网络安全
Aviatrix 发布清除受压缩云和AI 工作量
在 Google 上的首选来源中添加 Unite.AI
Aviatrix拥有发布清除系统，这是一种云安全装置，旨在通过限制其能够达到的目的地和其他工作量来限制受损工作量所造成的损害。 其中心命题与技术命题一样可操作：安全小组在允许其阻断生产连接之前，可以测试针对实际交通的限制性政策。
宣布 October 26,"清除"结合了出行和横向的封隔，与一个称为"Aviatrix Active Defense"的自动化政策层。 该公司还通过一个从2026年11月1日至2027年5月1日的临时应对方案，向没有工作量上限的企业提供出站封隔、平面封隔和入侵预防。
对于部署AI agents与常规云应用并列的组织来说，其根本问题越来越严重。 被利用或被操纵的agent可能已经具备有用的证书和网络访问权。 停止最初的妥协仍然至关重要，但事后可用的联系有助于确定这种妥协是留在当地还是分散。
带有后果预览的默认拒绝
Aviatrix 控制平台的清理工作，它为工作量提供了一套明确的允许通信路径，其他路径默认被拒绝。
外部封装规范与外部目的地的连接，以域名表示，而不只是网络地址。 横向约束通过身份来规范工作量之间的沟通，将模型延伸至云端并扩展到容器，无服务器功能，数据库等资源以及AI agents.
部署方面的挑战是，合法应用的依赖性往往难以完全列举。 在审查期间看来正确的规则仍然可以中断支付服务、背景工作或很少使用的整合。
清关以"影子规则集"解决了这种风险。 一项拟议政策首先在监控模式下与直播政策同时运行，显示它本来会拒绝的流量而不阻断这些连接。 团队可以识别所需的路径，修改权限，然后切换到执行。 Aviatrix 称执行和回滚每个需要一次行动。
这使得预览成为了工作流程的一个重要部分，而不是保证改变不会导致停用。 在一个期间观察到的流量可能不包括月终处理、灾后恢复或另一种罕见但合法的活动。 各小组仍然需要选择反映其应用实际运作的观察期和例外。
网络执行如何适应云应用
Aviatrix在其产品网站上描述了VPC层面的透明插入，保留了原始地址而不需要主机agent,SDK，或应用程序代码更改。 它也可以通过Terraform和Kubernetes自定义资源来代表称政策，并在不需要网关的地方将其编成安全小组和Kubernetes网络政策。
这一点很重要，因为云基础设施的变化比固定地址清单要快。 集装箱可以移动，功能可以规模化，应用程序可以跨越多个网络。 围绕工作量及其所需目的地表达意向可使政策比将每个地址的改变作为单独的安保决定更持久。
实际目标是关闭攻击者可以使用的通信路径，同时不迫使每个应用团队采用新的整合。 尽管如此，网络封隔仍然制约着连接：允许的连接仍然可以进行有害的活动。 它补充了补丁、身份控制、应用安全和检测，而不是使这些控制变得没有必要。
主动防御新增自动政策维护
Aviatrix Active Defense是供货的自主层。 根据公告，其agents构建了客户环境的模型，起草了需要的政策应用，在监控模式中评价，并随着工作量的变化而保持时事。 由此产生的政策仍然可供安全小组阅读和编辑。
Aviatrix CEO Doug Merritt 称在公告中解释公司决定在客户评估及补丁系统时提供临时封隔后卫。
网站新增是一个重要的可用性区分：Aviatrix Entertainment上Aviatrix的设计伙伴可以免费提前访问Aviatrix Cloud. 这应当与是否具备排雷的遏制控制加以区分。 页面中还有称，自动化在团队定义的护栏内运行，不修改由人所写的规则。
潜在的好处是将应用行为转化为可执行的政策的手工工作较少。 相应的业务要求是保持所有权的明确性：自动起草的规则需要明确的审查和晋升程序，特别是当应用程序观察到的行为可能已经包括不想要的连接时。
AI Agents为什么使可达性更加重要
Aviatrix的更广泛的AI工作量安全技术利用网络流量数据，DNS日志和云资产库存来发现agents，模型端点和相关基础设施。 公司形容这是安全小组识别AI用途的一种方法，而并不完全依赖于开发者仪器应用。
发现和遏制解决了不同的问题。 发现有助于确定哪些系统存在，在哪里连接。 一旦一项政策得到实施，其中哪些关系仍有可能由限制决定。
考虑agent需要一个模型提供者和一个经批准的内部服务。 如果agent受损，限制其网络路径可以减少数据被窃取或进一步访问的目的地。 它没有确定agent的提示、推理或授权行动是安全的；这些需要在其他层面进行控制。
这种区分保持了产品的AI关联性。 清除是指agent通过网络可以达到的界限，而主动防御则使用自动化来帮助维持这些界限。
免费方案和标准提供
Aviatrix 称所有企业都有资格享受其应对方案，涵盖出厂封堵、平面封堵和在11月1日至5月1日没有工作量上限的情况下在其地产防止入侵。 AWS市场招生 2026年11月1日开通。
团队可以从自由封闭评估开始。 网站将最初基于浏览器的自评分与随后利用客户数据进行的架构评估区分开来，后者提供了临时结果。 因此，最初的得分应被理解为调查的起点，而不是衡量每一可获取资源的清单。
根据其标准提议，清理工作包括评估和15个监测或执行工作量，没有时间限制。 新增能力按工作量计价，阿维亚特里克公司可提供定价。 公告称两种封装控制通过Aviatrix Cloud交付，也可在Aviatrix Entertainment上获取。
发布针对的是企业安全中长期存在的障碍：各组织经常同意工作量应较少接触，但在后果不确定时会犹豫不决地实施限制。 清除的重要性在于将这一安全目标与分阶段的作业程序联系起来 -- -- 观察拟议的政策，解决依赖性，执行，并保留一条明确的回路。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity
