> ## Documentation Index > Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt > Use this file to discover all available pages before exploring further. # CNSF > Introduction to the Aviatrix Cloud Native Security Fabric (CNSF), providing zero trust security, network segmentation, and workload protection across multi-cloud environments. # Cloud Native Security Fabric (CNSF) **The missing security layer for the cloud era** ## What is Cloud Native Security Fabric? Cloud Native Security Fabric (CNSF) is a cloud runtime security control layer built **inside** the cloud network, not at the edge. It enforces Zero Trust between every cloud workload by inspecting, segmenting, and controlling workload-to-workload and workload-to-internet communications across regions, accounts, clouds, and data centers. **The Crisis**: The cloud has created the largest unguarded attack surface in enterprise history—the space between every workload. While security teams focused on the edge, adversaries moved inside, exploiting implicit trust to move laterally and exfiltrate data undetected. *** ## The Vision CNSF is the missing fabric-level control layer for the cloud era. A standard way to declare, enforce, and prove trust between workloads in real time, everywhere they run. **This is not a new category. It is a return to first principles** in a cloud era that's often prioritized speed over security. By embedding trust directly into the fabric of the cloud, CNSF defines the control layer that Zero Trust has lacked since workloads left the data center. **The Question**: The question is not whether Cloud Workloads need a security fabric—the breaches prove they do. The question is whether you'll build it proactively or reactively. The cloud will not wait, and neither will the adversaries exploiting the gaps that remain unaddressed. *** ## The Problem CNSF Solves The fortress is dead. For two decades, cybersecurity was defined by walls, perimeters, and the illusion of inside versus outside. But the cloud did not move the perimeter, **it vaporized it**. Modern applications are distributed across thousands of micro-perimeters: VPC/VNets, clusters, functions, and services Most tools watch from the outside while attacks spread inside through implicitly trusted east-west communication paths Sensitive inter-service communication now routinely traverses public infrastructure previously considered hostile territory Applications are transient ecosystems of short-lived components creating constantly evolving attack surfaces ### The New Reality Three irreversible shifts have fundamentally broken traditional security models: 1. **The Internet Became the Enterprise Network**: What was once your controlled internal network and the external internet have merged 2. **The Perimeter Became Exponentially Distributed**: Attack surface has atomized into thousands of individual points requiring defense 3. **Applications are Ephemeral and Deeply Distributed**: Transient ecosystems of containers, functions, and services with intricate, temporary dependencies **Critical Fact**: 25% of data breaches involve lateral movement, with hackers spending weeks or months silently moving between systems. The space between workloads has become the new primary battleground. *** ## Why CNSF is Different Unlike traditional security approaches that bolt on protection after the fact, CNSF is fundamentally different in four critical ways: ### Inline Enforcement **Real protection happens where packets flow** * Controls applied in the data plane—the actual forwarding path * Policy enforced in real time, not merely declared * Line-rate performance with predictable latency ### Agentless & Embedded **Security woven into the fabric, not bolted on** * No agents to deploy or manage * Lives in the data path by design * Travels with workloads across environments ### MultiCloud Consistency **Express intent once, enforce everywhere** * Same policy produces same results across AWS, Azure, GCP, OCI * Abstracts cloud provider differences * Uniform enforcement across hybrid environments ### Developer-Ready **Fits existing workflows** * Deep [Terraform](https://registry.terraform.io/providers/AviatrixSystems/aviatrix/latest/docs) and IaC integration * No application code changes required * Preserves development velocity *** ## Core Capabilities ### Identity-Aware Segmentation * Define who/what can communicate based on labels, identity, and context * Stop lateral movement with deny-by-default policies * Dynamic trust boundaries that adapt to infrastructure changes ### Egress Governance * Explicit allow-lists for approved SaaS/ERP and external services * Eliminate common data exfiltration paths * Monitor and control outbound communications ### Inline Encryption & High-Performance Transport * Protect data in motion across sites, regions, and clouds * Quantum-resistant encryption for future threats * Deterministic performance across multicloud topologies ### Kubernetes & Cloud-Native Coverage * Consistent fabric-level policy for east-west pod/service traffic * Secure ephemeral container communications * No application rewrites required *** ## How CNSF Works Captures intent (segments, trust zones, egress rules) and programs the fabric consistently across environments Applies policy inline where workloads actually communicate—between services, VPC/VNets, clusters, and on hybrid links Identity, posture, and labels refine decisions dynamically, keeping policy accurate as infrastructure changes Continuous enforcement that scales with workload creation, movement, and destruction *** ## The Accelerants: K8s and GenAI Two Board-mandated initiatives are exponentially increasing the urgency for CNSF: ### Kubernetes Complexity * **96% of enterprises** use Kubernetes with complex, ephemeral networking * Securing east-west traffic between thousands of pods * Consistent policy across multi-cluster deployments ### Generative AI & "Shadow AI" * Autonomous agents and AI-powered tools proliferating within environments * AI systems designed to pull data from anywhere and communicate extensively * New communication patterns bypassing traditional controls **Shadow AI Crisis**: As "Shadow IT" emerged in the early cloud era, autonomous AI deployment creates communication pathways that bypass conventional security controls. *** ## CNSF in the Security Ecosystem CNSF does not replace your security stack—**it activates it** where existing tools cannot reach: **CNAPP & Posture Tools**\ They find misconfigurations; CNSF enforces cloud runtime communication policies derived from those insights **Endpoint/XDR**\ They protect hosts; CNSF protects the paths between hosts and services **SASE/Zero Trust Access**\ They govern user-to-app; CNSF governs service-to-service and workload-to-internet after access is granted **NGFWs**\ They provide ingress/egress defense; CNSF extends Zero Trust inside the cloud runtime fabric *** ## Measurable Outcomes Deny-by-default segmentation prevents unauthorized movement between workloads Governed egress and encrypted paths eliminate common data loss vectors Uniform policy, evidence, and trust-zone visibility across all clouds Standardized controls that move with workloads and align to DevOps/IaC *** ## Key Use Cases 1. **Enforce Zero Trust** for cloud workloads across multiple CSPs and regions 2. **Govern and monitor egress** to external services/SaaS to prevent data loss 3. **Segment Kubernetes** services/pods without application rewrites 4. **Secure hybrid communications** (data center ↔ cloud) with consistent policy 5. **Control GenAI/agentic systems** communications safely *** ## Zero Trust Alignment CNSF directly supports the core pillars of the CISA Zero Trust Maturity Model: * **Network**: Dynamic segmentation and encrypted communications * **Application**: Service-to-service trust enforcement * **Data**: Protection of data in motion between workloads Plus all four cross-cutting capabilities: Visibility, Analytics, Automation, and Governance. *** ## Learn More Ready to explore CNSF further? Continue with the detailed implementation guides and architectural overviews: * CNSF Architecture * Use Cases & Solutions