Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack
STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

  • A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
  • What attackers exploited, and which enforcement gaps let them move.
  • Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Kill Chain Coverage
ATT&CK Mapped
Real-World IOCs
Graphic-for-second-Salt-Typhoon-blog-2
Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Displaying 2857 to 2868 of 6910 threat reports

ShinyHunters' Exploitation of Oracle PeopleSoft: A Wake-Up Call for ERP Security
Higher Education/Acadamia4 months ago

ShinyHunters' Exploitation of Oracle PeopleSoft: A Wake-Up Call for ERP Security

In June 2026, the ShinyHunters cybercriminal group launched a series of data theft attacks targeting Oracle PeopleSoft servers across more than 100 organizations, predominantly within the education sector. By exploiting a combination of known and zero-day vulnerabilities, they successfully exfiltrated sensitive data from approximately 300 instances. The University of Nottingham was among the affected institutions, with its data subsequently published on ShinyHunters' data leak site. These incidents underscore the critical need for organizations to promptly apply security patches and conduct thorough system configurations to mitigate potential vulnerabilities. This attack highlights a concerning trend of cybercriminals increasingly targeting enterprise resource planning (ERP) systems, which are integral to organizational operations. The exploitation of both known and unknown vulnerabilities in such systems emphasizes the importance of proactive cybersecurity measures, including regular system audits, timely patch management, and comprehensive incident response planning to safeguard sensitive data and maintain operational integrity.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
China-Linked JDY Botnet Intensifies Focus on U.S. Military Networks
Defense/Space4 months ago

China-Linked JDY Botnet Intensifies Focus on U.S. Military Networks

In June 2026, cybersecurity researchers identified a significant expansion of the JDY botnet, a network linked to Chinese state-sponsored actors such as Volt Typhoon. The botnet, which has grown from approximately 650 active bots in January 2024 to over 1,500 compromised small office/home office (SOHO) and Internet of Things (IoT) devices, primarily targets U.S. military and associated networks. JDY functions as a distributed scanning and fingerprinting network, rapidly identifying vulnerable infrastructure shortly after public vulnerability disclosures, thereby facilitating swift exploitation by advanced persistent threat (APT) actors. This development underscores the escalating sophistication and persistence of state-sponsored cyber threats, particularly those emanating from China. The rapid operationalization of reconnaissance data by APT groups highlights the critical need for organizations, especially within the defense sector, to enhance their cybersecurity posture, promptly apply patches, and implement robust monitoring to detect and mitigate such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
GitHub's npm v12: Strengthening Security Against Supply-Chain Attacks
Computer Software/Engineering4 months ago

GitHub's npm v12: Strengthening Security Against Supply-Chain Attacks

In June 2026, GitHub announced significant security enhancements for npm version 12, aimed at mitigating supply-chain attacks. Key changes include requiring explicit approval for running preinstall, install, or postinstall scripts from dependencies, and restricting automatic fetching of dependencies from Git repositories and remote URLs unless explicitly permitted. These measures are designed to prevent unauthorized code execution during package installations, thereby enhancing the security of the npm ecosystem. This initiative addresses vulnerabilities exploited in recent supply-chain attacks, such as the Shai-Hulud campaign, which compromised numerous npm packages to steal developer credentials. By implementing these changes, GitHub aims to fortify the software supply chain against emerging threats and protect developers from potential security breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Langflow Vulnerability CVE-2026-5027 Exploited in the Wild
Computer Software/Engineering4 months ago

Critical Langflow Vulnerability CVE-2026-5027 Exploited in the Wild

In early 2026, a critical path traversal vulnerability, CVE-2026-5027, was discovered in Langflow, an open-source AI development platform. This flaw allowed unauthenticated attackers to write arbitrary files to exposed servers by exploiting the 'POST /api/v2/files' endpoint, which failed to properly sanitize user-supplied filenames. The vulnerability was publicly disclosed on March 27, 2026, after initial reports to the Langflow team went unanswered. Exploitation of this flaw has been observed in the wild, with attackers dropping test files on vulnerable instances. Langflow users are urged to upgrade to version 1.10.0 to mitigate this risk. This incident underscores the critical importance of timely vulnerability management and the risks associated with default configurations that allow unauthenticated access. Organizations must prioritize patching known vulnerabilities and reassess default settings to prevent unauthorized exploitation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
JDY Botnet's Rapid Expansion: A Wake-Up Call for Cybersecurity
Telecommunications4 months ago

