Aviatrix Contain the Blast Radius Without Breaking the App

Chris McHenry of Aviatrix demonstrates how the Cloud Native Security Fabric contains a compromised cloud workload without disrupting applications. The session walks through Aviatrix’s see, insert, enforce, and operate approach, covering agentless gateway insertion, monitor-mode policy simulation, smart groups spanning VMs, Kubernetes, and serverless, policy as code, and the new Active Defense agentic layer for automating zero trust. The demo was part of Aviatrix’s Security Field Day 16 presentation with Willie Tejada and Matt Snyder, which framed blast radius as the measure of how much damage a compromised system can do.

McHenry argued that cloud network security is the worst he has seen in twenty years. More than 95% of the default cloud controls Aviatrix has examined across hundreds of containment assessments allow unfettered internet access, and roughly 2% of AWS spend goes to NAT gateways that provide unprotected egress. The live demo began with a compromised serverless workload on ECS that could reach command-and-control hosts, a rogue DNS server, GitHub, and a neighboring file share. McHenry deployed Aviatrix’s eBPF-based gateways from the egress score, replaced the NAT gateway, and enabled transparent inspection on a transit gateway. Route tables updated automatically, and throughput dipped only from about 9.2 Gbps to the high eights. Rules simulated in monitor mode then moved to enforcement, cutting off command and control and lateral movement, while one intent-based policy generated more than 50 security group rules to close the local segment.

The larger point was that fear of breaking applications, not a lack of tools, keeps teams from containing breaches. Aviatrix therefore favors a ladder that starts with blocking known-bad traffic rather than all-or-nothing zero trust. McHenry said basic malicious-egress filtering alone would have stopped both LiteLLM supply chain compromises this year. Smart groups that tracked a Kubernetes deployment as it scaled to ten pods, along with policy that Kubernetes teams edit through their own pipelines, are meant to keep security out of developers’ way. Active Defense is in early access now, with general availability expected later this year. It uses AI to map business criticality and move segments from learning to enforcement. It is backed by workload-specific threat intelligence that would allow YouTube on desktops but flag it in a payment environment.