When patching can't keep pace and protection can't wait

Nirav ShahSVP, Product and Solution Marketing | F5

For years, application security has operated on a familiar assumption: when a vulnerability is discovered, organizations have time to assess the risk, develop or obtain a patch, test it, and deploy it before attackers can exploit the weakness.

Artificial intelligence is making that assumption increasingly dangerous.

AI is accelerating vulnerability discovery, reconnaissance, exploit development, and attack automation. As these capabilities become more sophisticated, attackers can identify and exploit weaknesses at speeds that traditional security and development processes were never designed to match. In some cases, exploitation begins before vulnerabilities are even publicly disclosed.

The implications extend well beyond the need to patch faster. Organizations must rethink how they protect applications and APIs when the time required to fix a vulnerability can far exceed the time attackers need to exploit it. This is a topic I address in depth during my session, “WAAP for the post-Mythos world” in the virtual, on-demand F5 Post-Mythos Security Summit.

As I discuss in my session, the answer starts with recognizing that immediate protection and permanent remediation are two distinct challenges. Here are three ways security leaders should rethink their approach as that gap continues to grow.

1. Recognize that the exposure gap has become structural

Security teams have devoted years to improving vulnerability management and accelerating patch deployment. Those efforts remain essential. But there's a fundamental limit to how quickly organizations can safely modify applications and infrastructure.

Patches must be evaluated, tested, and deployed. Development teams must consider application dependencies, operational stability, and the possibility that an emergency fix could introduce new problems. For enterprises managing thousands of applications across multiple environments, these processes are necessarily complex.

Meanwhile, AI is changing the attacker's side of the equation.

The growing ability to automate vulnerability discovery and exploitation means attackers can operate at machine speed, while defenders remain constrained by development cycles and operational requirements. Even the most efficient security organizations cannot eliminate that mismatch simply by asking their teams to work faster.

This creates a structural exposure gap. Vulnerabilities can become exploitable long before organizations can safely deploy permanent fixes. And as AI continues to advance, the gap threatens to become even more difficult to manage.

The question security leaders must confront is no longer just how to accelerate patching, but also how to protect their organizations when patching cannot happen fast enough.

2. Protection and remediation require different timelines

Addressing this challenge requires a change in thinking. Traditionally, vulnerability management has focused heavily on remediation: identify the weakness, prioritize it, and eliminate it as quickly as possible. But when exploitation can precede the availability of a patch, organizations cannot afford to make protection entirely dependent on remediation.

They need to separate the two. Permanent remediation addresses the underlying vulnerability. Immediate protection, meanwhile, focuses on preventing attackers from exploiting that vulnerability while remediation is underway.

This distinction is particularly important for business-critical applications. Rushing an untested patch into production can introduce operational risks of its own. Yet delaying deployment while following established change-control procedures can leave the organization exposed.

Virtual patching offers one way to address this dilemma. By applying protective controls outside the vulnerable application, organizations can block known exploitation techniques without immediately modifying the underlying code.

Importantly, virtual patching is not a substitute for fixing vulnerabilities. Nor does it eliminate every possible attack path. Its value lies in reducing exposure while development and security teams complete the work necessary for permanent remediation.

In other words, organizations need the ability to respond to immediate threats without making every security incident an emergency application release. And that requires an architectural approach to application protection.

3. Architecture must bridge the gap

When threats move faster than application development and deployment cycles, protection must be able to operate independently of those cycles.

This is where modern web application and API protection (WAAP) (https://www.f5.com/solutions/web-app-and-api-protection) takes on an increasingly impactful role. By providing security controls in the application data path, WAAP can help organizations detect and block malicious activity before it reaches vulnerable applications. Capabilities such as web application firewalls, API security, bot defense, and DDoS mitigation provide complementary layers of protection.

The architectural advantage is significant. Organizations can apply protective controls without necessarily waiting for changes to application code, giving development teams additional time to investigate vulnerabilities and implement permanent fixes.

But the challenge is becoming more complicated.

Today's application environments extend beyond traditional web applications. Enterprises increasingly depend on APIs, AI-powered applications, and autonomous agents that introduce new interactions, dependencies, and potential attack surfaces. At the same time, AI-enhanced attacks are making it more difficult for security teams to distinguish malicious activity from legitimate traffic.

Simply adding more security rules or generating more alerts isn't a sustainable answer. Protection must become more intelligent and adaptive without overwhelming security teams or disrupting legitimate business activity.

That makes the ability to identify threats accurately, minimize false positives, and enforce appropriate protections increasingly important. It also reinforces the need for an architecture that can deliver consistent protection across applications and environments.

Ultimately, organizations cannot solve a machine-speed security problem simply by adding more people or accelerating existing processes. They need an architecture designed to protect applications while the underlying systems catch up.

See my session about how to protect when patching can't keep up

AI is fundamentally changing the relationship between vulnerability discovery, exploitation, and remediation. Organizations must continue to improve their patching processes, but they also need ways to protect applications and APIs when permanent fixes aren't immediately available.

In my session, “WAAP for the post-Mythos world” at the F5 Post-Mythos Security Summit, I explore how modern WAAP can help organizations respond to this new reality. I demonstrate how AI-powered protection and virtual patching can help organizations address vulnerabilities at the edge without waiting for application code changes. I also examine how these capabilities fit into a broader approach to protecting applications, APIs, and AI against increasingly sophisticated threats.

To watch my session, register here.

About the Author

Nirav ShahSVP, Product and Solution Marketing | F5

Nirav Shah is the Senior Vice President and Head of Products and Solution Marketing at F5, where he leads the strategic direction for Application Security and AI Security. Before joining F5, he spent eleven years at Fortinet in several leadership positions, most notably heading the AI-Powered SASE, SOC, and Secure Networking solutions. His extensive background also includes significant roles at Cisco Systems, where he spearheaded major initiatives for SD-WAN. With more than two decades of experience in the cybersecurity sector, he has an established record of launching market-defining products and building high-performance teams that align product development with sales and marketing for maximum impact. As a thought leader and USC alumnus, he is a frequent speaker at industry conferences and a regular contributor to leading publications on the intersection of AI and cybersecurity, while remaining dedicated to mentoring emerging cybersecurity professionals.

More blogs by Nirav Shah