Default Deny Without the Outage: Containing AI Agents on Every Path – Aviatrix Triple-T
AI agents now run inside production cloud estates with valid credentials, broad network reach, and the ability to act faster than any human reviewer. Attackers have adjusted. Eighty-two percent of intrusions use valid credentials, and the median time to exploit a newly disclosed vulnerability is now -7 days. Detection and patching cannot close that gap on their own. The outcome depends on blast radius: the sum of what a compromised workload can reach.
Most teams know default deny is the answer and avoid it anyway, because one wrong rule can take down a revenue-generating application. In this session, Chris McHenry, Chief Product Officer at Aviatrix, shows how practitioners enforce an explicit communication policy for every workload, on both outbound and lateral paths, across every cloud, without breaking production, and without slowing developers down. Attendees will leave with a five-property test for evaluating any containment architecture and a practical sequence for moving from observation to enforcement.
Chris McHenry is Chief Product Officer at Aviatrix, where he leads product strategy and development for the Cloud Native Security Fabric. His work centers on a practical question facing every enterprise that runs AI in the cloud: when a workload or AI agent is compromised, how far can it reach? Chris works directly with security and network architects at large enterprises to reach default deny in production across multicloud estates, governing both what leaves the estate and what moves laterally inside it, without disrupting the applications that run the business.