JDY Botnet's Rapid Expansion: A Wake-Up Call for Cybersecurity

In June 2026, cybersecurity researchers reported a significant expansion of the JDY botnet, a covert network linked to Chinese state-sponsored actors. The botnet has grown from 650 to over 1,500 compromised small office and home office (SOHO) routers and IoT devices. This network is utilized for large-scale reconnaissance, enabling rapid identification and mapping of exposed services within hours of new vulnerability disclosures. The JDY botnet's resilience and adaptability underscore the persistent threat posed by state-sponsored cyber activities targeting critical infrastructure. The rapid expansion of the JDY botnet highlights the increasing sophistication of state-sponsored cyber operations. Organizations must prioritize timely patching of edge devices, enforce strong authentication measures, and monitor for indicators of compromise to mitigate the risks associated with such covert networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Miasma Worm Source Code Leaked on GitHub: Implications for Open-Source Security
Computer Software/Engineering4 months ago

Miasma Worm Source Code Leaked on GitHub: Implications for Open-Source Security

In June 2026, the Miasma worm, an evolution of the Shai-Hulud malware, was deliberately leaked on GitHub by threat actors. This credential-stealing framework targets developers by infecting their machines, harvesting build environment and cloud credentials, and propagating itself by compromising legitimate repositories and packages. Notably, Miasma has been linked to significant supply chain attacks, including the compromise of 73 Microsoft GitHub repositories and Red Hat npm packages. The worm's autonomous propagation mechanism poses a substantial risk to the open-source ecosystem, enabling rapid and widespread distribution of malicious code. The deliberate release of Miasma's source code is expected to facilitate further adaptations by malicious actors, potentially leading to an increase in sophisticated supply chain attacks. This incident underscores the critical need for enhanced security measures within the open-source community to mitigate the risks associated with such self-propagating malware.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft's June 2026 Patch Tuesday: Addressing 206 Vulnerabilities, Including Three Zero-Days
Computer Software/Engineering4 months ago

Microsoft's June 2026 Patch Tuesday: Addressing 206 Vulnerabilities, Including Three Zero-Days

In June 2026, Microsoft released its largest-ever Patch Tuesday update, addressing 206 vulnerabilities across its product suite, including Windows, Office, Azure, and more. Notably, this update included fixes for three zero-day vulnerabilities: CVE-2026-49160, a denial of service flaw in web servers; CVE-2026-45586, an elevation of privilege issue in the Windows Collaborative Translation Framework; and CVE-2026-50507, a BitLocker vulnerability allowing unauthorized data access. These zero-days were publicly disclosed by a researcher known as 'Nightmare Eclipse,' leading to heightened tensions between the researcher and Microsoft. The rapid disclosure and exploitation of these vulnerabilities underscore the evolving threat landscape and the critical need for timely patch management. Organizations are urged to prioritize the deployment of these updates to mitigate potential risks associated with these vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
The Gentlemen Ransomware Group: A Rising Threat in 2026
Financial Services4 months ago

The Gentlemen Ransomware Group: A Rising Threat in 2026

The Gentlemen ransomware group, emerging in mid-2025, has rapidly become the second most active ransomware-as-a-service (RaaS) operation, claiming over 330 victims by mid-2026. Offering affiliates a 90% revenue share, the group attracts experienced operators who exploit internet-facing devices like VPNs and firewalls to gain initial access, swiftly encrypting entire networks within hours. Their cross-platform ransomware, written in Go, targets Windows, Linux, and ESXi environments, employing advanced techniques such as lateral movement, defense evasion, and data exfiltration to maximize impact. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/?utm_source=openai))The rapid ascent of The Gentlemen underscores the evolving sophistication of ransomware operations, highlighting the urgent need for organizations to bolster their cybersecurity defenses. The group's aggressive recruitment and advanced tactics exemplify the growing threat posed by RaaS platforms, emphasizing the importance of proactive threat intelligence and robust security measures to mitigate such risks. ([computerweekly.com](https://www.computerweekly.com/news/366643511/The-Gentlemen-emerging-as-key-ransomware-player?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Proto6 Vulnerabilities in protobuf.js: A Threat to Node.js Applications
Computer Software/Engineering4 months ago

