The Design Is the Product: Why Air-Gapped On-Premises Matters for Protecting IP in Additive Manufacturing

In additive manufacturing, the most valuable asset a company owns is no longer the machine. It is the design file.

In conventional production, know-how is spread across tooling, fixtures, machine settings and the experience of people on the shop floor. In additive manufacturing, all of that collapses into data. Whoever holds the complete build file can, in principle, reproduce the part on any qualified machine, anywhere in the world.

That moves the front line of intellectual property protection from the factory gate to the design environment. It also raises a question many engineering leaders have not yet asked their software vendors: where exactly does our design data live, who can reach it, and under which jurisdiction?

In short

• Additive design files carry the full engineering know-how of a part, especially its internal architecture.

• Design data is a documented target for theft, espionage and sabotage.

• The cloud is right for most work, but it cannot give exclusive control over data while it is processed.

• For crown-jewel designs, an air-gapped on-premises deployment is the strongest foundation, provided it is run with discipline.

Why additive design data is so exposed

A build file holds the geometry, the internal architecture, the material and the process settings. Together they define not only what a part looks like, but how it performs.

The outside of a part can be measured with a scanner. The inside is different. Its lattices, graded densities and internal channels are where years of simulation and testing are condensed. Reverse-engineering them from a physical part takes industrial CT scanning and considerable effort. Stealing the file takes neither.

And these files travel. Researchers at NYU Tandon point out that the additive supply chain relies on sending CAD files within organisations and to outside partners by email or cloud, creating many openings for thieves to obtain them and print counterfeit parts (NYU Tandon). The U.S. National Institute of Standards and Technology (NIST) adds that the complexity of additive designs and processes makes them attractive targets, and that generic IT security guidance needs additive-specific additions (NIST, 2023).

In additive manufacturing, the design file is not documentation of the product. It is the product, waiting to be printed.

The threat is documented, not theoretical

Manufacturing design data is a proven target, and the 2026 figures are clear:

• 80 percent: share of manufacturing breaches in which internal data was involved, according to the 2026 Verizon Data Breach Investigations Report (Manufacturing.net).

• 15 percent: share of actors behind manufacturing breaches motivated by espionage rather than money (Advanced Manufacturing).

• 48 percent: share of breaches across all sectors that involved a third party, up from 30 percent a year earlier (eSecurity Planet).

• 247 days: average time to identify and contain a breach, at a record global average cost of USD 4.99 million, according to IBM (Baker Donelson). Eight months is long enough to copy an entire product line.

For additive manufacturing specifically, four attack patterns stand out:

• Theft and counterfeiting. Stolen design files are printed as copies that are hard to tell from the original.

• State-backed espionage. In 2018, the U.S. Department of Justice indicted ten people over a five-year effort to steal turbofan engine technology from U.S. and French aerospace firms (IndustryWeek).

• Sabotage of the design. In the “dr0wned” study, researchers used a cyber attack to weaken a 3D-printed drone propeller, which then broke apart in flight (arXiv).

• Side channels at the printer. A 2026 study reconstructed a printer’s toolpath from its sound and magnetic emissions with 98.89 percent command-level accuracy, from up to 60 cm away (arXiv).

The sabotage case deserves particular attention. A stolen design is a commercial loss. A manipulated design that passes visual inspection is a safety problem.

What the cloud does well, and where it stops

This is not an argument against the cloud. Large providers invest more in physical security, patching and monitoring than most manufacturers ever could. For most design work, a well-configured, regionally hosted cloud service is secure, efficient and the sensible choice.

For the most sensitive work, however, three structural facts matter.

Responsibility is shared, and most failures sit with the customer. The provider secures the infrastructure; data, identities and access settings remain the customer’s job. Gartner has estimated that through 2026, 99 percent of cloud security failures will be the customer’s fault, mostly through misconfiguration (Kaseya, citing Gartner).

Design software must read the design to compute on it. Encryption protects data at rest and in transit. But a geometry engine generating an internal lattice, or a solver running a simulation, has to work on readable data, on infrastructure the customer neither owns nor operates. Confidential computing narrows this gap, but France’s national cybersecurity agency ANSSI concludes it is not sufficient against a hostile administrator performing targeted attacks (ANSSI, 2025).

Data location is not legal control. Under the U.S. CLOUD Act, a provider subject to U.S. jurisdiction can be compelled to disclose data in its possession, custody or control, even when it is stored outside the United States (MLL Legal). Some legal analyses consider fears of broad surveillance overstated (Hogan Lovells). But for a board protecting its core intellectual property, the question is not how likely a request is. It is whether the company can say, without qualification, who is able to access its designs.

Regulation reinforces the point. Swiss export control covers technology and software in intangible form (SECO). U.S. rules exempt cloud storage of defence technical data only when it is end-to-end encrypted (Dechert). And trade secret law, in Switzerland as in the EU, protects know-how only where the holder has visibly treated it as secret (Winston & Strawn).

Why air-gapped on-premises matters

An air-gapped on-premises deployment gives a manufacturer something no hosted service can: exclusive physical, operational and legal control over its designs while they are created and processed.

