If one application is compromised, how much of your company goes with it?

That is a question I would like to hear more often in security budget meetings. We ask how many vulnerabilities have been found, how quickly patches are applied and how long it takes to detect an intruder. Those are useful questions. They still leave a business owner wondering whether one bad afternoon can shut down the company.

The answer depends in part on what the compromised system can reach. Can it communicate with production systems? Retrieve customer records? Access backup infrastructure? Send information to an outside destination nobody approved?

Containment puts limits on those possibilities before the incident. It gives an enterprise a way to reduce the consequences of a security failure while the work of detecting, investigating and fixing that failure proceeds.

Recent developments at Aviatrix and IonQ give us reason to examine this more closely. Both are connecting containment with cryptographic protection, from different starting points. The larger story is what enterprises stand to gain when those responsibilities are managed together.

Assume a Failure. Limit Its Reach

Segmentation and least privilege have been part of security for years. We do not need to pretend someone just discovered that unrestricted access creates risk.

What deserves attention is how consistently those principles survive contact with a working enterprise.

An application needs a new connection. A team is under pressure to deploy. A temporary exception remains after the project ends. An acquisition introduces another network. Over time, access can extend well beyond what the original business requirement justified.

Each decision may have seemed reasonable when it was made. The accumulated reach is what an attacker gets to explore.

Containment makes that reach an explicit security responsibility. An application should be able to perform its work within enforced limits. Those limits should remain useful even before anyone knows the application has been compromised.

That last point is critical. Detection takes time, and an alert still requires a response. A restriction already in place can prevent a connection while the security team is determining what happened.

There will be trade-offs. An overly restrictive policy can interrupt legitimate work. Enterprises need to understand dependencies, test proposed changes and give operations teams a workable path to enforcement. A policy that never makes it beyond a planning document provides little comfort during an incident.

Follow the Business Into the Cloud

The reach of a compromise does not necessarily stop at the boundary of the environment where it began.

A business process can connect an employee device, an application in a public cloud, an internal database and a third-party service. Security teams need to understand the permissions and communication paths across that process.

The Thales 2025 Cloud Security Study reported that 54% of cloud data was classified as sensitive, compared with 47% in 2024. Respondents used an average of 2.1 public cloud providers. Thales’s 2026 Data Threat Report findings included another concern: only 34% of organizations knew where all their data resided.

That is a difficult starting position for deciding what should be allowed to reach it.

AI agents add another reason to examine those decisions. An agent may need access to several applications to complete useful work. Giving it that access also creates responsibilities around the credentials it uses, the information it can retrieve and the destinations it can contact.

An organization should be able to explain those boundaries before expanding the agent’s authority. It should also understand where network controls need to work alongside identity and application controls. Limiting a connection does not, by itself, determine every action permitted through it.

Control the Path and Protect the Information

Containment becomes more useful when the discussion includes the information moving across permitted connections.

Consider an application authorized to retrieve customer records. If compromised, it might attempt to access another database or send those records to an unauthorized destination. Segmentation and outbound communication controls can limit those opportunities.

The approved connection to its own database still needs protection. Encryption helps preserve confidentiality if that traffic is intercepted. Encrypting a transfer to an attacker-controlled destination, however, does not make the transfer acceptable.

These responsibilities concern the same records, and enterprises have good reason to coordinate them.

Aviatrix’s Harvest and Decrypt Protection, introduced in September, is one example. The company combines encryption, outbound communication governance and crypto agility on its cloud networking platform, using enterprise-controlled keys.

Doug Merritt’s framework brings together four responsibilities: Govern what leaves, govern lateral movement, encrypt communications and support cryptographic change. I find that useful because it connects decisions that can otherwise become separate projects with separate owners.

As I wrote in my September article on enterprise quantum security, buyers need to understand the protections on their actual production paths. Aviatrix’s quantum-safe positioning and continuing roadmap belong in that practical context.

The longer-term concern is that intercepted information can remain valuable for years. A business may retire an application while its medical records or engineering designs remain sensitive. Preparing cryptographic protection for that lifetime is a current responsibility, even though the timing of a quantum computer capable of breaking widely used public-key cryptography remains uncertain.

A Substantial Investment in the Same Direction

IonQ’s agreement to acquire Elisity provides another indication of the business interest in connecting these capabilities.

The proposed all-stock transaction is valued at up to $1.3 billion, including performance-based earnouts, and is expected to close in the fourth quarter of 2026, subject to customary conditions and regulatory approval.

Elisity contributes identity-based policy enforcement and enterprise deployment experience. IonQ brings post-quantum cryptography and quantum key distribution capabilities from its existing security business. The proposed combination would connect restrictions on access and attack propagation with cryptographic protection.

Elisity’s platform uses identity and contextual information to inform communication policy, with enforcement through supported network infrastructure. Its ability to simulate policies before enforcement addresses an important operational concern: reducing exposure while keeping essential services running.

The significance extends beyond the transaction. My reading is that this investment reflects the value of connecting advanced security technology with the policies enterprises can actually operate. Customers need protection they can introduce, maintain and adjust as the business changes.

What Did We Actually Reduce?

Containment also creates an opportunity to improve how we discuss security results.

Two businesses could report the same number of vulnerabilities while facing very different consequences from a compromise. In one, an affected workload might reach several critical systems. In the other, enforced restrictions might substantially limit that access.

The vulnerability count alone does not explain the difference.

Aviatrix’s work on Blast Radius Economics and Reachable Value at Risk attempts to connect technical reach with business exposure. Its deeper containment assessment is described as examining runtime flows and estimating exposure in dollars.

This is a developing approach, and its value will depend on credible inputs and validation. But the management question it addresses deserves attention: Which change in our security architecture reduces the most consequential exposure?

A board should be able to understand why restricting a particular set of connections matters to revenue, service delivery or sensitive information. Security teams should be able to explain what remains reachable after those changes, including the access the business legitimately requires.

That is where I would put more of the conversation. We can acknowledge the difficulty of keeping every attacker out and still demand better control over what happens after a failure.

A hospital needs to keep delivering care. A manufacturer needs to keep production running. A business needs to protect its customers and continue operating while an incident is resolved.

Containment should help make those outcomes possible. One compromised system should not get a free pass through the rest of the company.