Aviatrix Threat Research Center
144 to 1

The security industry perfected protecting one.
The other 144 are on their own.

1
Human Identity
VS.
144
Machine Identities
97%
have excessive privileges
60%
of containers live <60 seconds
42%
have privileged access
* Statistics sourced from the NHI & Secrets Risk Report H1 2025 by Entro Security.
User-Centric Zero Trust
ZTNA · SASE · EDR · IAM
🔑
Identity & MFA
SSO, conditional access, behavioral analytics
🌐
SASE / Secure Web Gateway
User-to-app traffic inspection
💻
Endpoint Detection
Agent on laptop, not on container
🔐
Access Governance
Who can access which application
Protects the User → App Path
Cloud Security Posture
CNAPP · CSPM · CWPP
🔍
Vulnerability Scanning
Finds CVEs in packages & images
⚙️
Misconfiguration Detection
Exposed S3, open ports, IAM risks
🗝️
Secret Exposure
Finds leaked keys & credentials
📊
Compliance Reporting
Posture dashboards & audit trails
Finds the Problem · Does Not Stop It
🛡️
Workload-Centric Zero Trust
Distributed Cloud Firewall · CNSF
⚡
Distributed Enforcement
Policy at every gateway, every workload
🌍
Global IP Blocklist
One rule → every VPC, every region, instantly
🔒
Egress Governance
Every path the workload can reach
📋
Forensic DENY Logs
Which pod, which IP, what time
Governs Every Workload Path · Stops Exfiltration
"We Have Egress Filtering" — But Does It Govern These Paths?
User-Centric Stack
✕ K8s pod egress via node NAT
✕ Serverless function egress
✕ East-west between VPCs
✕ Instant global policy propagation
CNAPP / Posture Tools
— No egress filtering capability
— No runtime enforcement
— Scan-time detection only
— Alert after the fact
Distributed Cloud Firewall
✓ K8s pod egress — enforced at workload
✓ Serverless — fabric-level governance
✓ East-west — every gateway enforces
✓ One policy → universal propagation
User-Centric Zero Trust and Cloud Security Posture are necessary.

The attack model changed. Threats arrive as trusted code, running inside your infrastructure. The only question that matters: can the workload reach the attacker's endpoint? That question is answered by Workload-Centric Zero Trust.

Read the full blog: 144 to 1 Read the Case Study →
Cloud Native Security Fabric