Impart Security Launches AI-Driven Runtime Defense Harness for Rapid Virtual Patching
Impart Security has announced the Runtime Defense Harness, a product that uses AI agents to draft and test virtual patches for newly disclosed vulnerabilities without placing AI models in the live traffic path. The system lets AI agents investigate an attack and build a candidate rule against a customer's own traffic, which an engineer then approves before it is enforced as deterministic WebAssembly code by Impart's Layer 7 engine. The company says this can deliver a tested virtual patch within 60 minutes of disclosure, compared to days or weeks for vendor signatures or code fixes. The announcement cites the PHP2Shell disclosures and a Node.js vulnerability as examples where exploitation outpaced traditional patch timelines.
Detalhes técnicos
- Agents get just-in-time, scoped access to only the traffic and systems needed for a task; block mode and live rule changes require engineer approval.
- Enforcement is inline, deterministic WebAssembly with no added network hop or per-request inference.
- Supports Impart's own lightweight model or customer-supplied models from Anthropic, OpenAI, Azure, or Google, with a full audit trail of agent actions.
- Impart cites a case involving a high-severity Node.js remote code execution flaw (CVE-2026-111497) where customers reportedly had a blocking virtual patch within 24 hours, versus four days for a major CDN's log-only rule.
- Notes that nearly 80% of 4.38 million internet-facing PHP services run unsupported versions, limiting the protective value of vendor patches alone.
Remediação
- Organizations relying on virtual patching should still prioritize applying vendor-released patches and upgrading unsupported software versions where feasible.
Linha do tempo
-
Impart Security Launches AI-Driven Runtime Defense Harness for Rapid Virtual Patching
ler a análise desta fonte ocultar
Impart Security has announced the Runtime Defense Harness, a product that uses AI agents to draft and test virtual patches for newly disclosed vulnerabilities without placing AI models in the live traffic path. The system lets AI agents investigate an attack and build a candidate rule against a customer's own traffic, which an engineer then approves before it is enforced as deterministic WebAssembly code by Impart's Layer 7 engine. The company says this can deliver a tested virtual patch within 60 minutes of disclosure, compared to days or weeks for vendor signatures or code fixes. The announcement cites the PHP2Shell disclosures and a Node.js vulnerability as examples where exploitation outpaced traditional patch timelines.
Technical Details
- Agents get just-in-time, scoped access to only the traffic and systems needed for a task; block mode and live rule changes require engineer approval.
- Enforcement is inline, deterministic WebAssembly with no added network hop or per-request inference.
- Supports Impart's own lightweight model or customer-supplied models from Anthropic, OpenAI, Azure, or Google, with a full audit trail of agent actions.
- Impart cites a case involving a high-severity Node.js remote code execution flaw (CVE-2026-111497) where customers reportedly had a blocking virtual patch within 24 hours, versus four days for a major CDN's log-only rule.
- Notes that nearly 80% of 4.38 million internet-facing PHP services run unsupported versions, limiting the protective value of vendor patches alone.
Remediation
- Organizations relying on virtual patching should still prioritize applying vendor-released patches and upgrading unsupported software versions where feasible.