnected the whole time, and change control gets a clean record of which model version ran when.
Cloud vs air-gapped edge: what do you actually give up?
The honest comparison is not "edge always wins", it is what each column costs you. A cloud inspection pipeline offers central storage and ready-made fleet dashboards, at the price of an outbound dependency and your raw images leaving the line. An air-gapped edge unit offers a decision that never leaves the line, at the price of running updates and analytics by a local or manual path instead of an automatic cloud one.
| Dimension | Cloud vision | Air-gapped edge unit |
|---|---|---|
| Where inference runs | A vendor cloud or off-line server | On the unit, fanless Jetson-class 8-16 GB |
| Network needed to decide | Outbound connection required | None, decides fully offline |
| Per-part decision time | Round-trip plus queue, variable | About 30 ms measured on the edge |
| Where images go | Uploaded to a cloud region | Processed on the line, not shipped off-site |
| Model updates | Pushed over the network | By USB stick, versioned and change-controlled |
| Behaviour in an outage | Stops when the link or region is down | Keeps inspecting through the outage |
For most regulated or IP-sensitive lines, that trade favours the edge. What you give up, automatic cloud updates, is replaceable with a USB workflow; what you keep, a decision and an image that never leave the plant, is hard to recover once it has been shipped to a third party. For the fuller latency and data-locality argument, see the sibling post on edge vs cloud visual inspection.
Where does remote monitoring still fit on an offline line?
Air-gapped does not have to mean blind. A unit can decide every part offline and still serve a local web-based dashboard on the plant network, so an operator or line manager watches counts, pass/fail rates and drift without any of that data crossing the plant boundary. The dashboard sits on the same side of the air gap as the line.
The distinction that matters is between the plant network and the public internet. Keeping the unit off the public internet is what satisfies the security policy; serving a dashboard to an engineer on the internal network does not break the air gap. Where a plant wants trends across several lines, those can be aggregated as numbers on the internal network while the raw frames stay on each unit. The rule of thumb is simple: metrics can move on the internal network, images do not have to move at all.
This post is a spoke of the pillar guide on AI visual inspection; for the hardware that carries the model, compute and updates inside one enclosure, see the system.