Aviatrix puts boundaries in the cloud

At Republic Airways, the clouds were connected. That was part of the problem. Private data centers, Amazon Web Services and Microsoft Azure had been stitched together with native tools, VPN tunnels and traditional appliances. Connections existed. A coherent view of those connections was harder to come by. Tunnels were unstable. Finding the fault meant looking across tools that did not share the same picture.

Aviatrix’s published case study reports that, after the airline adopted its Cloud Native Security Fabric, mean time to repair fell from days to under an hour. Regional deployments moved from multiple days to the same day. The useful detail is the mechanism: shared telemetry, encrypted connectivity and a common place to manage policy.

01 / THE ORIGINAL INSIGHTA pilot sees the gap

Sherry Wei founded Aviatrix in 2014 after a career that included Cisco. Her observation was practical: traditional networking assumptions did not travel neatly into the public cloud. Companies could rent computing capacity quickly, yet connecting and governing it created another engineering problem. According to Aviatrix’s anniversary history, its first product helped customers extend data centers into AWS.

The name means female aviator, a nod to Wei. The destination expanded. Enterprises accumulated clouds, regions and private networks, each with its own vocabulary and controls. Aviatrix developed a software layer for operating across them. Its expertise sits in that awkward middle ground between network engineering, cloud automation and security policy.

The engineering work also has a human footprint. Aviatrix describes a remote-first culture and names curiosity, empathy and a team-first mindset among its values. Its public engineering interviews emphasize autonomy and collaboration on difficult networking problems. These are the company’s descriptions of itself, but they fit a product whose daily work involves making different systems cooperate.

The ambition attracted capital. In September 2021, TCV led a $200 million Series E at a $2 billion valuation. That valuation belongs to that financing, rather than serving as a current price tag. Doug Merritt, formerly Splunk’s CEO, was announced as chairman, CEO and president in June 2023.

02 / TOO MANY ROUTESThe hotel with too many routes

IHG Hotels & Resorts offers a second way to understand the business. Its applications operated across AWS and Google Cloud. The company initially used each provider’s native networking constructs, then found it needed a common operational view across regions and providers. Every individual cloud could make sense while the combined network became difficult to follow.

IHG deployed Aviatrix’s software overlay to connect virtual private clouds without sending traffic on a detour through its on-premises data center. Automated route propagation, firewall insertion and encrypted links became parts of the same architecture. Equinix extended that operating model through regional performance hubs. For a hotel business, application availability has a direct commercial purpose: guests need the services to work.

This is Aviatrix’s place in the market. It sits above cloud infrastructure, selling consistency across environments that remain different underneath. Native cloud services are alternatives, as are overlapping networking and firewall products from Cisco, Palo Alto Networks, Fortinet and Check Point. Aviatrix’s argument rests on shared operations and distributed enforcement across the estate.

03 / THE COMMERCIAL REALITYThe price of a common rulebook

Aviatrix sells enterprise software through contracts, partners and cloud marketplaces. Buyers can encounter metered network licensing or managed firewall packages. One public AWS Marketplace listing prices a five-node managed Cloud Firewall package at $27,700 for twelve months, including advanced security entitlements, implementation for those nodes and round-the-clock support. Additional AWS infrastructure costs may apply.

That makes the evaluation concrete. Count the software, cloud resources, deployment work and ongoing operations. Then compare the whole arrangement with the tools and labor it replaces. A team running a modest environment in one cloud may have little reason to add another control layer. The business case becomes more interesting as environments multiply and troubleshooting crosses organizational boundaries.

04 / THE NEXT BOUNDARYAfter someone gets in

The security proposition follows naturally from the networking work. A network knows which workloads can communicate. Put enforcement along those paths, and it can restrict communication before a compromised machine starts exploring its neighbors. Aviatrix calls its architecture a Cloud Native Security Fabric: shared policy with distributed enforcement, rather than requiring every decision to happen at a central traffic bottleneck.

The product catalog puts names to those jobs. Distributed Cloud Firewall supplies segmentation and outbound traffic control. SmartGroups organize policy around workload context, including cloud tags and Kubernetes labels, reducing reliance on address lists. Secure Datacenter Edge handles the connections back to private infrastructure. CoPilot supplies operational visibility. Together, these components address both the question of where a packet should go and whether it should be allowed to get there.

AI gives the idea another customer. Across AI adopted Aviatrix to apply consistent segmentation and runtime visibility across public cloud, private infrastructure and customer-controlled deployments. Its enterprise clients wanted deployment flexibility without losing security controls. An agent still needs connections to do its job; those connections also define how far a mistake or compromise can travel.

“The internet was not built for security.”

DOUG MERRITT / AI SECURITY PODCAST

In April 2026, Aviatrix announced AgentGuard in early access alongside its containment positioning. It joined the Open Information Security Foundation in June, identifying Suricata as its embedded intrusion prevention engine. September brought Harvest and Decrypt Protection. The launch described ML-KEM key establishment on the control plane; hybrid ML-KEM on the data plane remained on the roadmap. Product boundaries matter here, too.

The lesson a reader can copy starts before buying software: map the conversations an application needs, identify their owners, and test a narrow policy before expanding it. Containment depends on traffic actually passing through enforcement and on rules matching real dependencies. A beautifully drawn boundary in the wrong place can interrupt legitimate work. Republic’s experience points toward the goal: fewer disconnected tools to consult when a connection goes wrong.