Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack
STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

  • A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
  • What attackers exploited, and which enforcement gaps let them move.
  • Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Kill Chain Coverage
ATT&CK Mapped
Real-World IOCs
Graphic-for-second-Salt-Typhoon-blog-2
Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Displaying 1261 to 1272 of 6868 threat reports

Anthropic Claude Users Targeted in Multi-Platform Infostealer Campaign
Computer Software/Engineering2 months ago

Anthropic Claude Users Targeted in Multi-Platform Infostealer Campaign

In August 2026, Anthropic detected unauthorized access to Claude AI accounts after threat actors used multiple infostealer malware variants including Vidar, Lumma, StealC, RedLine, Acreed, and Atomic Stealer to harvest user session cookies and authentication tokens. The attackers bypassed multifactor authentication by stealing active browser sessions rather than credentials, allowing them to consume users' Claude usage quotas and access saved payment information. Anthropic responded by forcibly signing out affected users, removing payment methods, and refunding unauthorized charges. This incident exemplifies the growing shift from credential-based attacks to session hijacking, as organizations strengthen password policies and MFA adoption. The attack highlights emerging threats against AI platforms and the need for enhanced session management controls in cloud-native applications.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Langflow and Rails Vulnerabilities Enable Widespread Credential Harvesting Campaign
Computer Software/Engineering2 months ago

Critical Langflow and Rails Vulnerabilities Enable Widespread Credential Harvesting Campaign

In August 2026, threat actors launched widespread exploitation campaigns targeting two critical vulnerabilities: CVE-2026-0768 in Langflow (CVSS 9.8) enabling arbitrary Python code execution as root, and CVE-2026-66066 in Ruby on Rails (CVSS 9.5) allowing file disclosure and remote code execution through Active Storage image processing flaws. VulnCheck recorded over 360 detections within days, with attackers primarily originating from Russia conducting credential harvesting, environment variable enumeration, and deploying cryptocurrency miners and remote access tools across vulnerable AI development platforms. This incident highlights the growing threat landscape targeting AI infrastructure and development platforms, as organizations increasingly deploy AI applications without proper security controls, creating new attack surfaces that threat actors are rapidly exploiting for credential theft and lateral movement.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Russian APT UAC-0099 Exploits AI Security Tools with GuardBreaker Prompt Injection
Computer Software/Engineering2 months ago

Russian APT UAC-0099 Exploits AI Security Tools with GuardBreaker Prompt Injection

In September 2026, ESET researchers disclosed a new technique called GuardBreaker employed by Russia-aligned threat actor UAC-0099 against Ukrainian targets. The attack involved embedding provocative text about nuclear weapons creation into malicious VBS scripts to deliberately trigger AI safety mechanisms and prevent automated analysis. The technique aims to force large language models into refusal states, allowing malware like the MATCHBOIL loader to evade AI-assisted security workflows. This represents a sophisticated evolution in adversarial prompt injection, specifically designed to exploit the safety guardrails of modern AI security tools. This incident highlights the growing threat of AI-targeted evasion techniques as organizations increasingly rely on automated security analysis. With AI copilots and LLM-based scanners becoming standard in security operations, attackers are developing specific countermeasures to blind these systems, creating new vulnerabilities in modern defense strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Critical Privilege Escalation Flaw Exposes Industrial Control Systems to Complete Compromise
Industrial Automation2 months ago

Critical Privilege Escalation Flaw Exposes Industrial Control Systems to Complete Compromise

A critical privilege escalation vulnerability (CVE-2026-16675) was discovered in Rockwell Automation's FactoryTalk Activation Manager V5.02 and below, affecting industrial control systems worldwide. The vulnerability allows authenticated attackers to hijack console windows during installation or repair operations, escalating from standard user privileges to SYSTEM-level access with complete control over affected systems. This poses significant risks to critical manufacturing infrastructure, as attackers can access all files, processes, and system resources once exploited. This vulnerability highlights the ongoing security challenges facing industrial control systems as manufacturing environments become increasingly digitized and interconnected, making them attractive targets for cybercriminals and nation-state actors seeking to disrupt critical infrastructure operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Critical Privilege Escalation Vulnerabilities Discovered in Rockwell Automation Industrial Systems
Industrial Automation2 months ago

Critical Privilege Escalation Vulnerabilities Discovered in Rockwell Automation Industrial Systems