Aviatrix Launches Clearance to Contain Compromised Cloud and AI Workloads
Add Unite.AI to your preferred sources on Google
Aviatrix has launched Clearance, a cloud security offering designed to limit the damage a compromised workload can cause by restricting the destinations and other workloads it can reach. Its central proposition is operational as much as technical: security teams can test a restrictive policy against real traffic before allowing it to block production connections.
Announced October 26, Clearance combines outbound and lateral containment with an automated policy layer called Aviatrix Active Defense. The company is also making outbound containment, lateral containment, and intrusion prevention available to enterprises without a workload cap through a temporary response program running from November 1, 2026, to May 1, 2027.
For organizations deploying AI agents alongside conventional cloud applications, the underlying problem is increasingly consequential. An exploited service or manipulated agent may already have useful credentials and network access. Stopping the initial compromise remains essential, but the connections available afterward help determine whether that compromise stays local or spreads.
Default Deny With a Preview of the Consequences
Clearance runs on the Aviatrix Containment Platform, built on the company’s Cloud Native Security Fabric. It gives workloads an explicit set of permitted communication paths, with other paths denied by default.
Outbound Containment governs connections to external destinations, expressed by domain rather than only by network address. Lateral Containment governs communication between workloads by identity, extending the model across clouds and to resources such as containers, serverless functions, databases, and AI agents.
The deployment challenge is that legitimate application dependencies are often difficult to enumerate completely. A rule that appears correct during review can still interrupt a payment service, a background job, or an infrequently used integration.
Clearance addresses that risk with a Shadow Rule Set. A proposed policy first runs in monitor mode alongside the live policy, showing the traffic it would have denied without blocking those connections. Teams can identify required paths, revise permissions, and then switch to enforcement. Aviatrix says enforcement and rollback each require a single action.
