The need to secure IT infrastructures without compromising performance or operational fluidity is creating more and more tension within IT teams.
Physical isolation (or air gap) has long been the default method of meeting the need for security; VDI (Virtual Desktop Infrastructure) was supposed to simplify it, but often did not keep its promises in terms of performance, cybersecurity, or user experience.
In a recent recommendationANSSI indicates that the workstation itself can become the place where insulation is applied and verified. Today, hardware and virtualization technologies are reaching a maturity that allows for real change, through multi-environment workstations.
The costs of security that is too rigid and complex
Modern work has become more mobile and collaborative: IT professionals are constantly switching contexts, collaborating with external partners, and accessing sensitive resources from multiple locations.
Many pentesters, for example, travel with multiple computers dedicated to different clients or projects. They may have to juggle three or four physical workstations to meet the strict isolation rules required for effective cybersecurity. Safety is certainly preserved, but ergonomics are significantly degraded and productivity hampered. The paradox is clear: an approach designed to protect businesses makes the daily lives of professionals heavier.
Operations and maintenance teams encounter another challenge: they often operate in areas where connectivity is poor or non-existent. They must access voluminous technical documentation, sensitive configurations or industrial dashboards without being able to rely on 4G, Wi-Fi, or remote desktop. They therefore work either blindly or using insecure portable devices that can be used offline – certainly practical, but which introduce new risks.
For IT and security administrators, each additional computer or device represents one more system to maintain, one more update cycle to follow, one more endpoint to monitor.
Physical isolation therefore encounters limits linked to the evolution of work practices, because it slows down collaboration between teams in a context where it should be fluid and flexible. As for VDI, it is simply incompatible with operational constraints.
Integrate security and simplicity “by design”
A crucial question therefore arises: how to simplify the daily lives of teams while offering the same security guarantees as separation?
A multi-environment workstation can provide the answer, provided that demanding design principles are followed, including component and domain isolation, encryption, updates and documentation.
These principles align with ANSSI guidelines for terminal segmentation and isolation, and provide a framework that meets the most stringent regulatory requirements. Where traditional physical isolation has long been the standard for securing critical systems, multi-environment desktops shift this paradigm to the endpoint itself. They maintain a strict separation between environments while bringing them together on a single station. Isolation remains total, but mobility, ergonomics and IT visibility are realigned with the realities of modern work, including in the most sensitive environments.
The result is a leaner, more agile operating model: fewer devices to certify, simplified compliance processes, and restored visibility. By integrating isolation directly at the endpoint level, organizations regain governance and control, without the hassle of multiple devices.
Hardware security comes back to center
Cybersecurity strategies have long favored software, relegating the hardware layer to secondary importance. Multi-environment workstations require a re-evaluation of this approach: to ensure robust isolation, security must now be anchored in the hardware.
An effective approach can be based on a type 1 hypervisor, combined with a measured boot chain, a hardware root of trust and a minimal Trusted Computing Base (TCB). These mechanisms cover all hardware and software protections, ensuring that each environment has its own trust and connectivity assumptions.
This approach to securing a workstation “by design” makes it possible to make hardware security a strategic pillar. For administrators, the computer becomes a verifiable platform, whose integrity can be attested. The attack surface is reduced, and cross-domain failures limited. Developers gain autonomy, OT, industrial or maintenance operators finally have a single device capable of simultaneously hosting several environments and applications.
Multi‑environment workstations therefore mark a turning point in the isolation of sensitive environments, and a giant step forward for companies in their regulatory compliance. The paradigm is evolving towards a situation that allows them to evolve with the least possible compromise between security, performance and ergonomics.
