Default-Deny without an Outage: A Demo from ONUG

Summarize with:

ChatGPTClaudePerplexityGoogle AIGrok

Yesterday at the ONUG conference, Aviatrix Chief Product Officer Chris McHenry took the Yellow Theater for a Triple-T for a live demo of Aviatrix Clearance, a new offering on the Aviatrix Containment Platform, built on the Cloud Native Security Fabric: default deny enforcement that does not cause an outage.  

As Chief Product Officer at Aviatrix, Chris leads product strategy and development for the Cloud Native Security Fabric. His work centers on a practical question facing every enterprise that runs AI in the cloud: when a workload or AI agent is compromised, how far can it reach? He demoed a solution that contains agents with default-deny without compromising production.  

Default Deny is the Best Strategy, But It Could Break Production 

Evidence is piling up that prevention and detection, two pillars of cloud network security, are no longer fast enough to prevent compromised AI agents from causing security incidents. As Mandiant found recently, the median time to exploit a newly disclosed vulnerability is now negative 7 days. CrowdStrike also found that 82% of intrusions are malware-free, meaning they used valid credentials and trusted pathways. We can't detect or patch fast enough when threats look like authorized traffic.  

AI agents have accelerated the urgency because they don't follow traditional rules. They are often highly-privileged, ephemeral, and unpredictable, able to evade normal security policies and reach destinations they should not.  

Security leaders have known for a long time that default-deny policy enforcement is the best way to limits how far one compromise spreads. Unfortunately, it’s difficult, expensive, and dangerous to implement because one false step could block a legitimate connection and take down production. No one wants to harm business revenue as part of a security project that will only be successful if nothing happens. While many are trying to implement default-deny enforcement and contain outbound traffic and lateral movement, rapid network and application changes and the daily demands of the business cause those projects to stall and fail.  

Aviatrix Clearance: Monitor, then Enforce 

We designed Aviatrix Clearance to answer those concerns by equipping security teams to monitor before enforcing and limit the blast radius of what a compromised workload can reach.  

Chris's demo showed how Aviatrix Clearance limits each cloud workload to the paths it needs, outbound and lateral. Outbound Containment means a workload can reach only the outside destinations it is cleared for, named by domain. Lateral Containment means it can reach only the other workloads it is cleared for, down to a single pod, function or database. Intrusion prevention comes with both. Every policy runs in monitor mode first, and a shadow rule set shows what it would block on live traffic before anything is blocked. Enforcing is one action, and so is backing out. 

Aviatrix Clearance is free to every enterprise across its whole cloud estate from November 1, 2026 through May 1, 2027, with no workload cap.

• Learn how to join the Clearance Incident Response program. 

• See Aviatrix Clearance in action.