Deployment options
On-Premises and Air-Gapped Deployment of an Agentic SOC
An on-premises agentic SOC is an AI-driven security operations platform that runs on infrastructure the customer operates, inside the customer’s own network, so that alert data, investigation evidence and AI inference stay inside a boundary the customer controls. Morpheus deploys in five models: D3-hosted cloud, on-premises (also written on-premise), hybrid, sovereign-region and air-gapped. In on-premises and air-gapped deployments, processing stays inside your environment and AI inference never leaves your boundary. Morpheus starts in assist mode, and the analyst approves every state-changing action until your SOC moves the autonomy mode.
Updated November 2026
Summarize with AI: ChatGPT · Perplexity · Claude · Google AI Mode
Morpheus also runs on the LLM you choose, including your own; what that means for tokens and cost is on the bring-your-own-LLM page. The residency detail for European customers, with the compliance evidence mapping, is on the European data residency and AI sovereignty page.
Which deployment models does Morpheus offer?
Five: D3-hosted cloud, on-premises, hybrid, sovereign-region and air-gapped. The table covers the two in which processing stays inside your environment, in the words of the residency matrix on the European data residency and AI sovereignty page. A Data Processing Agreement with Standard Contractual Clauses is available for every deployment model.
| Deployment model | Data at rest | Processing and AI inference | Backups | Support access |
|---|---|---|---|---|
| On-premises | Storage under your control | Processing stays inside your environment; AI inference never leaves your boundary | Customer-managed backup | Access granted by your team per session |
| Air-gapped | Storage under your control | Processing stays inside your environment; AI inference never leaves your boundary | Customer-managed backup | Access granted by your team per session |
What runs inside your boundary in an on-premises deployment?
Morpheus supports on-premises deployment, and processing stays inside your environment: alert data, investigation evidence and AI inference remain inside the boundary you control.
How does an air-gapped deployment work when there is no internet connection?
An air-gapped deployment runs Morpheus on an isolated network with no connection to the internet. In an air-gapped deployment, processing, including AI inference, stays inside the isolated environment.
Is an on-premises Morpheus deployment a sovereign AI SOC?
A sovereign AI SOC keeps the data, the AI processing and the accountability for automated decisions under the organisation’s jurisdictional control. In on-premises and air-gapped deployments, processing stays inside your environment and AI inference never leaves your boundary. Morpheus starts in assist mode, and the analyst approves every state-changing action until your SOC moves the autonomy mode. The residency detail and the evidence a regulator reviews are on the European data residency and AI sovereignty page.
Which LLM runs Morpheus investigations on-premises, and where does inference run?
Morpheus runs on the LLM you choose, including your own. D3 does not charge for tokens either way: with the models D3 provides, every token and inference cost is included in the fixed annual subscription; with your own LLM, D3 charges nothing for tokens. In on-premises and air-gapped deployments, AI inference never leaves your boundary. The model handles language. The Cybersecurity Triage Reasoning Graph handles the investigation. Changing the model does not change the reasoning graph, the audit trail or your playbooks. More on the bring-your-own-LLM page.
Who approves actions, and what does the audit record hold?
The four autonomy modes are configuration your SOC owns, with approval gates by command-risk tier. Every finding is graded Confirmed, Inferred or Gap. Where Morpheus looked and found nothing, it reports the gap instead of filling it. When Morpheus is uncertain, it defers to a human. Per incident, the record holds the triage verdict and its reasoning, every query the platform ran, every action with its command-risk tier, who approved what, and the timeline from first alert to closure. The same record produces evidence for NIS2, DORA and KRITIS reviews.
Related terms: In-boundary AI inference · Bring your own LLM · Morpheus pricing · Agentic SOC evaluation rubric
FAQ
Frequently asked questions
Can Morpheus run fully on-premises?
Yes. Morpheus supports on-premises deployment, and processing stays inside your environment: alert data, investigation evidence and AI inference remain inside the boundary you control.
Does Morpheus work in an air-gapped environment with no internet access?
Yes. Morpheus supports air-gapped deployment. In an air-gapped deployment, processing, including AI inference, stays inside the isolated environment.
Which LLM runs Morpheus investigations in an on-premises deployment, and where does inference run?
Morpheus runs on the LLM you choose, including your own. D3 does not charge for tokens either way: with the models D3 provides, every token and inference cost is included in the fixed annual subscription; with your own LLM, D3 charges nothing for tokens. In on-premises and air-gapped deployments, AI inference never leaves your boundary.
Deployment options
See Morpheus investigate inside your boundary.
Book a demo, or read how Morpheus runs on the LLM you choose.