The network containment company

Know what every workload reachesClear what it needs, block everything else

Aviatrix sets what every cloud workload may reach before any attack, in the network, with nothing to install on the workload, so a compromised workload does not become a catastrophic breach.

500+ enterprises run the Aviatrix Containment Platform. Aviatrix will make you safe and more secure.

How far can one breach go?

About 0 workloads across 200 VPCs and VNets.In the peer estates we assessed, 82–99% of workloads could reach the internet without restriction, and 91–100% of network paths were open on admin ports.

Estimate yours
What Is Aviatrix Clearance

Set what every workload may reach before any attack

Aviatrix Clearance gives every cloud workload a cleared list of what it may reach, Outbound Containment to egress internet traffic and Lateral Containment between workloads. Everything else is blocked, enforced in the network with nothing to install on the workload.

Every workload

VMs, serverless functions, databases and platform services get the same clearance, by identity, across every cloud.

Kubernetes workloads

Policy follows the pod rather than the node address, and pod egress through node NAT is governed like any other path.

AI agent workloads

Every agent is discovered from flow and DNS, including the ones no one authorized, and cleared for its own job rather than its neighbor’s.

Explore Aviatrix Clearance

Aviatrix Active Defense capabilities come to Aviatrix Clearance in the first quarter of 2027.

BLAST RADIUSDEFAULT DENYcalls homeWorkloadcompromised packagecleared pathsnever left the estateInternet
Customer Verified

A compromised package called home and got nowhere

A supply-chain compromise inside a customer’s AI stack beaconed out to the internet. Default-deny outbound at the workload held, the connection never left the estate, and the blast radius stayed at the paths that workload was cleared for. That is Outbound Containment, and it ships in Aviatrix Clearance.

Read the account
Clearance Incident Response

Three incidents this month. One pattern.

  • php2shell, a pair of critical flaws in the software that runs a large share of the world's websites, was under attack four days before its fix shipped.

  • eMudhra put weak certificate keys into wide use.

  • LiteLLM was compromised for the second time this year, and the payload harvested every AI provider key the gateway held.

Our own Controller runs PHP. It was affected and patched on October 27, and the advisory is here (opens in a new tab).

None of this is patched in a day. Aviatrix is making Aviatrix Clearance free to every enterprise, outbound, lateral and intrusion prevention, through May 1, 2027, so teams have time to patch with a containment backstop in place.

Know your Blast Radius in 60 seconds

The estimate runs in your browser with nothing to deploy. Then get it measured from your own configuration with the free Containment Assessment.