What Is Your Reachable Value at Risk?

Summarize with:

ChatGPTClaudePerplexityGoogle AIGrok

Attacks now move faster than any team can detect them or patch the flaw behind them, so the control that decides the outcome is the one set in advance: which paths exist and what each workload can reach. That was the argument Aviatrix CEO Doug Merritt made at ONUG. They also gave networking leaders a number to bring to the board, Reachable Value at Risk, which puts a dollar figure on how far an attacker can reach and how long they have. 

Networking teams spent ten years watching the cloud take over their work while security budgets went to other teams. Doug argued that the decision has come back to them, because the paths an attacker uses after getting in are network paths. When prevention fails and detection is too slow, containment decides whether the incident becomes a catastrophic breach. 

Why the Old Math Stopped Working

Average eCrime breakout, the time from first access to moving into other systems, fell to 29 minutes in 2025, according to CrowdStrike. The average organization takes 247 days to identify and contain a breach, 183 to find it and 64 to contain it, according to IBM and the Ponemon Institute. No staffing plan closes a gap that wide. 

Working harder at remediation hasn't closed the gap, either. Qualys studied more than a billion remediation records for vulnerabilities in CISA's Known Exploited Vulnerabilities catalog. Organizations handled 6.5 times more critical vulnerabilities, yet the share still open after seven days rose from 56% in 2022 to 63% in 2025. 

The cloud also leaves the paths an attacker needs open by default. A new AWS security group allows all outbound traffic, and Kubernetes pods can reach each other until someone writes a policy. Wiz found that 72% of environments have publicly exposed PaaS databases without enough access control. 

These numbers mean that security strategies like “patch faster” and “detection first” are no longer enough on their own. 

The Three Jobs of the Network

Doug described three jobs that network teams have long agreed on: 

1. Encrypt data in motion 

2. Govern every path out 

3. Contain lateral paths, so one compromise stays contained 

Few enterprises finished the second and third jobs because one wrong rule could take down production. That fear kept default deny on the roadmap for years. 

Companies that run AI agents now apply the second job to their own systems. In August, CrowdStrike published the architecture it uses to contain its offensive AI agents, and the first of its seven layers is a network boundary where outbound traffic is denied by default. Anthropic reported a red-team test in which a malicious prompt led Claude Code to exfiltrate credentials in 24 of 25 retries, and the defense that held was control over what the agent could reach. A Number the Board Can Use 

Boards already price financial exposure as value at risk. Doug's Blast Radius Economics framework gives them a matching number for a cyberattack. Reachable Value at Risk or RVaR is the expected annual loss from what an adversary can reach: 

RVaR = V × R × P × T 

• V is what the system is worth. 

• R is the share of the system that a compromise can reach. 

• P is the probability of compromise this period. 

• T is how much the loss grows while access lasts. 

Here is how an organization determines these variables: 

• Finance builds V with the CFO.  

• Architecture owns R and T, the two terms a security program can change by design.  

• R comes from observed runtime flows, not from an architecture diagram, and the gap between them is a finding of its own.  

The result is a ranked list of business systems, not one score for the whole company. 

Doug encouraged attendees to compare their estates before and after containment, and value and probability appear on both sides of the ratio, so they cancel out. The two questions that stall most network budget requests, how likely is a breach and what is the data worth, no longer need an answer. What remains is how far an attacker can reach and how long they have, and both can be measured in your own environment. 

The framework pairs that measure with a second one, Durable Risk Reduction, which scores each project on how much Blast Radius it removes and how long the change holds against its full cost. For example, containing the crown-jewel production estate could score 1.00, while a detection-only visibility platform scores 0.06. 

What This Does and Doesn’t Measure

Reachable Value at Risk is a way to compare systems and rank investments, and its output is not actuarial truth. Containment limits how far one compromise spreads. It doesn't prevent the first break-in, and detection is still needed. 

Aviatrix builds containment, so weigh our interest accordingly. Aviatrix Clearance, a new offering on the Aviatrix Containment Platform, built on the Cloud Native Security Fabric, limits each cloud workload to the paths it needs, outbound and lateral. Every policy runs in monitor mode first, and a Shadow Rule Set shows what it would block on live traffic before anything is blocked. 

Where to Start with Reachable Value at Risk

Pick your most valuable system and ask two questions: what can it reach today, and how long would an intruder have before you contained them? The free, read-only Containment Assessment answers the first question for every workload your controller manages.  

Download the Blast Radius Economics whitepaper to learn more about Reachable Value at Risk and Durable Risk Reduction. 

References 

Amazon Web Services, "Security Group Rules," https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html  

Anthropic, "How We Contain Claude Across Products," May 25, 2026, https://www.anthropic.com/research/how-we-contain-claude  

Aviatrix, "Aviatrix Clearance," https://aviatrix.ai/products/aviatrix-clearance/  

Aviatrix, "Blast Radius Economics: One System, Two Instruments," October 2026, https://aviatrix.ai/resources/blast-radius-economics-whitepaper/.  

Aviatrix, "Containment Assessment," https://aviatrix.ai/containment-assessment/  

Aviatrix, "The Containment Era: Beyond Detection-First Security," https://aviatrix.ai/why-aviatrix/the-containment-era/  

CrowdStrike, "2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack Surface," Feb. 24, 2026, https://www.crowdstrike.com/en-us/press-releases/2026-crowdstrike-global-threat-report/  

CrowdStrike, "Secure Agent Harness Execution: Preventing Escape," Aug. 4, 2026, https://www.crowdstrike.com/en-us/blog/secure-agent-harness-execution-preventing-escape/  

IBM, "Cost of a Data Breach Report 2026," July 29, 2026, https://www.ibm.com/reports/data-breach  

Kubernetes, "Network Policies," https://kubernetes.io/docs/concepts/services-networking/network-policies/  

ONUG, "The Breach Is Decided in Your Network Before It Starts,” October 29, 2026, https://onug.net/events/the-breach-is-decided-in-your-network-before-it-starts-midday-keynote-presentation/  

Qualys, "The Broken Physics of Remediation," March 2026, https://assets.qualys.com/m/4fa63b802726a2c8/original/Qualys-TRU-The-Broken-Physics-of-Remediation.pdf  

Wiz, "Cloud Data Security Snapshot: Current Exposure Trends," https://www.wiz.io/reports/cloud-data-security-report-2025