网络安全
Aviatrix 发布清除压缩云和AI 工作量
在 Google 上的首选来源中添加 Unite.AI
Aviatrix拥有发布清除系统，这是一个云层安全装置，旨在通过限制目的地和它能够达到的其他工作量来限制受损工作量可能造成的损害。 其中心命题与技术命题一样可操作：安全小组在允许其阻断生产连接之前，可以测试针对实际交通的限制性政策。
宣布 October 26,"清除"结合了出入境和横向封隔，与一个称为Aviatrix Active Defense的自动化政策层。 该公司还通过一个从2026年11月1日至2027年5月1日的临时应对方案，为没有工作量上限的企业提供外出封隔、横向封隔和入侵预防。
对于部署AI agents和常规云应用的组织来说，其根本问题越来越严重。 被利用的服务或被操纵的agent可能已经具有有用的资质和网络访问。 停止最初的妥协仍然至关重要，但事后可用的联系有助于确定这种妥协是留在当地还是分散。
带有后果预览的默认拒绝
Aviatrix 控制平台的清理工作，它为工作量提供了一套明确的允许通信路径，其他路径默认被拒绝。
外部封装规范与外部目的地的连接，用域名表示，而不仅仅是网络地址表示。 横向约束通过身份来规范工作量之间的沟通，将模型延伸至云端，并扩展到容器，无服务器功能，数据库，以及AI agents等资源。
部署方面的挑战是，合法应用的依赖性往往难以完全列举。 在审查期间看来正确的规则仍然可以中断付款服务、背景工作或很少使用的整合。
以暗影规则处理这个风险一项拟议的政策首先在监控模式下与直播政策并列运行，显示它本来会拒绝的流量而不阻断这些连接。 团队可以识别所需的路径，修改权限，然后切换到执行。 Aviatrix 称执行和回滚每个需要单项行动。
这使得预览成为工作流程的重要部分，而不是保证改变不会导致停产。 在一个期间观察到的流量可能不包括月终处理、灾后恢复或另一种罕见但合法的活动。 各小组仍然需要选择反映其应用程序实际运作的观察期和例外。
网络执法如何适应云应用
在其产品网站上，Aviatrix描述了VPC层面的透明插入，保留原始地址而不需要主机agent,SDK，或应用程序代码更改。 也可以通过Terraform和Kubernetes自定义资源来代表称政策，并编组成安全小组和Kubernetes网络政策，在其中不需要网关。
这很重要，因为云基础设施的变化比固定地址清单要快。 容器可以移动，功能可以缩放，应用程序可以跨越多个网络。 围绕工作量及其所需目的地表达意向，可使政策比将每个地址的变化作为单独的安保决定来对待更为持久。
实际目标是关闭攻击者可以使用的通信路径，而不必强迫每个应用团队采用新的整合。 尽管如此，网络封隔仍然制约着连接：允许的连接仍然可以进行有害的活动。 它补充了补丁、身份控制、应用安全和检测，而不是使这些控制变得没有必要。
主动防御新增自动政策维护
Aviatrix Active Defense是供货的自主层。 根据公告，其agents构建了客户环境的模型，起草了需要的政策应用，在监控模式中评价，并随着工作量的变化而保持时常。 由此产生的政策仍可供安保小组阅读和编辑。
Aviatrix CEO Doug Merritt 称在公告中解释公司决定在客户评估及补丁系统的同时提供临时封装后退。
网站新增是一个重要的可用性区分：Aviatrix Entertainment上Aviatrix的主动防守在设计伙伴的免费早期访问，并计划为Aviatrix Cloud. 这应当与是否具备清除装置的控制加以区分。 该页还使用称，自动化在团队定义的护栏内操作，不修改由人编写的规则。
潜在的好处是将应用行为转化为可执行的政策的手工工作较少。 相应的操作要求是保持所有权的明确性：自动起草的规则需要明确的审查和晋升程序，特别是在应用程序观察到的行为可能已经包括不想要的连接时。
AI Agents为什么使可获取性更加重要
Aviatrix的更广泛的AI工作量安全技术利用网络流数据，DNS日志和云资产库存来发现agents，模型端点和相关基础设施。 公司将此描述为安全团队在不完全依赖开发者仪器应用的情况下识别AI用途的一种方式。
发现和遏制解决了不同的问题。 发现有助于确定哪些系统存在，在哪里连接。 一旦一项政策得到实施，其中哪些联系仍有可能存在。
考虑agent需要一个模型提供者和一个经批准的内部服务。 如果agent受损，限制其网络路径可以减少数据盗窃或进一步访问的目的地。 它没有确定agent的提示、推理或授权行动是安全的；这些需要在其他层面进行控制。
这种区分保持了产品的AI关联性。 清除是指agent可以通过网络达到的界限，而主动防御则使用自动化帮助维持这些界限。
免费方案和标准的提供
Aviatrix 称所有企业都有资格享受其应对方案，涵盖出厂封堵，横向封堵，在11月1日至5月1日没有工作量上限的情况下在其地产防止入侵。 AWS市场招生于2026年11月1日开通。
团队可以从自由封禁评估开始。 网站将基于浏览器的初始自评分与随后利用客户数据进行的架构评估区分开来，后者提供了临时结果。 因此，最初的得分应理解为调查的起点，而不是衡量每一可获取资源的清单。
根据其标准提议，清理工作包括评估和15项监测或执行工作，没有时间限制。 额外能力按工作量计价，阿维亚特里克斯公司可提供定价。 公告称两种封装控制通过Aviatrix Cloud交付，也可在Aviatrix Entertainment上获得。
发布针对的是企业安全方面一个长期存在的障碍：各组织经常同意工作量应较少接触，但在后果不确定时会犹豫执行限制。 清除的重要性在于将这一安全目标与一个分阶段的行动进程联系起来 -- -- 观察拟议的政策，解决依赖性，执行这项政策，并保持一条明确的回路。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity
Aviatrix Launches Clearance to Contain Compromised Cloud and AI Workloads
Add Unite.AI to your preferred sources on Google
Aviatrix has launched Clearance, a cloud security offering designed to limit the damage a compromised workload can cause by restricting the destinations and other workloads it can reach. Its central proposition is operational as much as technical: security teams can test a restrictive policy against real traffic before allowing it to block production connections.
Announced October 26, Clearance combines outbound and lateral containment with an automated policy layer called Aviatrix Active Defense. The company is also making outbound containment, lateral containment, and intrusion prevention available to enterprises without a workload cap through a temporary response program running from November 1, 2026, to May 1, 2027.
For organizations deploying AI agents alongside conventional cloud applications, the underlying problem is increasingly consequential. An exploited service or manipulated agent may already have useful credentials and network access. Stopping the initial compromise remains essential, but the connections available afterward help determine whether that compromise stays local or spreads.
Default Deny With a Preview of the Consequences
Clearance runs on the Aviatrix Containment Platform, built on the company’s Cloud Native Security Fabric. It gives workloads an explicit set of permitted communication paths, with other paths denied by default.
Outbound Containment governs connections to external destinations, expressed by domain rather than only by network address. Lateral Containment governs communication between workloads by identity, extending the model across clouds and to resources such as containers, serverless functions, databases, and AI agents.
The deployment challenge is that legitimate application dependencies are often difficult to enumerate completely. A rule that appears correct during review can still interrupt a payment service, a background job, or an infrequently used integration.
Clearance addresses that risk with a Shadow Rule Set. A proposed policy first runs in monitor mode alongside the live policy, showing the traffic it would have denied without blocking those connections. Teams can identify required paths, revise permissions, and then switch to enforcement. Aviatrix says enforcement and rollback each require a single action.