In September 2026, CISA disclosed two critical privilege escalation vulnerabilities (CVE-2026-9633 and CVE-2026-9634) in Rockwell Automation's Redundancy Module Configuration Tool affecting versions 9.00.00 through 10.00.00. The vulnerabilities stem from incorrect default permissions that allow the tool's executables to search for required DLLs in directories writable by standard users. If exploited, local attackers can place malicious DLLs in these directories, which are then loaded with Administrator/SYSTEM privileges when the tool is run by an administrator. Rockwell Automation has released version 10.01.00 to address these issues, affecting critical manufacturing infrastructure worldwide. This incident highlights the persistent threat of DLL hijacking attacks in industrial control systems, particularly as organizations modernize their operational technology environments. With increasing convergence of IT and OT networks, such privilege escalation vulnerabilities pose significant risks to critical infrastructure security and operational continuity.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Critical DoS Vulnerability Exposes Rockwell Automation Industrial Controllers to Remote Attack
Automotive2 months ago

Critical DoS Vulnerability Exposes Rockwell Automation Industrial Controllers to Remote Attack

A critical denial-of-service vulnerability (CVE-2026-9637) affects multiple Rockwell Automation Logix Platform controllers including ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, and Compact GuardLogix 5380 systems. The vulnerability stems from improper validation of input length during Common Industrial Protocol (CIP) message processing, allowing remote attackers to trigger a major nonrecoverable fault (MNRF) that requires a complete power cycle to restore operations. Affected versions span firmware releases up to V33 and specific ranges in V34-V36 branches, impacting critical manufacturing infrastructure worldwide. This vulnerability highlights the ongoing targeting of industrial control systems and the critical need for robust OT security measures. As industrial networks become increasingly connected and Nation-state actors continue to probe critical infrastructure, vulnerabilities in widely-deployed platforms like Rockwell's Logix controllers represent significant national security and operational continuity risks that require immediate attention.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
METR Breach Exposes New AI Infrastructure Attack Vectors Worth $600K
Computer Software/Engineering2 months ago

METR Breach Exposes New AI Infrastructure Attack Vectors Worth $600K

In March 2026, attackers exploited a fail-open authentication vulnerability in METR's publicly accessible AI research infrastructure to steal API keys and consume approximately $600,000 worth of AI model credits. The breach occurred when a researcher's EC2 instance running agent orchestration software inadvertently exposed authentication-protected endpoints to the public internet for several days. Attackers likely discovered the vulnerable system through certificate transparency monitoring and automated scanning for AI-related infrastructure, then directly prompted the exposed AI agent to reveal its API credentials before establishing persistent access. A second incident in May 2026 involved sustained probing of METR's infrastructure and exploitation of an inadvertently exposed SQL query endpoint that could have provided access to sensitive AI evaluation data. This incident highlights the emerging attack surface created by AI research infrastructure and the growing threat of credential harvesting targeting AI model providers. As organizations increasingly deploy AI agents and automated systems, the combination of high-value API access, complex authentication chains, and rapid development cycles creates new opportunities for financially motivated attackers to exploit cloud misconfigurations for significant monetary gain.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
The Rise of Repeatable Cybercrime: How ClickFix Became 2026's Dominant Attack Vector
Financial Services2 months ago

The Rise of Repeatable Cybercrime: How ClickFix Became 2026's Dominant Attack Vector

In 2026, cybercriminals have shifted from developing sophisticated new attack methods to perfecting repeatable, scalable procedures that work consistently across targets. Microsoft's threat intelligence team identified ClickFix as the most common initial access method, accounting for 47% of observed attacks. This social engineering technique tricks users into executing malicious commands by placing them on their clipboard through deceptive web pages. Bitdefender's analysis of 700,000 security incidents revealed that 84% of high-severity breaches involved legitimate administrative tools already present on victim systems, demonstrating the widespread adoption of 'living off the land' tactics. This trend represents a fundamental evolution in cybercrime business models, where threat actors prioritize operational efficiency over technical innovation. The shift coincides with declining ransom payments and increased victim volumes, forcing attackers to optimize for cost-effectiveness and repeatability rather than sophistication.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Denial of Service Vulnerability Exposes Rockwell Automation Industrial Controllers
Industrial Automation2 months ago

Critical Denial of Service Vulnerability Exposes Rockwell Automation Industrial Controllers

