Attack Surface Ranked

FIELD NOTE · 10 SEPTEMBER 2026

Virtual patching with a WAF: what ASM tools can and cannot do

Quick answer

Virtual patching blocks exploitation of a known flaw at a control point, usually a web application firewall, before the software itself is patched. Of the ten tools we score, IONIX and watchTowr document pushing rules to WAFs and edge platforms, and Cortex Xpanse documents automated response playbooks. A virtual patch shortens the exposure window; it does not replace the fix.

By Attack Surface Ranked analysts · Published 10 September 2026 · 3 min read

What is virtual patching?

A virtual patch is a rule in front of the application, not a change to the application. When a vulnerability is published and the affected system cannot be patched quickly, because it is a legacy application, because the vendor fix is not out yet, or because change windows are weeks apart, a WAF rule that matches the exploit request can block the attack path in the meantime. In our glossary this is a compensating control: a measure that reduces risk while the underlying flaw remains.

Why does it matter more in 2026?

Two reasons: volume and speed. FIRST forecast a median of about 59,427 CVEs for 2026 in February and raised that to about 66,000 in June. At the same time, vendors are publishing capabilities measured in hours. IONIX says Live Exposure Defense, which it shipped on 31 May 2026, correlates each new CVE with a customer's internet-facing assets, confirms exploitability through safe active testing and delivers a mitigation workflow within 12 hours. watchTowr says Project Red, introduced on 24 July 2026, reproduced one new vulnerability in 22 minutes. Patching at that speed across a large group is rarely possible. A rule at the edge sometimes is.

Which ASM tools document virtual patching or automated mitigation?

Mitigation documented by vendors in our ranking, September 2026
ToolWhat the vendor documentsWhere the control runsRemediation score
IONIXA deployable WAF rule within 12 hours of CVE publication, delivered into remediation workflows. Identifies WAFs from Akamai, Cloudflare, AWS, Azure, Imperva, Barracuda, Fortinet, Palo Alto Networks, Fastly and 50+ other vendors. Active Protection claims expired domains, abandoned cloud buckets and exposed nameservers.The customer's WAFs9
watchTowrActive Defense rules pushed to the edge through Cloudflare, Akamai, Imperva, F5, Fortinet, Check Point and Citrix.Edge and WAF platforms9
Cortex XpanseActive Response automated playbooks, with remediation routed through Cortex XSOAR.Cortex playbooks8
CyCognitoStep-by-step guidance, owner linking and a retest after the fix. No automated mitigation described.Not applicable7
HadrianRemediation guidance, automatic tickets and automatic regression testing. No WAF rules described.Not applicable7

Scores are from our remediation criterion, which carries 20% of the weighted score. Tenable ASM, Rapid7 Surface Command, Censys ASM, CrowdStrike EASM and Microsoft Defender EASM document tickets, workflows or downstream automation but not WAF rules on the pages we reviewed. See the full score matrix.

What controls should sit around an automated rule?

A rule that blocks traffic can also block customers. Before any tool deploys one, agree on the following.

  1. Approval: who signs off, the security team, the application owner or both, and how fast.
  2. Mode: whether new rules start in monitor or log-only mode before they block.
  3. Scope: which WAFs, which applications and which subsidiaries' estates the tool may change. In a group with separate business units this often needs separate approval paths.
  4. Rollback: how a rule is removed, by whom, and how quickly.
  5. Expiry: a review date on every virtual patch, so rules do not pile up after the code is fixed.
  6. Evidence: the finding stays open until the patch ships and a retest confirms it.

What if the vulnerable asset is not behind a WAF?

A virtual patch only helps if the asset sits behind a WAF and that WAF is enforcing rules rather than only monitoring. In large groups that is often not the case: acquired companies bring their own hosting, and marketing sites go live outside the standard stack. IONIX launched WAF Posture Management on 17 August 2026 for this problem, describing continuous, evidence-based WAF validation that finds unprotected assets, checks enforcement status and detects configuration drift. On 31 July 2026 IONIX also joined the Akamai Technology Partner Program.

Whatever tool you use, ask it for a list of internet-facing web assets with no WAF in front of them. That list is where virtual patching cannot help you.

When is virtual patching the wrong answer?

When the flaw sits in authentication or business logic that no request pattern can describe, when the application is not behind a WAF at all, or when the asset should not exist. For an abandoned subdomain or a forgotten test server the fix is to take it down or reclaim it. That is why claiming hijackable assets, such as dangling DNS records, expired domains and abandoned cloud buckets, counts as its own capability in our remediation criterion.

Sources

Related on this site