This makes the preview an important part of the workflow, rather than a guarantee that a change cannot cause an outage. Traffic observed during one period may not include month-end processing, disaster recovery, or another rare but legitimate activity. Teams still need to choose observation periods and exceptions that reflect how their applications actually operate.
How Network Enforcement Fits Cloud Applications
On its product website, Aviatrix describes transparent insertion at the VPC level, preserving original addresses without requiring a host agent, SDK, or application code change. It also says policies can be represented through Terraform and Kubernetes custom resources, and orchestrated into security groups and Kubernetes NetworkPolicy where a gateway is unnecessary.
That matters because cloud infrastructure changes more quickly than a static address list. A container may move, a function may scale, and an application may span several networks. Expressing intent around the workload and its required destinations can make a policy more durable than treating every address change as a separate security decision.
The practical goal is to close communication paths an attacker could use without forcing every application team to adopt a new integration. Network containment nevertheless governs connectivity: an allowed connection can still carry harmful activity. It complements patching, identity controls, application security, and detection rather than making those controls unnecessary.
Active Defense Adds Automated Policy Maintenance
Aviatrix Active Defense is the offering’s autonomous layer. According to the announcement, its agents build a model of the customer’s environment, draft the policies applications need, evaluate them in monitor mode, and keep them current as workloads change. The resulting policies remain readable and editable by the security team.
“You cannot patch or detect your way out of this in the time you have, and this patch cycle runs into the holiday change freeze,” Aviatrix CEO Doug Merritt said in the announcement, explaining the company’s decision to offer a temporary containment backstop while customers assess and patch systems.
The website adds an important availability distinction: Active Defense is in free early access for design partners on Aviatrix Enterprise and is planned for Aviatrix Cloud. That should be distinguished from the availability of Clearance’s containment controls. The page also says the automation operates within team-defined guardrails and does not modify rules written by people.
The potential benefit is less manual work translating application behavior into enforceable policy. The corresponding operational requirement is to keep ownership clear: automatically drafted rules need a defined review and promotion process, especially when an application’s observed behavior may already include unwanted connections.
Why AI Agents Make Reachability More Important
Aviatrix’s broader AI workload security technology uses network flow data, DNS logs, and cloud asset inventory to discover agents, model endpoints, and related infrastructure. The company describes this as a way for security teams to identify AI use without depending entirely on developers instrumenting applications.
Discovery and containment solve different problems. Discovery helps establish which systems exist and where they connect. Containment determines which of those connections remain possible once a policy is enforced.
Consider an agent that needs a model provider and one approved internal service. Restricting its network paths can reduce the destinations available for data theft or further access if that agent is compromised. It does not establish that the agent’s prompts, reasoning, or authorized actions are safe; those require controls at other layers.
This distinction keeps the product’s AI relevance concrete. Clearance is about bounding what an agent can reach through the network, while Active Defense uses automation to help maintain those boundaries.
The Free Program and Standard Availability
Aviatrix says all enterprises qualify for its response program, covering outbound containment, lateral containment, and intrusion prevention across their estate without a workload cap from November 1 through May 1. AWS Marketplace enrollment opens November 1, 2026.
Teams can begin with a free Containment Assessment. The website distinguishes an initial browser-based self-score, which provides provisional results, from a subsequent architecture assessment using customer data. The initial score should therefore be understood as a starting point for investigation rather than a measured inventory of every reachable resource.
Under its standard offering, Clearance includes an assessment and 15 workloads in monitor or enforce mode without a time limit. Additional capacity is priced per workload, with pricing available from Aviatrix. The announcement says the two containment controls are delivered through Aviatrix Cloud and are also available on Aviatrix Enterprise.
The launch targets a persistent obstacle in enterprise security: organizations often agree that workloads should have less access, but hesitate to enforce restrictions when the consequences are uncertain. Clearance’s significance lies in connecting that security objective to a staged operational process—observe the proposed policy, resolve dependencies, enforce it, and retain a clear path back.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.