Rockwell Automation disclosed CVE-2021-42260, a high-severity denial of service vulnerability affecting ControlLogix, CompactLogix, GuardLogix, and Compact GuardLogix controllers. The vulnerability, with a CVSS score of 7.5, allows attackers to trigger an infinite loop condition through corrupt crafted data, causing major nonrecoverable faults (MNRF) in safety controllers and requiring program downloads for recovery. The flaw impacts multiple firmware versions across the 34.x, 35.x, 36.x, and 37.x series, affecting critical manufacturing infrastructure deployed worldwide. This vulnerability highlights the ongoing risks to operational technology environments where denial of service attacks can cause significant operational disruption. As industrial control systems become increasingly connected and targeted by threat actors, vulnerabilities like CVE-2021-42260 demonstrate the critical need for robust OT security measures and timely patch management in manufacturing environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
The Coding Agent Trap: How Rogue AI Endpoints Became the New Supply Chain Threat
Computer Software/Engineering2 months ago

The Coding Agent Trap: How Rogue AI Endpoints Became the New Supply Chain Threat

In August 2024, security researchers documented a novel supply chain attack where threat actors discovered exposed LLM inference endpoints, relabeled them with popular model names like DeepSeek, and distributed them as 'free' alternatives to attract AI coding agents. A honeypot captured a real coding agent session from China that transmitted 88 messages containing filesystem data, PowerShell command outputs, and tool manifests to an untrusted endpoint. The malicious endpoint operator could have responded with tool calls to execute arbitrary commands, read sensitive files, or exfiltrate data from the victim's machine without exploiting vulnerabilities. This represents a new attack vector where AI agents voluntarily connect to rogue infrastructure, exposing their capabilities and local environment data through normal inference requests with tools enabled and permissive configurations. This incident highlights the emerging risks as AI coding agents become mainstream development tools, with threat actors adapting traditional supply chain tactics to target autonomous systems that can execute code and access filesystems based on remote model responses.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical DOS Vulnerabilities Threaten Rockwell Automation RSLinx Classic Industrial Systems
Industrial Automation2 months ago

Critical DOS Vulnerabilities Threaten Rockwell Automation RSLinx Classic Industrial Systems

Four critical denial-of-service vulnerabilities (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) were discovered in Rockwell Automation's RSLinx Classic versions 4.50 and earlier. These vulnerabilities allow attackers to crash the RSLinx Classic service by sending specially crafted CIP packets, exploiting integer overflow, integer underflow, and buffer overflow conditions. The vulnerabilities affect critical manufacturing infrastructure worldwide and require service restarts to recover, potentially disrupting industrial operations and production systems. These vulnerabilities highlight the growing threat landscape facing industrial control systems as cybercriminals increasingly target critical infrastructure. With the rise of nation-state actors and ransomware groups focusing on OT environments, securing industrial communication protocols like CIP has become paramount for operational resilience.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Critical Vulnerabilities Expose Rockwell Automation Industrial Systems to Remote Attacks
Industrial Automation2 months ago

Critical Vulnerabilities Expose Rockwell Automation Industrial Systems to Remote Attacks

In September 2026, CISA disclosed critical vulnerabilities in Rockwell Automation's FactoryTalk Historian Machine Edition affecting Series B 5.202 and Series C 7.101. CVE-2025-12768, with a CVSS score of 8.0, enables remote code execution through an out-of-bounds write condition exploitable by attackers with low-level authentication. CVE-2026-12661 allows denial-of-service attacks via stack-based buffer overflows when crafted requests are sent to the web interface, potentially crashing industrial systems. These vulnerabilities impact critical infrastructure sectors including chemical manufacturing, healthcare, and water systems worldwide. The disclosure emphasizes the growing threat landscape targeting industrial control systems and operational technology environments. Similar buffer overflow vulnerabilities in ICS components have been increasingly exploited by nation-state actors and ransomware groups to disrupt critical infrastructure operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

Utilize the Network Layer

With CNSF, enterprises can:

  • Contain attack paths at runtime

    Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.

  • Eliminate blind spots in workload-to-workload traffic

    Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.

  • Secure modern and AI-driven workloads

    Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.

  • Apply consistent Zero Trust controls without slowing teams

    Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

  • The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment
Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command CenterQuick AssessmentAssess My Blast Radius
8
Tracked Campaigns
82%
Intrusions are malware-free
— CrowdStrike GTR 2026
29 min
Avg. eCrime breakout time
— CrowdStrike GTR 2026
27 sec
Fastest observed breakout
— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment AssessmentUnder Active Attack?
Cta pattren Image