What is Aviatrix?
Aviatrix describes itself as the network containment company. Its main product on aviatrix.ai, Aviatrix Clearance, sets what every cloud workload may reach before any attack, covering egress to the internet and traffic between workloads. Each workload gets clearance for the destinations and other workloads it needs, and everything else is denied by default. The policy is enforced in the network with nothing to install and nothing to detect first, so a compromised workload stays where it is.
Kubernetes is covered too: policy follows the pod rather than the node address, and pod egress through node NAT is governed like any other path. Alongside this, the documentation covers Aviatrix's cloud networking platform for deploying, configuring and managing multi-cloud networking infrastructure. The docs state that they cover both self-managed and cloud-hosted versions of the platform.
The platform is positioned across AWS, Azure, GCP and OCI, and the company has moved its web presence from aviatrix.com to aviatrix.ai. Pricing is not public in the pages checked, so confirm licensing and cloud infrastructure costs directly with the vendor.
Key capabilities
- Workload clearance Allow-lists for each workload's destinations and peers.
- Default deny Everything not cleared is blocked.
- Network enforcement Nothing to install on workloads.
- Kubernetes policy Rules follow the pod, not the node address.
- Cloud networking platform Multi-cloud networking infrastructure with documentation.
- Deployment choice Self-managed or cloud-hosted versions.
Where Aviatrix fits
- Network containment Aviatrix Clearance sets what every cloud workload may reach before any attack, so a compromised workload stays where it is.
- Outbound containment A workload reaches only the outside destinations it is cleared for, named by domain rather than IP, with default deny at every workload and no central firewall in the path.
- Lateral containment A workload reaches only the other workloads it is cleared for, by identity.
- Kubernetes Policy follows the pod rather than the node address, and pod egress through node NAT is governed like any other path.
- AI workloads Every agent is discovered from flow and DNS, including ones no one authorized, and cleared for its own job.
- Other workloads VMs, serverless functions, databases and platform services get the same clearance, by identity, across every cloud.
- Assessment and platform The browser-based Self-Score reports a provisional Blast Radius, and the documentation covers deploying and managing multi-cloud networking infrastructure.
Reviews of Aviatrix
Be the first to share your experience with Aviatrix.
Write a review
Loading review form…
Alternatives to Aviatrix
ScanopyScanopy scans networks on a schedule with daemons for Linux, macOS, Windows, FreeBSD or Docker and builds L2, L3, workload and application topology views plus a device inventory. AGPL-3.0 Community Edition, commercial licenses and Scanopy Cloud.
UnTangledUnTangled is a GPL-2.0-or-later web interface for OpenWRT 23.05 and newer. It adds a Network Map, device controls, mesh Wi-Fi, parental schedules, VPN, QoS and firewall screens at /untangled/, while LuCI stays available at the root path.