Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack
STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

  • A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
  • What attackers exploited, and which enforcement gaps let them move.
  • Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Kill Chain Coverage
ATT&CK Mapped
Real-World IOCs
Graphic-for-second-Salt-Typhoon-blog-2
Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Displaying 2917 to 2928 of 6910 threat reports

Meta Thwarts NSO Group's Latest WhatsApp Phishing Scheme
Government Administration4 months ago

Meta Thwarts NSO Group's Latest WhatsApp Phishing Scheme

In June 2026, Meta identified and disrupted spear-phishing attempts linked to the Israeli spyware vendor NSO Group. These attacks aimed to deceive users into clicking malicious links, redirecting them to external websites outside of WhatsApp. Meta also discovered that NSO Group had created test accounts and groups on WhatsApp, which were subsequently removed. This activity violated a permanent injunction issued in 2025 that barred NSO from targeting WhatsApp and its users. In response, Meta filed a federal court contempt order against NSO Group for breaching this injunction. ([about.fb.com](https://about.fb.com/news/2026/06/fighting-spyware-an-update-from-whatsapp/?utm_source=openai)) This incident underscores the persistent threat posed by spyware vendors like NSO Group, who continue to develop and deploy sophisticated attacks against communication platforms. The recurrence of such activities highlights the need for ongoing vigilance and robust security measures to protect user privacy and maintain platform integrity.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
SoFi Hong Kong Data Breach: Lessons in Third-Party Risk Management
Financial Services4 months ago

SoFi Hong Kong Data Breach: Lessons in Third-Party Risk Management

In April 2026, SoFi Hong Kong, a subsidiary of the U.S.-based financial technology company SoFi Technologies, detected unauthorized access to a customer database managed by a third-party vendor. The breach, discovered on April 30, 2026, prompted SoFi to engage a cybersecurity firm to investigate. While the full scope of the incident remains under investigation, the company has advised customers to monitor their accounts for suspicious activity and has implemented additional security measures to protect affected accounts. This incident underscores the critical importance of robust third-party risk management in the financial sector. As financial institutions increasingly rely on external vendors for data management, ensuring these partners adhere to stringent security protocols is essential to prevent unauthorized access and protect sensitive customer information.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Massive Exploitation of Ghost CMS Vulnerability CVE-2026-26980
Financial Services5 months ago

Massive Exploitation of Ghost CMS Vulnerability CVE-2026-26980

In May 2026, a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS was exploited to compromise over 700 websites, including those of Harvard University, Oxford University, and DuckDuckGo. Attackers injected malicious JavaScript into these sites, presenting visitors with fake Cloudflare verification prompts that, when followed, installed malware on their systems. This vulnerability, with a CVSS score of 9.4, allowed unauthenticated attackers to read arbitrary data from the database, leading to widespread data breaches and malware distribution. ([techtimes.com](https://www.techtimes.com/articles/317134/20260525/ghost-cms-sql-injection-hits-700-sites-harvard-duckduckgo-serve-fake-cloudflare-malware.htm?utm_source=openai)) The exploitation of this vulnerability underscores the critical importance of timely patch management. Despite a patch being available since February 2026, many organizations failed to apply it, resulting in significant security incidents. This case highlights the ongoing risks associated with unpatched software and the necessity for organizations to maintain robust vulnerability management practices. ([techradar.com](https://www.techradar.com/pro/security/ghost-cms-flaw-hijacked-to-target-hundreds-of-websites-with-clickfix-attacks-heres-how-to-stay-safe?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Security Incident Highlights Risks in Microsoft Entra Agent ID's Assistive Agents
Information Technology/IT5 months ago

Security Incident Highlights Risks in Microsoft Entra Agent ID's Assistive Agents

In May 2026, a security incident involving Microsoft Entra Agent ID's assistive agents was identified. An AI agent, operating under the On-Behalf-Of (OBO) authentication flow, sent a suspicious email with the subject 'Here is your invoice' from matt@ContosoCorp.onmicrosoft.com to an external recipient. The email originated from IP address 51.3.97.221, utilizing the Microsoft Graph beta API. This activity raised concerns about potential misuse of delegated permissions granted to AI agents, highlighting vulnerabilities in the OBO flow that could be exploited for unauthorized actions. The incident underscores the growing security challenges associated with AI agents in enterprise environments. As organizations increasingly integrate AI-driven workflows, ensuring robust identity and access management for these agents becomes critical. This event serves as a reminder of the importance of monitoring AI agent activities and implementing stringent controls to prevent unauthorized access and actions.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Hades Campaign: A New Threat to PyPI Security
Computer Software/Engineering5 months ago

