Welcome toThe Containment Era.
The Containment Era Series
Welcome to
The Containment Era.When prevention fails and detection is too slow, containment decides whether the incident becomes a breach. Four papers. One structural argument. The category that governs what happens after breach. Containment: the architectural enforcement of policy at every workload.
Series · Paper 1 of 4The Containment EraSeries · Paper 2 of 4The Containment PlatformSeries · Paper 3 of 4144 to 1Series · Paper 4 of 4 — NEWThe Priority Inversion
01/04
The FortiBleed Attack Chain
Six stages. Zero malware. No alerts fired. Containment stops the breach.
When the perimeter fails, containment holds. CNSF enforces east-west policy at every workload — so a valid VPN login never becomes a breach. No perimeter dependency. Always on.
01 · Access
#### Initial Access
Mass scanning + SSO auth bypass + brute force. Any internet-facing FortiGate in scope.
SpyCloud · The Hacker News · June 2026
02 · Exfil
#### Config Exfil
Full config — VPN creds, admin hashes, topology. 73,932 devices · 194 countries.
BleepingComputer · SOCFortress
03 · Crack
#### Hash Crack
GPU cluster cracks SHA-256 hashes at industrial scale. Validated credentials sold at $30K–$60K per device.
SOCRadar · The Hacker News · June 2026
04 · Login
#### VPN Login
Valid credentials · valid session · SIEM sees normal login · no alert fires. 75% of initial access is malware-free.
CrowdStrike GTR 2024
Containment enforces here
05 · Pivot
#### AD Pivot Contained
SSL VPN → AD enumeration denied at workload boundary. Containment enforces east-west policy regardless of how attacker got in.
IBM Cost of a Data Breach 2024 · Aviatrix CNSF
06 · Radius
#### Blast Radius: Zero
Ransomware deployment and data exfil never happen. East-west movement denied. No perimeter dependency. Always on.
Aviatrix Cloud Native Security Fabric
Secure Your Cloud for the Future of AI
Leverage the cloud network as a unifying enforcement layer to secure all your agentic software and cloud workload communications.
Cloud runtime security that delivers measurable business outcomes:
0 %
average savings for egress
##### Use our TCO calculator to estimate cloud security savings with Aviatrix versus cloud provider solutions.
##### Built-In Zero Trust Fabric
Secure the cloud runtime agentlessly and in-line, with no app changes. Enable identity-aware connections; inspect, segment, and encrypt every session.
##### Stop Data Exfiltration
Shut down east–west attacks and risky egress in real time with least-privilege microsegmentation, decryption/inspection, and allowlists that block C2 and data leaks.
##### One Policy, Every Cloud
Consistent control across AWS, Azure, GCP, OCI, data center, and edge. Central intent adapts to each cloud, with IaC/GitOps support at scale.
##### Visibility & Compliance
Be audit-ready and ship faster with real-time flow maps, unified logs, and integrations that turn detection into in-line prevention.
The Architectural Divide
60 Pages. 5 Products.One Cloud.
That's what it takes to secure Azure with a centralized firewall architecture. Chokepoint Security routes every packet through an appliance — creating fragmentation, latency, and coverage gaps wherever the appliance can't reach.
The Problem
Centralized firewall architectures require 5–7 products per cloud, 60+ pages of deployment guidance, and traffic steering that breaks in Kubernetes and serverless. The complexity is structural, not operational.
Fails 3 of 5 testable containment properties by architecture: path-complete, compute-model agnostic, universally propagated.
The Alternative
CNSF enforces at every workload — one platform, one policy, universally propagated across every cloud, every VPC, every Kubernetes cluster. No hair-pinned traffic. No per-VPC firewall instances. No coverage gaps.
Passes all 5 testable properties: path-complete, identity-aware at L7, detection-independent, compute-model agnostic, universally propagated.
The Position
We’re not asking you to rip anything out. Deploy containment as the backstop your environment needs while your existing stack continues operating. Once containment is in the architecture, the chokepoint becomes gradually redundant.
"You never argued it. You outgrew it."
WhitepaperRead: The Containment PlatformExploreSee How CNSF Complements Your Security Stack
Elevate Your Security Stack with Cloud Native Security Fabric
Aviatrix CNSF complements your security ecosystem — segmenting workloads with Wiz, fueling Microsoft Security Copilot with rich AI insights, powering autonomous VPN defense, and extending the reach of Palo Alto Networks NGFWs.
[](https://www.youtube.com/embed/Jm6ok89MnKQ)
Solutions That Secure Cloud, Serverless, K8s, and AI
From visibility to zero trust, AI-driven detection to remediation, CNSF keeps enterprises secure at the speed of innovation.
- Aviatrix Cloud Firewall™ #### Zero Trust for Every Workload Traditional cloud firewalls can’t keep up with today’s perimeterless cloud environments. Aviatrix Cloud Firewall™ embeds zero trust at the workload, using AI insights for stronger detection, automated protection, and predictable costs.
- Secure Datacenter Edge #### Seamless, Secure Connectivity Across Cloud and Edge Extend CNSF to hybrid environments with real-time protection, regulatory compliance, and high-speed AI security.
- Financial Services
- Healthcare
- Manufacturing
- Retail
- Software
- Financial Services
- Healthcare
- Manufacturing
- Retail
- Software
- Operationally simple
- Visible and measurable
- Consistent across clouds and regions
- Performance-driven
- Secure by design
* Zero Trust Everywhere
Enforce consistent policies across cloud, Kubernetes, and AI workloads.
