Air-Gapped vs VPC vs SaaS for Enterprise AI Agents
Compare air-gapped, VPC, and SaaS deployment for enterprise AI agents with real cost deltas, latency figures, and a decision tree for regulated workloads.
Most deployment-topology conversations get resolved in a slide instead of a spreadsheet. Someone declares that "regulated data stays on-prem," someone else counters that "SaaS is faster to value," and the actual decision is made by whoever spoke last. That is not an architecture; that is a coin flip with lawyers.
The three real options for running enterprise AI agents look similar on a vendor's diagram and behave very differently in production. Air-gapped means no route to the internet at all. VPC means the agent runs inside a network boundary you own, typically inside your cloud account or a dedicated tenant provisioned into it. SaaS means the vendor operates the agent in their own multi-tenant environment and you send data across their perimeter. Each option prices differently, fails differently, and passes audits differently.
The question is not which one is safest. The question is which combination of regulatory pressure, latency budget, and token volume actually forces the harder choice — and where you would be paying a premium for control you do not need.
What Each Topology Actually Means
The words get abused, so pin them down before pricing them.
SaaS is the vendor's cloud, the vendor's model, the vendor's operators. Your prompts, tool calls, and retrieved context traverse their perimeter. You get contractual promises about isolation and retention; you do not get to inspect the substrate. This is fine for a lot of workloads and disqualifying for others.
VPC deployment puts the agent stack inside a network boundary you control. A virtual private cloud is a configurable pool of shared resources allocated inside a public cloud with tenant isolation enforced through private subnets and virtual networking. In practice this means the agent, its tool registry, its vector store, and its audit log all sit inside your AWS, Azure, or GCP account. The model weights may come from a vendor, but the runtime and the data plane are yours.
Air-gapped means the inference server, the orchestrator, and every dependency run with no outbound network route. Air-gapped deployments represent the strongest guarantee for the most stringent compliance environments. That guarantee is expensive: model refreshes arrive on signed media, patches move through a controlled ingest process, and any telemetry ping in a third-party component disqualifies it. If your architecture is more comfortable running behind a hardware perimeter than behind a firewall rule, our Air-Gapped AI practice is built for exactly this failure mode.
A useful gut check: if you cannot draw the exact network path a single tool call takes without waving your hand at "the vendor's cloud," you are running SaaS, not VPC. Naming this precisely matters when you get to the audit.
The Cost Delta Nobody Wants to Model
The default finance-team assumption is that SaaS is cheapest, VPC costs more, and air-gapped costs a fortune. That is directionally correct at low volume and increasingly wrong at high volume.
On the hardware side, a capable entry-level private LLM server starts at roughly $8,000 to $12,000, which is trivial for a proof of concept but not what production looks like. For serious throughput, an 8-GPU H100 node runs about $287,000 to $482,000 per year on AWS on-demand pricing, versus an on-prem floor around $237,000 per year. VPC deployment on reserved cloud GPUs sits between those two poles, without the capex commitment.
On the token side, self-hosting on a reserved cloud GPU breaks even at roughly 2 to 5 million tokens per day against frontier proprietary API pricing. Against optimized open-weight hosted APIs, that crossover moves out past 50 million tokens per day, because those providers already run the same infrastructure at scale on thinner margins. In other words: the deployment topology decision is really a token-volume-and-model-tier decision wearing a compliance costume.
Two numbers that usually go missing from the model: the operator time to keep an on-prem or air-gapped cluster fed with model updates, and the cost of a serious data incident when SaaS goes wrong. IBM's 2025 Cost of a Data Breach report put the global average breach at $4.44 million, and the US average at an all-time high of $10.22 million. Neither figure is a reason to panic; both are a reason to price your topology decision against expected loss, not just against infrastructure. If ROI math is where these decisions live or die in your organization, our automation ROI models practice exists to make that math boring and defensible.
Latency and Failure Modes
Cost is legible. Latency is what surprises people in production.
Local inference commonly lands at 15 to 30ms P50 time-to-first-token on datacenter GPUs, while cloud APIs typically deliver 100 to 300ms P50 depending on provider and model, and cloud tails can spike to 1 to 2 seconds under provider-side congestion. For a chat sidebar, nobody notices. For an agent that fires eight tool calls in sequence before rendering, that difference is the reason the workflow feels alive or dead. The physics of latency is not something you optimize away with a better prompt.