Hades Campaign: A New Threat to PyPI Security

In June 2026, a sophisticated supply chain attack targeted the Python Package Index (PyPI), compromising 37 wheels across 19 packages. The attackers, adopting a 'Hades' naming convention, deployed a variant of the Shai-Hulud worm, which is known for its self-propagating and information-stealing capabilities. This malware infects software components, utilizes the access to publish malicious versions, and harvests repository accounts of downstream users. The attack chain's cross-runtime design involved the installation of Bun—a JavaScript runtime—as a heavily obfuscated JavaScript stealer before executing the payload. This incident underscores the persistent and evolving nature of software supply chain threats. The use of cross-runtime techniques and obfuscated payloads highlights the increasing sophistication of attackers, emphasizing the need for robust security measures in open-source ecosystems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
VerdantBamboo's Prolonged Cyber Espionage via BRICKSTORM Backdoor
Telecommunications5 months ago

VerdantBamboo's Prolonged Cyber Espionage via BRICKSTORM Backdoor

In September 2025, cybersecurity firm Volexity identified a prolonged cyber espionage campaign by the Chinese state-sponsored group VerdantBamboo, also known as UNC5221. The attackers exploited a local privilege escalation vulnerability in an Egnyte Storage Sync appliance to deploy a BSD variant of the BRICKSTORM backdoor, maintaining undetected access for at least 18 months. This access facilitated further infiltration into the victim's Microsoft 365 environment and the deployment of additional malware, including PLENET and AGENTPSD, on various network appliances. The campaign underscores the increasing targeting of network appliances and storage systems by sophisticated threat actors, exploiting their lack of endpoint detection capabilities to establish long-term persistence. Organizations are urged to enhance monitoring and security measures for such devices to mitigate similar threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
UNC3753's 2026 Data Theft Campaign: A Blend of Vishing and Physical Intrusions
Legal Services5 months ago

UNC3753's 2026 Data Theft Campaign: A Blend of Vishing and Physical Intrusions

Between January and May 2026, the threat actor UNC3753, also known as Chatty Spider, Luna Moth, and Silent Ransom Group (SRG), targeted numerous U.S. organizations in the professional, legal, and financial sectors. Utilizing voice phishing (vishing) and social engineering tactics, they impersonated IT support to gain remote access via screen-sharing sessions and remote monitoring tools. In some cases, attackers physically infiltrated offices, posing as IT technicians to exfiltrate data using USB devices. Stolen information included proprietary legal agreements, personally identifiable information (PII), and financial records. The group rapidly demanded ransoms, threatening to publish the stolen data if payments were not made promptly. This incident underscores the evolving tactics of cybercriminals, combining traditional social engineering with physical intrusion methods. The rapid execution of these attacks, often completed within a single business day, highlights the need for organizations to enhance their security awareness training and implement robust verification processes for IT support interactions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More
Computer Software/Engineering5 months ago

Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More

In early June 2026, multiple significant cybersecurity incidents emerged, including the exploitation of Meta's AI-driven customer support system to hijack high-profile Instagram accounts, a critical zero-day vulnerability in Qualcomm chipsets affecting numerous Android devices, and a self-replicating worm targeting Microsoft's GitHub repositories. These events underscore the persistent and evolving nature of cyber threats, highlighting vulnerabilities in widely used platforms and the need for robust security measures. The exploitation of AI systems for unauthorized access, the discovery of critical hardware vulnerabilities, and the targeting of major code repositories reflect a broader trend of increasingly sophisticated cyberattacks. Organizations must remain vigilant, continuously update their security protocols, and invest in advanced threat detection to mitigate these evolving risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Red Hat npm Packages Compromised in June 2026 Supply Chain Attack
Computer Software/Engineering5 months ago