* Real-Time AI Detection
Identify and stop exfiltration instantly with AI-enhanced traffic analysis.
* Actionable Visibility
Gain clear insights into traffic patterns and egress costs to improve performance.
* App Modernization Security
Enforced security for Kubernetes, and serverless without adding complexity while reducing IP burn.
Explore cloud firewall
* High-Speed, Encrypted Connectivity
Deliver patented, line-rate performance with single-region, multi-region, or multicloud redundancy—meeting the strict encryption and compliance demands of FinServ, Healthcare, and other regulated industries.
* Compliance Without Compromise
Address new HIPAA requirements and financial regulations with enterprise-grade encryption, segmentation, and policy enforcement built into the fabric.
* Centralized Control
Simplify operations with unified dashboards and automated workflows—ensuring consistent visibility and governance across cloud and edge environments.
* High-Speed AI Data Mobility
Move valuable data securely and at scale to power AI projects and innovations—accelerating training and inference without bottlenecks or added risk.
Explore Secure Datacenter Edge
500+ Enterprises Secure Cloud and AI with Aviatrix
Including 10% of the Fortune 500
Cloud Native Security Fabric: Security That Lives at the Workload Layer
Consolidate networking, management, automation, and security into one enterprise-grade solution.
CNSF weaves distributed, perimeterless security, centralized visibility, and unified control into every cloud environment.
Zero trust embedded at runtime—delivered as self-service or managed PaaS. No bolt-ons, no extra tools, just cloud- native security in the fabric of the cloud.
Secure and accelerate dynamic workloads, including GenAI. Eliminate blind spots, unify policies across clouds, and de-risk multicloud egress.
##### Application Modernization
Built for cloud-native applications with embedded governance and resilience.
##### Zero Trust With AI Insight
Policy enforcement strengthened by AI anomaly detection and remediation.
##### AI Workload Protection
Secure, optimize, and monitor genAI and agentic AI workloads across clouds.
Cloud Native Security for Regulated Industries
Aviatrix CNSF delivers secure networking across industries – including healthcare, finance, and public sector – that simplifies compliance, reduces costs, and protects innovation.
Financial Services
Cloud Network Security for Financial Services
Protect sensitive data, ensure compliance, and optimize digital banking experiences with robust, cloud network security solutions designed to meet the demands of modern financial institutions.
Explore Finserv Success Stories
The Experts Powering Cloud Security
Meet the real life cloud networking and security leaders protecting workloads, streamlining operations, and securing innovation worldwide.
#### Toby Foss
Senior Director, Information Security
The future of cloud networking is about embracing the ever-evolving landscape. Companies today must adapt or be left in the dust. I am proud of the automation that not only protects our global operations but also empowers my team to innovate and scale.
#### Cristian Critelli
Lead Networking and Resilience Partner Solution Architect
Over the next decade, cloud networking will be transformed by AI-driven automation and predictive analytics – redefining resilience and drastically reducing downtime. The shift toward multi-region and multi-availability zone architectures will accelerate, ensuring seamless continuity and empowering enterprises to build fault-tolerant infrastructures across distributed cloud environments.
#### Roy Long
FOUNDER, SKYPURPLE CLOUD
I thrive on helping organizations navigate the complexities of cloud technology by building flexible, scalable, secure solutions. The future of cloud networking is not about mastering just one tool—it’s about fostering continuous adaptability and resilience. The ability to stay agile in the face of evolving challenges is what drives success in the cloud landscape.
#### Mark Noorman
Competency Lead, Cloud Networking
I love those 'aha' moments when colleagues or customers realize they need to think differently to tackle network challenges. Many assume cloud networking has to follow a rigid structure, but platforms like Aviatrix show it can be much simpler. It’s about sharing knowledge, drawing from experience, and helping others design smarter, more effective solutions.
How Enterprises Protect Cloud Workloads with CNSF
Real-world stories of organizations preventing breaches, controlling costs, and frictionless security with CNSF.
Retail
#### Better Improves Its Multicloud Security and Compliance with Aviatrix
"Without Aviatrix, Better would simply not be able to meet our security and compliance requirements."
Ali Khan
CISO, Better
#### Better Improves Its Multicloud Security and Compliance with Aviatrix
Aviatrix + Orange Business: Better Together
A Modern Multicloud Foundation—Built for Scale, Visibility, and Control
[](https://videos.ctfassets.net/mvxxnmpzvwpe/1tGpwYOtBnPbIjcHPbfnAc/54875f479597bbbf484e78324d4a5c49/Aviatrix%5F%5F%5FOrange.mp4)
Aviatrix + Orange Business = A complete multicloud foundation that is:
Built With and Trusted By World-Class Partners
Aviatrix partners with top cloud providers and technology innovators to extend CNSF, accelerate secure deployments, and drive enterprise cloud resilience.
Guides and Research to Strengthen Your Cloud Network Security
Read Report2026 Futuriom 50 - Key Findings and HighlightsExplore
Whitepaper9 Cloud Perimeter Security ChallengesExplore
Checklist5 Kubernetes Security Must-HavesExplore
Secure The Connections Between Your Clouds and Cloud Workloads
Leverage a security fabric to meet compliance and reduce cost, risk, and complexity.
Calculate Potential Cloud SavingsGet a Free Workload Attack Path AssessmentSchedule a Personalized Demo
