Aviatrix Blast Radius Economics – Pricing What a Compromise Can Reach

Willie Tejada of Aviatrix introduces Blast Radius Economics, an open framework for pricing what a single compromised system can reach. The session explains reachable value at risk, built from system value, reachable share, probability, and time to contain, and positions it alongside CVE-based patching metrics and FAIR as a board-level number for justifying containment budgets. Presented at Security Field Day 16, the segment moved from Chris McHenry’s containment demo to the financial side, setting up Matt Snyder’s discussion of the framework’s companion metric.

Tejada argued that security leaders track well-understood numbers each quarter, but nothing has put a value on what a breach can actually reach. Many CISOs are working from budgets set in 2025 while the threat landscape has shifted sharply, and time to patch can no longer stand alone as a hygiene metric. Reachable value at risk combines the CFO’s valuation of a system, the share of the environment one compromised machine can reach, the probability of compromise, and the time to contain it. Because system value and probability are debatable, Tejada noted they largely cancel out when comparing before and after, leaving reach and time to contain as the variables that matter. Reach is where organizations are most often surprised, since the footprint drawn on a whiteboard rarely matches what inventory shows a workload can touch. Using the MGM breach as an example, he described how cutting reach from 60% of an environment to 10% would sharply reduce the value at risk.

Tejada presented the framework as open to any vendor with a containment system, not just Aviatrix, and as a complement to FAIR that strengthens its magnitude inputs rather than replacing it. The goal is to give each role its own number. The CISO would own blast radius and the cost of reducing it, and the CIO would own the architecture changes that shrink it. The investment case would rest on the work product measured by durable risk reduction, the counterpart Snyder would cover. The board, in turn, would watch CVE exposure and reachable value at risk side by side, expecting both to fall quarter over quarter. That pairing gives containment a defensible line in 2027 budget discussions with the CFO.