Operating a security zone on an air-gapped endpoint

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for operating an air-gapped endpoint, the process comprising:

• method for operating an air-gapped endpoint, comprising:
• initializing, on the endpoint, a hypervisor for execution over a primitive operating system (OS) of the endpoint;
• creating an isolated security zone by instantiating a virtual machine using the hypervisor, wherein the security zone includes a plurality of applications executed over a guest OS;
• and
• auditing, by the hypervisor, any action performed by any application executed in the security zone.

An air-gapped computing system, comprising:

• a network card interface;
• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• initialize, on the endpoint, a hypervisor for execution over a primitive operating system (OS) of the endpoint;
• create an isolated security zone by instantiating a virtual machine using the hypervisor, wherein the security zone includes a plurality of applications executed over a guest OS;
• and
• audit, by the hypervisor, any action performed by any application executed in the security zone.