Failure modes matter as much as median latency. SaaS gives you a vendor incident page and a status Twitter account. VPC gives you the ability to fail over between regions inside your own account, run your own retries, and observe your own queues. Air-gapped gives you full control and full responsibility: if the model server dies at 2am, nobody is paging themselves on your behalf. That is a real operational cost, and it is the reason air-gapped programs need a serious on-call rotation before they need a bigger GPU.
What the Regulator Actually Requires
Compliance conversations tend to inflate. "The regulator requires on-prem" usually decodes to "our lawyers have not read the guidance recently." Read the guidance. Most regimes require data residency, access control, auditability, and a specific data-processing agreement — not a specific network topology.
The workflows that genuinely force air-gapped are narrower than the marketing suggests: classified defense work, certain healthcare research environments, insider-information handling at some financial institutions, and industrial systems in SCIF-equivalent facilities. Almost everything else can be satisfied by a VPC deployment with strong tenancy, encryption, key control, and a real audit trail. If your team has not yet mapped which controls actually bind you, an AI security and compliance audit is cheaper than picking the wrong topology and rebuilding twelve months in.
Shadow AI complicates the picture. Gartner research across 500 companies found 68% of employees use unauthorized AI tools at work, up from 41% in 2023, and IBM found shadow AI was involved in 20% of breaches, adding as much as $670,000 to the average breach cost. Picking air-gapped for the sanctioned workflow does nothing if the sales team is pasting customer data into a consumer chatbot. The topology question and the governance question travel together.
A Decision Tree You Can Defend
The choice is rarely a clean one-of-three. It is a set of gates you walk through in order.
A few notes on how to apply this without lying to yourself. Volume estimates should be based on measured pilot traffic, not on the enthusiastic projection someone put in a deck; most agent workloads over-forecast by three to five times in the first year. Latency budgets should be measured end-to-end including retrieval and tool calls, not just model inference. And "the regulator requires it" should be traceable to a specific clause, not a summary of a summary.
The other honest answer is hybrid. A well-designed agent architecture can route sensitive tasks to a VPC-hosted model and low-sensitivity tasks to a hosted frontier API, with policy enforced at the tool registry rather than at the model boundary. Our agent architecture practice spends most of its time on exactly this seam, because it is where the cost savings and the compliance posture actually live.
Where Each Topology Earns Its Keep
SaaS earns its keep when your token volume is modest, your data is not regulated, and your workflows do not need sub-100ms tool orchestration. That describes a lot of internal productivity work and a fair number of customer-facing copilots. Do not pay a control premium for control you will not use.
VPC deployment earns its keep when you have real data residency or tenancy requirements, when you are running enough volume that reserved GPUs beat per-token pricing, or when you need to keep the audit log, the vector index, and the tool registry inside your own security boundary. This is the default for most regulated enterprises that are not running classified workloads.
Air-gapped earns its keep in a smaller set of environments than the brochures suggest, but where it fits, nothing else works. If your data physically cannot leave the building, this is the only conversation to have. The operational overhead is real, and it should be priced against the workflow value before the program starts, not discovered halfway through.
Getting the Decision Right the First Time
The failure pattern to avoid is picking a topology based on aesthetic preference and then discovering the bill or the audit twelve months later. Model the token volume. Measure the latency budget end-to-end. Read the actual regulation. Price the operational load, not just the infrastructure. And treat hybrid as a first-class option rather than a compromise, because for most enterprise agent programs it is the answer that clears both the finance review and the compliance review without leaving performance on the table.
An agent that only suggests is a search box. An agent that acts inside your systems is infrastructure, and infrastructure decisions age. The topology you pick now will shape the next three years of what your agents can and cannot touch. Make it a decision, not a slide.
Eric Lamanna is a Digital Sales Manager with a strong passion for software and website development, AI, automation, and cybersecurity. With a background in multimedia design and years of hands-on experience in tech-driven sales, Eric thrives at the intersection of innovation and strategy—helping businesses grow through smart, scalable solutions. He specializes in streamlining workflows, improving digital security, and guiding clients through the fast-changing landscape of technology. Known for building strong, lasting relationships, Eric is committed to delivering results that make a meaningful difference. He holds a degree in multimedia design from Olympic College and lives in Denver, Colorado, with his wife and children.
Put an agent to work, the right way.
Start on Automatic and put the workflow you want to automate in front of engineers who have shipped agents in regulated environments.
Agentic AI, in your inbox.
Occasional, high-signal notes on building and operating AI agents — automation patterns, architecture, and governance. No spam.