The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Self-Score
Architecture Read
Five Free Policies
Deploy and Expand
Your gaps have numbers now.
Both phases are free. Read-only. No agents, no topology change. Five measured reads from your own production data — so every finding comes with a number, not a narrative.
Five measured reads from one assessment
Each section answers a question your board or auditor will ask. Every finding is measured from your data, not modeled from industry averages.
Egress coverage & NAT dependency map
Route-confirmed egress posture per VPC. Which workloads reach the internet uninspected, which security groups are wide open, and where NAT gateways create dependency — with replacement cost calculated.
Illustrative: 98% of workloads on unrestricted outbound. NAT replacement spend offset quantified.
Blast radius analysis (0–100)
Per-VPC blast radius scored and normalized. Three-direction analysis (ingress, egress, east-west). Each remediation tier scored on two time scales: how much blast radius it removes on the incident scale (minutes to days), and how long the removal holds on the decay scale (months to years).
Illustrative: Tier 1 remediations cut reachable exposure by 61% — independent of how you price the assets. Value and probability cancel in the improvement ratio.
Workload composition & serverless blind spots
Your estate broken into VMs, containers, VPC-attached serverless, and unattached serverless — each with a different relationship to network control. Overlapping CIDRs mapped where traditional firewalls can’t deploy.
Illustrative: 758 functions with no VPC attachment. Invisible to every network-layer control.
Prioritized remediation tiers
Every VPC classified by remediation effort: one-click (gateway present, redirect), two-click (deploy then redirect), or custom. Ranked by blast radius score so you start with the highest-impact, lowest-effort work.
Illustrative: 18 VPCs are one-click. These cover 62% of the blast radius.
Encryption posture & cleartext visibility
Traffic-measured cleartext volume split by direction. Which paths carry unencrypted data, where the enterprise controls key exchange, and where the provider does. The flow-log assessment delivers this from observed traffic alongside the config-snapshot analysis.
Risk scoring and remediation ranking — built into the assessment.
Every report comes with two instruments from the Blast Radius Economics framework. One prices the exposure. The other ranks every project that reduces it.
Reachable Value at Risk
Prices the exposure as V × R × P × T — what the system is worth, the share reachable from a compromise, the probability of compromise, and how long access persists. Compare before and after and the two most contested terms — value and probability — cancel. The improvement case rests entirely on reachability and containment time, both measured in your environment.
Already have system valuations from a cyber risk quantification exercise or insurance underwriting? Bring them. This assessment measures the two variables those frameworks assume but cannot observe — reachability and containment time.
Durable Risk Reduction
Scores every remediation project as (Reduction × Durability) ÷ (Effort + 3 × (Debt + Cost)) — how much blast radius the work removes and how long the removal holds, weighed against total cost of ownership. Containment remediations score highest because they are structural: removing a network path leaves nothing for an attacker to out-iterate. The permission is granted once, in a change window, and does not require reading the threat feed the next morning.
Annual revenue or IT budget?
Sets the dollar scale of what's at stake.
Data classification tier?
PII, PHI, financial, or IP — determines what a breach costs per record.
Regulatory framework?
HIPAA, PCI, SOX — determines mandatory compliance costs.
The improvement ratio ships with zero questions — value and probability cancel, so the before-and-after comparison rests on measured architecture alone. Three onboarding inputs — annual revenue, data classification tier, and regulatory framework — unlock dollar-denominated risk scores, or bring existing valuations from a FAIR assessment or insurance exercise.
Read-only. Agentless. No topology change.
A facilitated engagement that reads what your environment already produces. A read-only IAM role gives architecture visibility immediately.
Connect
A read-only IAM role: route tables, security groups, VPC configurations, workload inventory. All data you already produce. No agents, no topology change.
Analyze
Aviatrix maps your estate across five dimensions: egress coverage, blast radius per VPC, workload composition, attack surface by direction, and encryption posture. Delivered in a structured session.
Remediate
Every VPC classified by effort — one-click, two-click, or custom. Applications ranked by blast radius and criticality. Your roadmap starts with the highest-impact, lowest-effort tier.
Start with Containment Assessment Phase 1. Go deeper with Phase 2.
Both phases are free. Phase 1 is self-service — take it now. When you’re ready to measure the gaps it finds, schedule Phase 2: the Architecture Read.
Schedule · Phase 2 Architecture Read
Request your assessment.
Fill in the details below and our team will reach out to schedule your Phase 2 Architecture Read.
No spam. Reviewed within 1 business day.