russia

Screenshot 2026-01-12 at 2.27.56 PM

DPKR

Enable-Line-Rate-Encryption-Across

Why Aviatrix + Kubernetes Hero

Harsh Verma

Aviatrix Cloud Threat Command Center

Strykr Wipe

pcpjack

teampcp_update

iran apt 2

jon qian

Matt Snyder

Deepak 

Developer configuring cloud network infrastructure with code editor visible, accompanied by purple and orange halftone pattern representing data flow

Kubernetes-Graphics-2

china_apt

Deepak is a Staff Engineer, Detection & Response at Aviatrix, specializing in detection engineering and adversary behavior analysis. He collaborates with cross-functional teams to identify emerging threats, design high-signal detections, and strengthen response capabilities across complex cloud and hybrid infrastructures.

Staff Engineer - Detection and Response

The Blast Radius Assessment is a ten-question evaluation of your current cloud architecture. It runs entirely in your browser with no data collected and takes about ten minutes. Rather than asking about your roadmap or planned improvements, it focuses on your environment as it exists today. The output scores your architecture against the  Cloud Threat Command Center's threat board of 21 real-world campaigns, showing you which ones could currently complete their attack path in your environment.

What is the Blast Radius Assessment, and how does it work?

The Cloud Threat Command Center is a resource Aviatrix built to help organizations transition to containment-era architecture. It includes four progressions: a Campaign Arc and Threat Board tracking real-world attacks mapped to MITRE ATT&CK, a Blast Radius Assessment that scores your current environment against 21 active campaigns, a Detection Gap analysis showing where traditional tools fall short, and a four-phase Deployment Roadmap for implementing containment over 12 months. The entire resource is designed to meet organizations where they are today.

What is the Cloud Threat Command Center?

The Containment Era reflects a fundamental shift in cloud security strategy. Traditional detection-focused approaches struggle against today's threats, where 82% of intrusions are malware-free and attackers can move laterally in as little as 27 seconds. Meanwhile, organizations take an average of 158 days to identify a breach. Containment-era architecture focuses on limiting what an attacker can reach from inside your environment by governing every communication path and enforcing policy at every workload, making blast radius a structural property rather than an incident response outcome.

What is the Containment Era, and why does it matter?

Matt leads the Detection & Response efforts at Aviatrix, working closely with internal security teams and external partners to identify, investigate, and respond to potential threats. His role spans strategic oversight and hands-on execution to ensure a strong security posture across complex, distributed environments.

Principal Engineer/Lead - Detection and Response

The Cloud Threat Command Center Deployment Roadmap is a four-phase, 12-month implementation model designed to ease teams into containment. Phase one starts with observation, not enforcement. You deploy in monitoring mode, map outbound and east/west communications, and build a clear picture of your actual blast radius before applying any policies. This approach means nothing changes operationally for your team at the start, giving you time to understand communication patterns and build confidence before moving into active policy enforcement in later phases.

How does the Cloud Threat Command Center Deployment Roadmap work?

John is the Chief Information Security Officer at Aviatrix. Previously, John served as the Head of Security Architecture at Zoom, where he was responsible for overseeing the security posture of Zoom products and features, cloud environments, and sensitive IT applications. Over four years, his team developed one of the industry’s most mature security programs while effectively supporting Zoom’s dramatic business growth during the pandemic.

Chief Information Security Officer

"Detect Faster" doubles down on sensors, analysts, and rules to minimize dwell time, but accepts that blast radius remains unlimited. With AI-accelerated offense compressing exploit timelines, the investment required to keep pace becomes structurally unbounded. "Contain First" governs every communication path so that blast radius is limited by architecture, regardless of attack speed. Detection still plays a role, but it operates inside an already-contained environment. The key distinction is whether you're racing attacker speed or enforcing limits that hold even when an attack goes undetected.

What's the difference between "Detect Faster" and "Contain First"?

