Santa Clara, Calif., Oct. 26, 2026 (GLOBE NEWSWIRE) -- Aviatrix today announced Aviatrix Clearance™, a new offering on the Aviatrix Containment Platform, built on the Cloud Native Security Fabric™. Clearance lets a security team limit each cloud workload to the paths it needs, outbound and lateral, and enforce that policy safely: each policy runs in monitor mode first, shows what it would block before it blocks anything, and backs out in one action. Aviatrix also announced a formal response program to address last week’s security incidents. The program makes Clearance free for every enterprise across its entire estate, including outbound, lateral, and intrusion prevention, from November 1, 2026, through May 1, 2027. It gives teams time to assess and patch in an orderly way, with a containment backstop in place.
“You cannot patch or detect your way out of this in the time you have, and this patch cycle runs into the holiday change freeze. So, we are giving the industry a way to contain the damage while they patch,” said Doug Merritt, chief executive officer of Aviatrix. “This incident response is a backstop, so teams have time to do the work properly while limiting how far any breach can spread. Clearance makes default deny safe to turn on, and Containment holds whether or not a breach has been detected. A security company should make its customers safer when the market is under this kind of pressure.”
Three incidents underscore the threat landscape faced by security teams. First, PHP2Shell, a pair of critical flaws in PHP, which runs about 70% of the world’s websites whose server-side language is known,1 saw exploitation attempts four days before its fix shipped on October 212. This is forcing teams to take systems offline to assess and patch. Second, eight intermediate certificates from the certificate authority eMudhra had keys weak enough to forge trusted certificates. Browsers updated quickly, but VPNs, containers, and Linux systems that have not updated still trust them. Third, LiteLLM was compromised for the second time this year. Valid developer credentials carried a poisoned release through a hardened pipeline, and the payload harvested every AI provider key the gateway held.
Default Deny Without the Outage
The control that limits damage when a patch is delayed is a default-deny policy, where a workload can connect only to what it needs. Security teams often delay enforcement because a single misconfigured rule can take down revenue-generating or process-critical applications. Aviatrix Clearance lets teams run a policy in monitor mode first, where the Shadow Rule Set evaluates it alongside the live policy on real traffic and shows the connections the policy would block, so teams can clear the paths their applications need before enforcing. Enforcement is a single setting, and backout is a single action.
Containment is the enforcement of an explicit communication policy at every workload, governing what it can reach and what can reach it, by workload identity and protocol, on every path available to it, whether or not a compromise has been detected. What a compromised workload can still reach is its Blast Radius, and Clearance reduces it.
Aviatrix Clearance is Two Controls and an Autonomous Defense Layer
Aviatrix Clearance comprises three components. Each can be purchased separately or together, in any order.
- Outbound Containment. A workload reaches only the outside destinations it is cleared for, named by domain rather than network address.
- Lateral Containment. A workload reaches only the other workloads it is cleared for, by identity, across clouds and down to a single container, serverless function, database, or AI agent, including the Kubernetes and serverless paths that Chokepoint Security, inspection at a central hub, does not govern.
- Aviatrix Active Defense™ agents build a model of the estate from the estate itself, with no tagging project and no inventory to import. They then draft the policy each application needs. They prove each policy in monitor mode on live traffic. Active Defense, in monitor mode, lets the team see exactly what would have been denied before anything is denied in production. The agents keep policies current as the estate changes. Every policy written is a standard policy the team can read, change, or backout in one action.
“In my years investigating international cybercrime, the decisive question was how the attackers got in and how we could plug the hole going forward. With advances in AI and hacker sophistication today, preventing intrusions is nearly impossible. Finding the root cause and patching doesn’t prevent the next exploit or entry that we haven’t discovered,” said Tom Pageler, former special agent, U.S. Secret Service; former Chief Risk Officer and Chief Security Officer of Neustar; and former Deputy Chief Information Security Officer of JPMorgan Chase. “Rather, the question today is: can an organization contain the fallout of an intrusion? True success is now achieved when every workload can only reach what it needs, and a breach stays small or inconsequential whether or not the organization has identified the intrusion yet.”
“Security and platform teams agree that each workload should reach only what it needs, outbound and lateral. Most haven't enforced it because the people who run production have seen a rule that looked right in review break an application, and they're right to hesitate. The question is no longer whether default deny is the right control. It is whether a team can see what a policy would have blocked before it blocks anything, enforce in one step, and back out in one step. That is what moves containment from a security recommendation to an operations decision, and it is the gap Aviatrix Clearance is built to close,” said Mitch Ashley, vice president and practice lead at The Futurum Group.
Clearance Incident Response Program
Aviatrix’s Incident Response program covers Outbound Containment, Lateral Containment, and Intrusion Prevention across the whole estate, with no workload cap, from November 1, 2026, through May 1, 2027. All enterprises qualify. Teams can begin today with the free Containment Assessment at aviatrix.ai/containment-assessment, which is read-only, installs nothing, and can reserve AWS Marketplace enrollment, which opens November 1, 2026.
General Availability
Aviatrix Clearance includes a Containment Assessment and 15 workloads in monitor or enforce mode, with no time limit, enough to cover a typical VPC or VNet. Clearance is priced per workload and delivered on Aviatrix Cloud. Contact Aviatrix for pricing. The same two controls are available on Aviatrix Enterprise. Aviatrix Active Defense is available today in free early access for design partners.
For more information, visit aviatrix.ai/clearance or contact an Aviatrix representative.
About Aviatrix
Aviatrix® is the network containment company. The Aviatrix Containment Platform sets what every cloud workload may reach before any attack, so a compromised workload does not become a company-wide breach. Built on the Cloud Native Security Fabric, it enforces that policy in the network, at every workload and in every cloud, with nothing to install and nothing to detect first, and encrypts the traffic it allows. It is simpler, safer, faster, and less costly than the firewalls and agents it replaces. The Cloud Native Security Fabric is quantum safe. Trusted by more than 500 of the world’s leading enterprises. For more information, visit aviatrix.ai.
Footnote citations available on the Aviatrix website.
Aviatrix 888-311-8328 press@aviatrix.com
