Quick answer: The data a security tool scans is an organization's most sensitive asset: internal network structure, vulnerabilities, credentials, source code. A tool that sends this data to a cloud or a third-party AI service for analysis creates a new leak surface while providing security. The difference that makes KAOS a world standard for enterprise and public environments is that it can run entirely locally (on-premise) and, when needed, air-gapped. In sovereign mode, KAOS works with its own model without depending on cloud services; thanks to offline parity it can stay local even when the internet is available, and no sensitive data scanned leaves the organization. This is a non-negotiable feature for organizations with KVKK and data-sovereignty requirements.

Most AI-assisted security tools draw their analytical power from cloud services: the scanned data is sent out for processing. This works in practice but has a cost. If what you scan is your organization's most sensitive information, sending it to an external service produces a new risk while providing security. The fourth core difference that lifts KAOS to a world standard is that it removes this trade-off: full capability, entirely local. This guide explains what sovereign and offline operation means, why it is critical for enterprise and public environments, and how KAOS provides it.

The problem: a security tool must not become a new leak surface

A penetration test or security scan, by its nature, touches an organization's most sensitive data. The tool sees the internal network topology, open endpoints, the credentials it finds, source code fragments and the exact location of vulnerabilities. If this information falls into the wrong hands, it offers an attacker a roadmap.

When a cloud-dependent tool sends this data out for analysis, it copies it somewhere beyond the organization's control. No matter how well the data is protected there, it is now outside the organization's security boundary and forms a new leak surface. This is unacceptable especially for public institutions, defense, health, finance and critical infrastructure. A world-standard cyber intelligence must not itself create a new risk while providing security.

Sovereign mode: full capability without cloud dependency

KAOS's sovereign mode lets the tool run at full capability on the organization's own infrastructure, without depending on cloud services. The model runs locally, the analysis is done locally, the memory is stored locally. No sensitive data is sent out.

This is not a "weakened offline version." The design goal of sovereign mode is parity: offline KAOS offers the same capability set as online KAOS. All of the recon, assessment, exploitation, verification and defense agents run locally. In fact, even when internet access is available, in a sovereign installation KAOS deliberately stays local and does not go out; this removes the possibility of "accidental leakage" at the architectural level. The orchestra structure we cover in our KAOS multi-agent swarm architecture article is what makes it possible for the entire multi-agent architecture to run locally.

The balance of offline parity and live intelligence

A question comes to mind: if KAOS is offline, how does it benefit from live CVE intelligence? The answer is a deliberate balance based on the deployment scenario.

Scenario Live CVE query Does data leave
Standard (connected) installation on (current CVEs live) only the CVE query, not target data
Sovereign / air-gapped off (local knowledge only) no, nothing

In a connected installation KAOS pulls current CVEs live, but this query uses only the technology/version matching, not the target's sensitive data. In an air-gapped installation the live query is fully turned off and KAOS works only with its local knowledge and learning brain. We cover how live intelligence works in our KAOS learning brain and live CVE article. So the organization can choose between currency and full isolation according to its security level; KAOS works at both ends.

Why sovereignty is a requirement of the enterprise world standard

Data sovereignty is at the center of enterprise and public security today. Regulations like KVKK care about where personal and sensitive data is processed and stored. For critical infrastructure and public institutions, keeping data within national and organizational boundaries is often a legal obligation. A cloud-dependent security tool cannot meet these requirements.

KAOS's ability to run sovereign and offline lifts it to a world standard not only technically but also in terms of compliance and risk. An organization can run its most sensitive security scan inside its own walls, with no data leaving. This is one of the features that defines a world-class cyber intelligence: being able to deliver the most powerful capability with the highest privacy.

The KAOS and DSET approach

At DSET we designed KAOS to run safely even in the most sensitive environments. In organizations where data cannot leave, such as public institutions, finance, health or critical infrastructure, we install KAOS entirely locally and air-gapped; throughout the scan no sensitive data crosses the organization's boundary. You get a full-capability security scan while meeting your KVKK and data-sovereignty requirements. To evaluate your organization with a sovereign-capable cyber intelligence developed in Turkey, contact DSET and reach our team at Ankara Hacettepe Teknokent. We also described our KVKK-focused pentest approach in our Ankara cybersecurity pentest KVKK KAOS article.

Frequently asked questions

Is offline KAOS weaker than the online version? No, the design goal of sovereign mode is full parity. All of the recon, assessment, exploitation, verification and defense agents run locally. The only difference is that in an air-gapped installation the live CVE query is off; in that case KAOS works with its local knowledge and learning brain. So there is no capability loss, only a deliberate choice of isolation.

Is it safe to use KAOS in terms of KVKK? Because in a sovereign installation no sensitive data scanned leaves the organization, KAOS works in compliance with data-sovereignty and KVKK requirements. Data is processed and stored where it is produced. This is a critical advantage for organizations that want to keep the processing location of personal and sensitive data under control. We plan the deployment and configuration together according to your compliance requirements.

Does sovereign mode require special hardware? KAOS is installed to run on the organization's own infrastructure; requirements vary with the scan scale and the chosen local model. In an air-gapped installation no internet access is needed at all. At DSET we plan the installation according to your existing infrastructure and security level, and determine the most suitable local configuration together.

Sources