The term is often used loosely. “On-premises” alone can still mean software that sends telemetry, checks licences online or allows remote vendor support. A true air-gapped deployment runs on the customer’s own hardware, on a network with no connection to the internet or the vendor. Licensing works offline, nothing is reported back, and updates arrive through a controlled, verified process.

It helps to see the options as a spectrum of control:

• Public cloud, regional hosting: run by the provider; reachable by the customer, the provider and its subprocessors. Right for most commercial design work.
• Dedicated or private cloud: run by a provider or partner; reachable by the customer and the operator. Suits sensitive work that needs scale.
• On-premises, connected: run by the customer; the vendor can still reach it if remote access or telemetry is enabled.
• On-premises, air-gapped: run by the customer and reachable only from inside its own perimeter. Built for defence, export-controlled and crown-jewel programmes.

What an air gap solves

• No remote attack path. Exploiting a vulnerability was the leading way into breached organisations in the 2026 Verizon report, at 31 percent of cases (eSecurity Planet). A system that cannot be reached from the internet cannot be exploited from it.
• No third parties in the data path. No provider staff, no subprocessors, no shared infrastructure.
• No provider as a legal access point. If no service provider holds the data, no provider can be compelled to disclose it.
• Simpler export-control compliance. Controlled technical data is processed where it already sits and never crosses a border through the tool itself.
• Provable protection. A defined perimeter, offline operation and logged transfers are concrete evidence of the steps taken to keep know-how secret.
• Integrity, not only confidentiality. A closed, known environment makes silent manipulation of designs far harder.

What an air gap does not solve

Air gaps have been breached. MITRE ATT&CK documents how the Stuxnet malware spread through removable drives into isolated environments, possibly carried in by an insider or contractor (MITRE ATT&CK). Every transfer path is an attack surface, insiders remain a risk, and side channels on the shop floor are unaffected by how the design software is deployed.

There is also an operational cost: updates must be brought in deliberately, through verified media or one-way transfer hardware. An air gap is not a feature that solves security on its own. It is the strongest foundation on which disciplined processes can be built.

Six questions to ask before choosing where your designs live

• Which designs are crown jewels? Classify programmes by commercial value, customer confidentiality and export-control status. Not every project needs an air gap; the most sensitive ones usually do.
• Where does the data actually go? Map every place geometry is stored, processed, simulated, cached and logged, and who holds the keys.
• Does the software truly run offline? Check that licensing, updates and every function work without a connection, and that telemetry can be switched off completely.
• Which jurisdictions apply? Identify every legal entity in the data path and the laws that can reach it.
• How is the air gap crossed? Define approved media, scanning, one-way transfer hardware where justified, and logging of every transfer.
• Can you prove it? Document your measures so you can show customers, and if necessary a court, exactly how your know-how was protected.
  

How we approach this at Spherene

At Spherene, we work exactly where this risk is concentrated: inside the part. CAD defines the outside of a part; SphereneNXT designs its internal architecture, the structures that determine stiffness, weight, heat management and energy absorption. That is the layer where our customers’ most valuable engineering knowledge lives.

We therefore offer sphereneNXT in two ways. A cloud service hosted in Switzerland suits most design work. An on-premises deployment, which can run fully air-gapped, serves customers whose designs must never leave their own perimeter. Both are built on the same platform, and our research and development is anchored in Switzerland.

In additive manufacturing, the inside of a part is where the value is. It deserves the same protection as the part itself.

Want to discuss an on-premises or air-gapped deployment for your team? Get in touch with us.

Get started sphereneNXT 

Already have an account? Log in to sphereneNXT, start using simulation, and keep an eye on what comes next.

New to sphereneNXT? Register here - start your trial 
Need help? Send us an email at support@spherene.io

Sources

ANSSI, Technical Position Paper on Confidential Computing

Baker Donelson, Ten Takeaways from IBM’s 2026 Cost of a Data Breach Report

Belikovetsky et al., dr0wned: Cyber-Physical Attack with Additive Manufacturing

Dechert, Cloud Solutions Allowed for Encrypted, Unclassified Defense Data

eSecurity Planet, 2026 Verizon DBIR: The New Era of Cyber Threats

Hogan Lovells, Demystifying the U.S. CLOUD Act

IndustryWeek, US Indicts 10 Chinese Over Scheme to Steal Aerospace Tech
Kaseya, The cloud shared responsibility model
Manufacturing.net, Verizon Unveils Latest Data Breach Report
MITRE ATT&CK for ICS, T0847 Replication Through Removable Media
MLL Legal, Extraterritorial Reach of the CLOUD Act

NIST, Milaat & Lubell, Layered Security Guidance for Data Asset Management in Additive Manufacturing

NYU Tandon, How to Prevent 3D Printing Hacks?

SECO, Güterkontrollgesetzgebung: Rechtliche Grundlagen

Side-channel IP theft attack on additive manufacturing using dual smartphones, arXiv, 2026

Winston & Strawn, EU Trade Secrets Directive: What Are “Reasonable Steps”?