Red Hat npm Packages Compromised in June 2026 Supply Chain Attack

In June 2026, a sophisticated supply chain attack was identified, involving the compromise of Red Hat's npm packages. Attackers infiltrated a Red Hat employee's GitHub account, injecting malware into numerous npm packages under the Red Hat Cloud Services namespace. This breach led to over 80,000 downloads of compromised packages within a week, targeting sensitive data such as GitHub Actions secrets, npm tokens, SSH keys, and cloud credentials. The malicious code employed encrypted exfiltration techniques, posing significant risks to developers and organizations relying on these packages. This incident underscores the escalating threat of supply chain attacks, particularly those exploiting open-source ecosystems. The attackers' use of advanced techniques, including encrypted exfiltration and targeting cloud identities, highlights the need for enhanced vigilance and robust security measures in software development and distribution processes.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Check Point VPN Flaw Exploited: CVE-2026-50751
Financial Services5 months ago

Critical Check Point VPN Flaw Exploited: CVE-2026-50751

In early June 2026, Check Point Software Technologies disclosed active exploitation of a critical vulnerability, CVE-2026-50751, affecting their Remote Access VPN and Mobile Access products configured with the deprecated IKEv1 key exchange protocol. This flaw allows unauthenticated remote attackers to bypass user authentication and establish unauthorized VPN connections. Exploitation has been observed since at least May 7, 2026, with increased activity in early June, including incidents linked to a Qilin ransomware affiliate. ([blog.checkpoint.com](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/amp/?utm_source=openai)) The incident underscores the risks associated with using outdated protocols like IKEv1, which, despite being deprecated, remain in use for legacy compatibility. Organizations are urged to disable IKEv1 and apply security updates to mitigate this vulnerability. ([blog.checkpoint.com](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/amp/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
AI-Generated Phishing Attacks Overwhelm SOCs in 2026
Financial Services5 months ago

AI-Generated Phishing Attacks Overwhelm SOCs in 2026

In early 2026, organizations experienced a surge in AI-generated phishing attacks, leading to an overwhelming increase in security alerts. These sophisticated campaigns utilized generative AI to craft convincing emails and evade traditional detection methods, significantly burdening Security Operations Centers (SOCs). As a result, SOCs faced challenges in effectively triaging and responding to the high volume of alerts, with only 37% of daily security alerts being investigated. This escalation in alert volume not only strained resources but also increased the risk of overlooking genuine threats, thereby elevating the overall cost and complexity of cybersecurity operations. ([prnewswire.com](https://www.prnewswire.com/news-releases/new-research-reveals-enterprises-investigate-just-37-of-daily-security-alerts-as-ai-expands-in-the-soc-302717184.html?utm_source=openai)) The proliferation of AI-driven phishing attacks underscores the urgent need for organizations to adapt their cybersecurity strategies. Traditional defense mechanisms are proving inadequate against the scale and sophistication of these threats. Implementing advanced AI-powered defenses and enhancing SOC capabilities are critical to effectively manage and mitigate the risks associated with AI-generated phishing campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
C0XMO Botnet's 2026 Exploitation of DD-WRT Router Vulnerability
Telecommunications5 months ago

C0XMO Botnet's 2026 Exploitation of DD-WRT Router Vulnerability

In June 2026, the C0XMO botnet, a sophisticated variant of the Gafgyt malware, exploited a buffer overflow vulnerability (CVE-2021-27137) in DD-WRT router firmware to compromise devices across multiple CPU architectures, including ARM, MIPS, and x86. The botnet's modular design enabled it to launch distributed denial-of-service (DDoS) attacks using 19 different methods and to eliminate competing malware by terminating their processes and removing persistence mechanisms. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/?utm_source=openai)) This incident underscores the escalating threat posed by advanced IoT botnets that leverage unpatched vulnerabilities in widely used devices. Organizations must prioritize timely firmware updates, enforce strong authentication practices, and disable unnecessary remote access to mitigate such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

Utilize the Network Layer

With CNSF, enterprises can:

  • Contain attack paths at runtime

    Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.

  • Eliminate blind spots in workload-to-workload traffic

    Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.

  • Secure modern and AI-driven workloads

    Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.

  • Apply consistent Zero Trust controls without slowing teams

    Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

  • The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment
Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command CenterQuick AssessmentAssess My Blast Radius
8
Tracked Campaigns
82%
Intrusions are malware-free
— CrowdStrike GTR 2026
29 min
Avg. eCrime breakout time
— CrowdStrike GTR 2026
27 sec
Fastest observed breakout
— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment AssessmentUnder Active Attack?
Cta pattren Image