I’m a Senior MTS – Detection & Response at Aviatrix, focused on detection engineering, incident response, and proactive threat hunting across multicloud environments. I help lead our mission to identify, investigate, and mitigate threats across corporate and production environments—operating a 24×7 SOC and aligning detection engineering with incident response best practices. My background spans SIEM operations, cloud security, and threat hunting, and I contribute to Aviatrix’s Security Research initiatives, analyzing how advances in AI influence and evolve our security landscape.

Senior MTS - Detection and Response

I am a cybersecurity professional specializing in threat detection, incident response, and cloud security. My writing focuses on breaking down real-world attacks, security research, and detection engineering into clear, actionable insights for defenders. Through my research blogs, I explore emerging threat techniques and modern approaches to security operations, including the use of AI in defense.

PCPJack evicts TeamPCP from compromised cloud environments and sweeps 30+ credential types. If you responded to Q1 exposure, your timeline may have a gap. 

PCPJack Cloud Worm Evicts TeamPCP, Steals Credentials

Someone Evicted TeamPCP from Your Cloud. That Is Not Good News. 

The Aviatrix Cloud Threat Command Center helps enterprises enter the Containment Era: understand the threat landscape, find gaps, and determine blast radius.

Aviatrix Cloud Threat Command Center: Equipping Enterprises to Contain Threats

Introducing the Aviatrix Cloud Threat Command Center: Built for the Containment Era

TeamPCP has compromised six targets in ten weeks, including SAP npm packages and Bitwarden CLI. VECT 2.0 ransomware destroys files over 128KB. Here is what changed and what to do now.

TeamPCP Has a Model. Understanding It Changes What You Defend.

Aviatrix advisory on the LiteLLM supply chain compromise with IOCs, persistence details, containment steps, credential rotation guidance, and network-layer defenses for security and networking teams.

LiteLLM Supply Chain Compromise: Defensive Guidance and Containment Steps

AVX-SEC-2026-003: LiteLLM Security Advisory

The Russian APT Playbook - Operational Evolution and Defensive Strategy (2021 - 2026)

DPRK stole $3–6B in cryptocurrency 2021–2026. Full kill chain analysis of the Bybit heist, 3CX supply chain attack, and FAMOUS CHOLLIMA with MITRE ATT&CK detection logic for SOC teams.

The DPRK APT Playbook - Operational Evolution and Defensive Strategy (2021-2026)

Your endpoints can leak data through “helpful” extensions. Get a 2025 threat breakdown, MITRE-mapped behaviors, and a practical visibility→control→detection plan.

The Browser Extension Security Crisis: Lessons from 2.6M Compromised Users over the years

Handala claimed a massive Intune-driven wiper event against Stryker: 200,000+ devices disrupted without a novel exploit. Learn how management-plane access becomes impact.

The Attack That Wiped 200,000 Stryker Systems Required No Novel Exploit. That Is the Problem.

Analyze how PRC cyber operations evolved from 2021 to 2026, from ProxyLogon to Salt Typhoon, Storm-0558, BRICKSTORM, SPAWN, and Volt Typhoon, with practical defensive strategy and detection guidance.

The Chinese APT Playbook: Operational Evolution and Defensive Strategy (2021–2026)

Track Iran’s cyber campaign evolution from 2021–2026, key threat actors, and practical hunt strategies for SOC and threat teams. Learn more.

The Iran APT Playbook: Operational Evolution and Defense 2026

The Iran APT Playbook: Operational Evolution and Defensive Strategy (2021–2026)

Kubernetes was built for speed, not restraint. See how east-west traffic enables lateral movement and how one policy can break the chain. Learn more.

When Cloud Workloads Trust Too Much in Kubernetes

When Cloud Workloads Trust Too Much: Kubernetes East–West Traffic, Lateral Movement, and Containment 

See how attackers discover exposed infrastructure, accelerate recon with AI, and compromise systems quickly—plus how to reduce risk. Learn more.

Research & Insights

Products

By Role

Customer Stories

Security & Legal

Solutions

Resources

Industry

Company

Tools