Aviatrix Clearance · Customer proof

Every workload reaches only what it is cleared to reach.

The controls inside Aviatrix Clearance, Outbound Containment and Lateral Containment, are in production today at the enterprises on this page. Read how their security and network teams govern what each workload can reach across AWS, Azure, Google Cloud and on premises, in their own words.

When prevention fails and detection is too slow, containment decides whether the incident becomes a catastrophic breach.

Start the free Containment Assessment

Start from the question your board asks

Each card sets the filters below

Customers Who Trust Aviatrix for Their Cloud Networking & Security

Select a logo to jump to its story
Control 1

Outbound Containment

A workload reaches only the outside destinations it is cleared for.

Better logo

Better

Financial services

AWSAzure

Better, a homeownership company, found that native cloud tools gave it no security, visibility or control over the data leaving its workloads, and that a third-party firewall was hard to orchestrate. It put firewalling on all outbound traffic with one centralized policy, met its security and compliance requirements, and reduced its egress costs.

In Clearance terms

Firewalling on every outbound path, one policy for all of it, and a lower egress bill is what Clearance delivers as Outbound Containment. Safer and Affordable, measured against what Better ran before.

Read the Full Story
Without Aviatrix, Better would simply not be able to meet our security and compliance requirements.
Ali KhanChief Information Security Officer, Better
Control 2

Lateral Containment

A workload reaches only the other workloads it is cleared for, inside the cloud, on the paths perimeter tools never see.

Republic Airways logo

Republic Airways

Airline

Private data centersAWSAzure

Republic Airways, one of the largest regional airlines in North America, runs its hybrid network with a small team. It enforces segmentation and consistent policy across clouds and on premises, with microsegmentation across all environments. Real-time telemetry cut mean time to repair from days to under one hour, and hybrid throughput rose by about 150 Mbps with full encryption.

In Clearance terms

Segmentation and policy enforcement on every path between workloads, across two clouds and two data centers, is what Clearance delivers as Lateral Containment. A small team runs it, which is Simpler.

Read the Full Story
Having one unified architecture and the automation and orchestration that Aviatrix provides makes us faster and more agile.
Brent FowlerSenior Network Engineer, Republic Airways
Controls 1 + 2

Both controls on one platform

Outbound Containment and Lateral Containment are purchased together or in any order. This customer runs both.

Amundi Technology logo

Amundi Technology

Financial services

On premisesAzure

Amundi Technology, the technology business line of Europe’s leading asset manager, runs production on premises and in Azure. On one platform it runs internet egress filtering by domain name, segmentation between virtual networks and multi-region transit, deployed with Terraform and watched from a single console.

In Clearance terms

Egress filtering by domain name is Outbound Containment. Segmentation between virtual networks is Lateral Containment. Amundi runs both on one platform, as code, and the next step in the quote, deeper segmentation, is what purchased together or in any order looks like from the customer’s side.

Read the Full Story
While we are already running a solid foundation supporting enterprise business-critical services and workloads in multiple regions, we also have significant work in progress to enhance Terraform usage, enforce deeper network segmentation, and leverage new Aviatrix features around network security orchestration.
Thomas MouilleseauxGlobal Head of IT Network, Unified Communication & Market Data, Amundi Technology
Deployment · Stage 1

See before you enforce

Visibility into every workload and every path comes before any policy is written. It is the first stage of a Clearance deployment.

AB InBev logo

AB InBev

Manufacturing

Multiple cloud providersOn premises

AB InBev, the largest brewer in the world, runs 80 percent of its infrastructure in the public cloud across major and regional providers and on-premises systems. One control plane gives it visibility across the whole environment, and address translation resolved the IP conflicts that came with acquisitions.

In Clearance terms

Seeing every workload and every path across every provider from one place is See, and it is where a Clearance deployment begins.

Read the Full Story
The Aviatrix Control Plane is one of the key features we value because of the visibility it provides across the entire environment.
Manaswinee MohantyDirector of DevOps and Cloud Engineering, AB InBev
IHG Hotels & Resorts logo

IHG Hotels & Resorts

Hospitality

AWSGoogle Cloud

IHG Hotels & Resorts runs more than 6,000 hotels in over 100 countries on AWS and Google Cloud. One transit architecture gives it multi-region connectivity, automated route propagation, firewall service insertion and global visibility, with encrypted links across both clouds.

In Clearance terms

One view of every path across two clouds is See. One place to insert enforcement on those paths is Insert. Clearance runs on the same one policy plane across every cloud.

Read the Full Story
And if you don’t have a single pane of glass to see that entire network and be able to route accordingly, it’s going to be a zoo.
Eric NormanHead of Infrastructure, Architecture, and Innovation, IHG Hotels & Resorts
Heineken logo

Heineken

Beverages

Heineken’s connectivity team describes the result in one line.

In Clearance terms

Comprehensive visibility with less complexity is See, and Simpler.

Read the Full Story
Aviatrix empowered us with intuitive tools and comprehensive visibility, enabling us to stay on track while minimizing complexity.
Edwin VenhuizenProduct Owner Connectivity, Heineken
Deployment · Operate

Operate as code

A policy change is deployed the way application code is deployed, and the same policy reaches every workload at once.

GN logo

GN

Manufacturing, under medical regulation

Azure

GN, a maker of hearing, audio, video and gaming technology, runs its Azure network with a team of two. It has granular segmentation, centralized firewall insertion and flow-level visibility, all deployed with Terraform.