This makes the preview an important part of the workflow, rather than a guarantee that a change cannot cause an outage. Traffic observed during one period may not include month-end processing, disaster recovery, or another rare but legitimate activity. Teams still need to choose observation periods and exceptions that reflect how their applications actually operate.
How Network Enforcement Fits Cloud Applications
On its product website, Aviatrix describes transparent insertion at the VPC level, preserving original addresses without requiring a host agent, SDK, or application code change. It also says policies can be represented through Terraform and Kubernetes custom resources, and orchestrated into security groups and Kubernetes NetworkPolicy where a gateway is unnecessary.
That matters because cloud infrastructure changes more quickly than a static address list. A container may move, a function may scale, and an application may span several networks. Expressing intent around the workload and its required destinations can make a policy more durable than treating every address change as a separate security decision.
The practical goal is to close communication paths an attacker could use without forcing every application team to adopt a new integration. Network containment nevertheless governs connectivity: an allowed connection can still carry harmful activity. It complements patching, identity controls, application security, and detection rather than making those controls unnecessary.
Active Defense Adds Automated Policy Maintenance
Aviatrix Active Defense is the offering’s autonomous layer. According to the announcement, its agents build a model of the customer’s environment, draft the policies applications need, evaluate them in monitor mode, and keep them current as workloads change. The resulting policies remain readable and editable by the security team.
“You cannot patch or detect your way out of this in the time you have, and this patch cycle runs into the holiday change freeze,” Aviatrix CEO Doug Merritt said in the announcement, explaining the company’s decision to offer a temporary containment backstop while customers assess and patch systems.
The website adds an important availability distinction: Active Defense is in free early access for design partners on Aviatrix Enterprise and is planned for Aviatrix Cloud. That should be distinguished from the availability of Clearance’s containment controls. The page also says the automation operates within team-defined guardrails and does not modify rules written by people.
The potential benefit is less manual work translating application behavior into enforceable policy. The corresponding operational requirement is to keep ownership clear: automatically drafted rules need a defined review and promotion process, especially when an application’s observed behavior may already include unwanted connections.
Why AI Agents Make Reachability More Important
Aviatrix’s broader AI workload security technology uses network flow data, DNS logs, and cloud asset inventory to discover agents, model endpoints, and related infrastructure. The company describes this as a way for security teams to identify AI use without depending entirely on developers instrumenting applications.
Discovery and containment solve different problems. Discovery helps establish which systems exist and where they connect. Containment determines which of those connections remain possible once a policy is enforced.
Consider an agent that needs a model provider and one approved internal service. Restricting its network paths can reduce the destinations available for data theft or further access if that agent is compromised. It does not establish that the agent’s prompts, reasoning, or authorized actions are safe; those require controls at other layers.
This distinction keeps the product’s AI relevance concrete. Clearance is about bounding what an agent can reach through the network, while Active Defense uses automation to help maintain those boundaries.
The Free Program and Standard Availability
Aviatrix says all enterprises qualify for its response program, covering outbound containment, lateral containment, and intrusion prevention across their estate without a workload cap from November 1 through May 1. AWS Marketplace enrollment opens November 1, 2026.
Teams can begin with a free Containment Assessment. The website distinguishes an initial browser-based self-score, which provides provisional results, from a subsequent architecture assessment using customer data. The initial score should therefore be understood as a starting point for investigation rather than a measured inventory of every reachable resource.
Under its standard offering, Clearance includes an assessment and 15 workloads in monitor or enforce mode without a time limit. Additional capacity is priced per workload, with pricing available from Aviatrix. The announcement says the two containment controls are delivered through Aviatrix Cloud and are also available on Aviatrix Enterprise.
The launch targets a persistent obstacle in enterprise security: organizations often agree that workloads should have less access, but hesitate to enforce restrictions when the consequences are uncertain. Clearance’s significance lies in connecting that security objective to a staged operational process—observe the proposed policy, resolve dependencies, enforce it, and retain a clear path back.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.