Aviatrix today announced Aviatrix Clearance, new offering on Aviatrix Containment Platform, built on Cloud Native Security Fabric. Clearance lets security team limit each cloud workload to paths it needs, outbound and lateral, and enforce that policy safely: each policy runs in monitor mode first, shows what it would block before it blocks anything, and backs out in one action. Aviatrix also announced formal response program to address last week security incidents. Program makes Clearance free for every enterprise across entire estate, including outbound, lateral, and intrusion prevention, from November 1, 2026, through May 1, 2027. Gives teams time to assess and patch in orderly way, with containment backstop in place.
You cannot patch or detect way out of this in time you have, and this patch cycle runs into holiday change freeze. So, giving industry way to contain damage while they patch. Incident response backstop, so teams have time to do work properly while limiting how far any breach can spread. Clearance makes default deny safe to turn on, and Containment holds whether or not breach has been detected.
Three incidents underscore threat landscape faced by security teams. First, PHP2Shell, pair of critical flaws in PHP, which runs about 70% of world websites whose server-side language known, saw exploitation attempts four days before fix shipped on October 21. Forcing teams to take systems offline to assess and patch. Second, eight intermediate certificates from certificate authority eMudhra had keys weak enough to forge trusted certificates. Browsers updated quickly, but VPNs, containers, and Linux systems that have not updated still trust them. Third, LiteLLM compromised for second time this year. Valid developer credentials carried poisoned release through hardened pipeline, and payload harvested every AI provider key gateway held.
Control that limits damage when patch delayed is default-deny policy, where workload can connect only to what it needs. Security teams often delay enforcement because single misconfigured rule can take down revenue-generating or process-critical applications. Aviatrix Clearance lets teams run policy in monitor mode first, where Shadow Rule Set evaluates it alongside live policy on real traffic and shows connections policy would block, so teams can clear paths applications need before enforcing. Enforcement single setting, and backout single action.
Containment is enforcement of explicit communication policy at every workload, governing what it can reach and what can reach it, by workload identity and protocol, on every path available to it, whether or not compromise detected. What compromised workload can still reach is Blast Radius, and Clearance reduces it.
Aviatrix Clearance comprises three components. Each can be purchased separately or together, in any order. Outbound Containment. Workload reaches only outside destinations cleared for, named by domain rather than network address. Lateral Containment. Workload reaches only other workloads cleared for, by identity, across clouds and down to single container, serverless function, database, or AI agent, including Kubernetes and serverless paths that Chokepoint Security, inspection at central hub, does not govern. Aviatrix Active Defense agents build model of estate from estate itself, with no tagging project and no inventory to import. They then draft policy each application needs. They prove each policy in monitor mode on live traffic. Active Defense, in monitor mode, lets team see exactly what would have been denied before anything denied in production. Agents keep policies current as estate changes. Every policy written standard policy team can read, change, or backout in one action.
About Aviatrix
Aviatrix network containment company. Aviatrix Containment Platform sets what every cloud workload may reach before any attack, so compromised workload does not become company-wide breach. Built on Cloud Native Security Fabric, enforces that policy in network, at every workload and in every cloud, with nothing to install and nothing to detect first, and encrypts traffic it allows. Simpler, safer, faster, less costly than firewalls and agents it replaces. Cloud Native Security Fabric quantum safe. Trusted by more than 500 of world's leading enterprises.
