The Containment Platform
Detection tells you something happened. Containment ensures it doesn't matter. CNSF is the first platform built from the principle that blast radius is the metric that matters.
- C
Contain first. Communication Governance enforces policy at every workload, every path. Blast radius is limited before any alert fires.
- D
Detect with context. Anomalous communication is identified against a baseline of governed behavior, not guessed from raw traffic.
- E
Eliminate surgically. Compromised workloads are isolated and remediated. The blast radius was already contained.
Chokepoint Security vs. Communication Governance
Every security architecture makes a structural bet. Chokepoint bets traffic will route through a single enforcement point. Containment enforces at every workload, every path.
Chokepoint Security
Governs only traffic that traverses the inspection point
Kubernetes pod egress, serverless, VPC peering bypass the chokepoint entirely
Single enforcement point becomes a single point of failure and a scaling bottleneck
Blast radius is unlimited for traffic that never reaches the chokepoint
Communication Governance
Enforces policy at every workload, every path, every cloud
No traffic bypasses enforcement because enforcement lives where the workload lives
Distributed enforcement scales with the workload fleet, not against it
Blast radius is structurally limited. Every workload is contained by default.
Chokepoint Security vs. Containment Architecture
A chokepoint governs the traffic that routes through it. Communication Governance governs every path.
Transit
Firewall
Transit
Firewall
Detailed Comparison
| Dimension | Chokepoint Security | Containment Architecture |
|---|---|---|
| Enforcement Point | Central transit firewall | Every workload |
| K8s Pod Egress | Invisible | Governed |
| Serverless Functions | Invisible | Governed |
| East-West Traffic | Depends on routing | Governed |
| Policy Propagation | Hours/days per device | Subsecond, universal |
| Blast Radius | Network-wide | Single workload |
"The distinction is not 'egress filtering vs. no egress filtering.' The distinction is where the enforcement lives."
Five Properties of a Containment Platform
Containment is the architectural enforcement of explicit communication policy at every workload — governing what it can reach and what can reach it, at the granularity of workload identity and protocol — on every path available to it, independent of whether a compromise has been detected.
Path-complete
01Enforcement governs every communication path, including those that bypass centralized inspection.
Identity-aware at Layer 7
02Policy operates at workload identity and application protocol, not IP addresses and ports.
Detection-independent
03Enforcement holds before, during, and after a breach without requiring detection.
Platform
Compute-model agnostic
04Enforcement reaches every workload type without requiring agent installation.
Universally propagated
05A single policy enforces across providers, regions, and clusters in subseconds.
Platform
Path-complete
Enforcement governs every communication path, including those that bypass centralized inspection.
Identity-aware at Layer 7
Policy operates at workload identity and application protocol, not IP addresses and ports.
Detection-independent
Enforcement holds before, during, and after a breach without requiring detection.
Compute-model agnostic
Enforcement reaches every workload type without requiring agent installation.
Universally propagated
A single policy enforces across providers, regions, and clusters in subseconds.
Three Gaps Detection Cannot Close
The detection-era security model was built for a world of persistent workloads, centralized traffic flows, and human-speed attacks. That world no longer exists.
The Fragmentation Gap
Enterprise clouds run across 3+ providers, each with different security primitives, different policy languages, and different enforcement planes. No single pane of glass governs communication across all of them. Workloads talk freely across boundaries no one monitors.
The Runtime Enforcement Gap
Containers exist for seconds. Serverless functions execute and vanish. AI inference workloads scale to thousands of instances and collapse. Security models that require agent installation, identity enrollment, and human review take longer than the workload lives.
The Ownership Gap
Cloud providers secure the infrastructure. But the shared responsibility model places interior security squarely on the tenant. 144 machine identities exist for every 1 human identity. The majority are ungoverned. The interior is open because no one built the walls.
Contain First.
Then Everything Else.
Detection-era tools detect, then attempt to contain. CNSF inverts the sequence. Containment is the starting state. Detection and elimination operate inside an already-contained environment.
Contain
Communication Governance enforces workload-level policy before any breach occurs. Every workload has an identity. Every path has a rule. Blast radius is structurally limited from the start.
Detect
With communication governed, anomalous behavior stands out against a clean baseline. Detection operates with signal, not noise. The governed environment makes the ungoverned visible.
Eliminate
Compromised workloads are surgically isolated and remediated. Because containment was already in place, the blast radius was limited before elimination began. Recovery is a bounded operation.
Closing the Divide Requires New Architecture
Extending perimeter firewalls or piling on endpoint agents won't address the root cause. Containment architecture requires four structural capabilities.
Real-Time, Inline Enforcement
Policy must be enforced inline, in real time, before lateral movement begins. Post-hoc detection and response is structurally too late. The wall must exist before the breach, not after the alert.
Unified Policy Across All Constructs
One policy language across VMs, containers, serverless, and AI workloads. Across AWS, Azure, GCP, and OCI. Define once, enforce consistently. No cloud-specific translation layers.
Workload-Agnostic by Design
Enforcement must work regardless of workload type, lifespan, or orchestration platform. A container that lives for 30 seconds gets the same policy as a VM that runs for three years.
Distributed Enforcement, Centralized Intent
Policy intent is defined centrally. Enforcement is distributed to every workload. The architecture scales with cloud velocity instead of fighting it. No traffic hairpinning. No bottlenecks.
Enforcement
Beyond the Perimeter
CNSF does not replace your perimeter security. It extends enforcement to the places your perimeter cannot reach: interior east-west traffic, cross-cloud paths, and ephemeral workloads.
Multicloud Governance
Unified policy across AWS, Azure, GCP, and OCI. One policy language. One enforcement plane. No cloud-specific workarounds.
Distributed Cloud Firewall
Workload-level enforcement that travels with the workload. No traffic hairpinning. No centralized bottleneck. Policy enforced where the workload lives.
SmartGroups & Identity
Policy defined by what a workload IS, not where it sits. Tags, roles, and attributes create dynamic groups that adapt as the fleet changes.
Perimeter Integration
Works alongside Palo Alto Networks, Fortinet, and Check Point. Your perimeter handles north-south. CNSF governs everything inside.
See Your Blast Radius
The Workload Attack Path Assessment maps your current exposure and shows exactly where containment changes the outcome.