Yeah, I don't think I've ever seen an 'airgapped' network that was actually airgapped. About half the time no discernable effort was ever put into airgapping a

Yeah, I don't think I've ever seen an 'airgapped' network that was actually airgapped. About half the time no discernable effort was ever put into airgapping and it was only ever a paper goal. Most of the rest of the time it started out configured reasonably but either drifted out as business needs changed ("Chloe get me a port!" is a pretty common joke) or someone just didn't realize it was special and configured it badly. The rest of the time you just stack up edge cases: bad management credentials, forgotten management interfaces, canned router or switch exploits, broken q-in-q implementations, etc. The list is endless. And all that's without getting someone authorized to carry you onto the airgapped network, which happens facepalmingly often.