Proto6 Vulnerabilities in protobuf.js: A Threat to Node.js Applications

In June 2026, cybersecurity researchers identified six critical vulnerabilities, collectively termed 'Proto6,' in protobuf.js—a widely used JavaScript and TypeScript implementation of Google's Protocol Buffers. These flaws, including CVE-2026-44291 and CVE-2026-44295, could lead to remote code execution (RCE) and denial-of-service (DoS) attacks if exploited. The vulnerabilities affect Node.js applications utilizing protobuf.js, Google Cloud client libraries, messaging frameworks like Baileys, and CI/CD pipelines. Attackers can exploit these issues by introducing malicious protobuf schemas, potentially compromising sensitive data and system integrity. The discovery underscores the growing risks in software supply chains, especially within data and AI ecosystems that frequently exchange schemas and configurations. Organizations are urged to update to protobuf.js versions 7.5.6 or 8.0.2 to mitigate these threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Miasma Worm's 2026 Attack on Microsoft: A Wake-Up Call for Supply Chain Security
Computer Software/Engineering4 months ago

Miasma Worm's 2026 Attack on Microsoft: A Wake-Up Call for Supply Chain Security

In June 2026, Microsoft faced a significant supply chain attack when the Miasma worm compromised 73 of its GitHub repositories across four organizations: Azure, Azure-Samples, Microsoft, and MicrosoftDocs. The attackers utilized previously stolen credentials to inject malicious code into these repositories, leading to widespread disruptions in continuous integration and deployment (CI/CD) workflows globally. This incident underscores the escalating threat of self-replicating malware targeting trusted software supply chains. The Miasma worm's ability to exploit AI coding tools and integrated development environments (IDEs) highlights a concerning evolution in attack vectors, emphasizing the need for enhanced security measures in development environments to prevent similar breaches in the future.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Exchange 'Ghost-Sender' Vulnerability Exposes Organizations to Email Spoofing Attacks
Financial Services4 months ago

Microsoft Exchange 'Ghost-Sender' Vulnerability Exposes Organizations to Email Spoofing Attacks

In June 2026, researchers identified a vulnerability in Microsoft Exchange, termed 'Ghost-Sender,' allowing attackers to spoof emails from any sender to organizations using Exchange Online or on-premises in hybrid mode with third-party mail servers. This flaw enables malicious actors to bypass SPF, DKIM, and DMARC policies, delivering emails directly to users' inboxes without warnings. The misconfiguration is widespread, with evidence of active exploitation in the wild. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/exchange-flaw-attackers-spoof-email-address?utm_source=openai)) The 'Ghost-Sender' vulnerability underscores the critical need for organizations to review and secure their email configurations. With attackers actively exploiting this flaw, immediate action is required to implement recommended mitigations and prevent potential phishing attacks, fraud, and unauthorized access facilitated through email spoofing.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft's June 2026 Patch Tuesday: A Record 206 Vulnerabilities Addressed
Information Technology/IT4 months ago

Microsoft's June 2026 Patch Tuesday: A Record 206 Vulnerabilities Addressed

In June 2026, Microsoft released a record-breaking Patch Tuesday update addressing 206 vulnerabilities across its product suite. This unprecedented volume underscores the accelerating pace of vulnerability discovery, largely driven by advancements in artificial intelligence. Notably, the update includes critical remote code execution flaws in core Windows components, such as HTTP.sys and the DHCP Client service, which could allow unauthenticated attackers to achieve full system compromise without user interaction. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-june-2026/?utm_source=openai)) The surge in identified vulnerabilities highlights the dual-edged nature of AI in cybersecurity. While AI enhances defensive capabilities, it also enables faster and more efficient discovery of software flaws, potentially outpacing traditional remediation efforts. Organizations must adapt by integrating AI-driven tools into their security workflows and enhancing their patch management processes to keep pace with this evolving threat landscape.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

Utilize the Network Layer

With CNSF, enterprises can:

  • Contain attack paths at runtime

    Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.

  • Eliminate blind spots in workload-to-workload traffic

    Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.

  • Secure modern and AI-driven workloads

    Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.

  • Apply consistent Zero Trust controls without slowing teams

    Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

  • The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment
Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command CenterQuick AssessmentAssess My Blast Radius
8
Tracked Campaigns
82%
Intrusions are malware-free
— CrowdStrike GTR 2026
29 min
Avg. eCrime breakout time
— CrowdStrike GTR 2026
27 sec
Fastest observed breakout
— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment AssessmentUnder Active Attack?
Cta pattren Image