In Clearance terms

Segmentation written as code and pushed everywhere at once is how Clearance is operated. One policy, every workload, run by two people.

Read the Full Story
Previously, we’d have to hand-configure everything. By the time you’d get to the Nth device, you’d be tired and miss something. With Aviatrix, it’s all done by code, and we know that the same configurations are being pushed everywhere.
Søren Stentoft HansenDirector of IT Security & Network, Group IT, GN
The Aviatrix Containment Platform

The fabric Clearance runs on

Aviatrix Clearance runs on the Aviatrix Containment Platform, built on the Cloud Native Security Fabric. These enterprises run the fabric today, and their numbers are the platform’s claims. Simpler and faster than what they ran before, in production across every major cloud.

PipelineRx logo

PipelineRx

Healthcare

AWS

PipelineRx, a cloud pharmacy platform, exchanged health data over VPNs and a transit gateway, hit routing prefix limits and IP conflicts, and after an acquisition faced data spread across several clouds. One management plane lets its DevOps team run the network and resolve issues in hours rather than days.

In Clearance terms

No appliance to route through and no specialist to hire. Simpler.

Read the Full Story
Aviatrix gave us simple, scalable, centralized management capabilities for all our VPNs and all our data. It gave our DevOps team a vehicle for easily managing the operations of the network in the cloud without locking us into a specific appliance or specialized engineering skillset.
Darren LombardiDevOps Engineer, PipelineRx
RheinEnergie logo

RheinEnergie

Energy

AWSAzureGoogle Cloud

RheinEnergie, a German energy provider retiring nearly all on-premises applications by 2030, runs three clouds and its data centers on one secure backbone. Connections that took weeks take hours, and business-critical applications gained a 10x performance improvement.

In Clearance terms

One way across three clouds and on premises. Simpler, and Faster.

Read the Full Story
We didn’t want an Azure solution, plus an AWS solution, plus a Google Cloud solution, plus legacy on-premises VPN routers to build our infrastructure. We wanted a single way to easily connect and manage all of these environments.
Erik SchubertIT Service Architect, RheinEnergie
HAPEV logo

HAPEV

Financial services

AWSAzure

HAPEV, a German pension provider administering over one million pension and retirement accounts, runs AWS and Azure from one management plane with infrastructure as code.

In Clearance terms

The infrastructure for a new workload in under an hour. Faster.

Read the Full Story
With the Aviatrix IaC capabilities, our DevOps team can configure the infrastructure for new workloads in less than an hour.
Radu AlexaNetwork & Security Engineer, HAPEV
Inmarsat logo

Inmarsat

Telecommunications

AWS

Inmarsat, a global satellite communications company, moved workloads off aging data centers and needed to place its firewalls between the cloud segments that required inspection. It deployed the transit and the firewall insertion in an afternoon and migrated every VPC the next day.

In Clearance terms

Enforcement inserted between segments without a redesign, in an afternoon. That is Insert, the second stage of a Clearance deployment, and Faster.

Read the Full Story
The Aviatrix solution provides us a scalable, repeatable way to design where new pods of connectivity can be onboarded in minutes and we can easily insert our firewalls between segments of the cloud that require the extra security.
Sheldon ParsonsSenior Network Engineer, Inmarsat
March 2026 · TeamPCP supply chain campaign

Containment under live attack

In March 2026, during the TeamPCP supply chain campaign, one Aviatrix customer, a Fortune Global 500 enterprise, was running the compromised LiteLLM package in its AI development environment. Its security team identified four command-and-control addresses associated with the campaign. An infrastructure engineer added them to one existing policy. The policy propagated to every gateway across the company’s cloud footprint, every VPC and every region, including the Kubernetes clusters running LiteLLM. Within minutes the deny logs showed compromised pods attempting to reach those addresses, and every attempt was blocked. Zero credentials were exfiltrated.

The engineer did not know what the addresses were connected to when he blocked them. The architecture was already in place and it did the work. That is Outbound Containment under live attack. The full account is in the Aviatrix paper 144 to 1. When prevention fails and detection is too slow, containment decides whether the incident becomes a catastrophic breach.

  1. 1Compromised LiteLLM packagerunning in the AI development environment
  2. 24 command-and-control addressesidentified by the security team
  3. 3Added to 1 existing policyby an infrastructure engineer
  4. 4Propagated to every gatewayevery VPC, every region, including the Kubernetes clusters running LiteLLM
  5. 5Deny logs, within minutescompromised pods attempted to reach those addresses, and every attempt was blocked. Optional
  6. ✓0credentials exfiltrated

See what a compromised workload in your cloud can reach today.

Start with the free Containment Assessment. It takes five minutes. Aviatrix Clearance is free to every enterprise through May 1, so you have time to patch.

Trusted by more than 500 of the world's leading enterprises.

About Aviatrix

Aviatrix® is the network containment company. The Aviatrix Containment Platform sets what every cloud workload may reach before any attack, so a compromised workload does not become a company-wide breach. Built on the Cloud Native Security Fabric, it enforces that policy in the network, at every workload and in every cloud, with nothing to install and nothing to detect first, and encrypts the traffic it allows. It is simpler, safer, faster and less costly than the firewalls and agents it replaces. The Cloud Native Security Fabric is quantum safe. Trusted by more than 500 of the world's leading enterprises. For more information, visit aviatrix.ai.