Picosegmentation
Microsegmentation made networks safer: no computer reaches another unless a rule allows it. Picosegmentation does the same in the code. No part of a program reaches another unless a gate allows it.
Every effect has its zone.
Everything in code produces an effect. An admin password just as much as a simple HTTP request. That is why Picosegmentation divides program code into layers and zones.
Everything that comes in: data from the network, files, user input.
Everything that goes out: responses, files, commands to other systems.
Between two zones there is exactly one crossing, the gate. There is no second way.
An effect only arises at a gate in the code.
The gate decides whether an operation may take place. From this follows the most important rule: an error may sit in its zone. It cannot be used for the effect of another zone, because there is no path to get there.
Computer science has known the individual building blocks for decades, such as permissions on objects, type checking and separated privileges. The protection only comes from the closed architecture that joins them into one whole in the code. Aviontex developed this architecture.
Picosegmentation is the level in the code.
The SI prefix security model arranges protection in five levels. The names are familiar from units such as micrometer and nanometer: each step is finer than the last.
| Level | What is separated | Aviontex |
|---|---|---|
| Micro | Network and connections | AviontexDNS |
| Nano | Processes and sandboxes | AviontexDNS |
| Pico | Program code: layers and zones | Picosegmentation in AviontexDNS |
| Femto | Hardware | |
| Atto | Chip microarchitecture |
No level replaces another. A boundary where checking stops is a gap. Microsegmentation closes that gap in the network. Picosegmentation closes it in the code, which is where errors actually arise.
Security that does not come afterwards.
Today security is usually sought after the fact: write code, find the hole, ship a patch. Picosegmentation turns that around.
Whole classes of errors disappear
Every piece of software has errors in its code. With Picosegmentation they have no path to an effect. Data from the network stays data. It never becomes program code, control or configuration. Attacks such as injection lose their foundation, not just a single hole.
Errors show up while writing
Every effect needs its gate. Anyone trying to produce an effect without a gate notices it at once. Decisions are made at a few named places and every rejection states its reason.
Tampering leads to a standstill
Every operation needs a clearance that can only arise at its intended gate. Changing the code breaks this chain. The software then stops instead of quietly running with altered rules.
What if PHP had been built this way?
In October 2026, PHP servers around the world had to be updated urgently. Two holes in the PHP core allowed remote code execution without authentication (CVE-2026-109618 and CVE-2026-109619).
Both follow the same pattern as many holes before them: something that should only ever be data reaches an effect it was never meant for. With Picosegmentation that path does not exist. This holds not for single holes but for whole classes, from SQL injection to cross-site scripting.
No fresh start needed.
Nobody has to change millions of lines of code at once. Just as microsegmentation grows segment by segment in a running network, Picosegmentation grows zone by zone in the code.
You start at the critical point, where data turns into an effect: where data comes in from the network, where things are stored and where something is executed. That single gate already takes one path away from an attack. Nothing changes on the outside: interfaces and behavior stay the same.
AviontexDNS
Our DNS servers are picosegmented. Origin, checking, storing and serving an answer are separate zones with their own gates. An answer is not true just because it arrived.