Virtual patching protects a vulnerable system from exploitation without changing its code, while the vendor patch is pending or will never come. Network and host intrusion prevention do it with rules written for known vulnerabilities. Mimic Networks does it at the kernel, on a baseline of each server's authorized state: disruption blocks what an analyzed vulnerability depends on, and containment limits what an exploit can do once it lands.
How often is a flaw already exploited when it goes public?
141 of 491
Of the 491 vulnerabilities newly named as exploited in the first half of 2026, attackers were already exploiting 141 when those flaws went public, per the Zero Day Clock, read 24 October 2026.
Virtual patching, defined
Updated by Mimic Networks. The outside sources sit at the end of this section, each with its own date.
What is virtual patching?
OWASP defines it as "A security policy enforcement layer that detects and blocks matching exploitation attempts against a known vulnerability without changing the vulnerable code," and adds: "It does not remove the underlying vulnerability" (OWASP Virtual Patching Cheat Sheet). TrendAI calls it a compensating control that shields a vulnerability until the vendor's patch can be tested and deployed (TrendAI), and Fortinet calls it a bridge until official patches are applied and verified (Fortinet).
The reason to do it is time. NIST lists four responses to a vulnerable system: accept, mitigate, transfer or avoid. Mitigation covers patching and also "deploying additional security controls to reduce vulnerability exploitation," and some systems never get a patch, because "the software is at end-of-life" (NIST SP 800-40 Rev. 4). CISA's catalog of known exploited vulnerabilities tells agencies to apply mitigations per vendor instructions or stop using a product when mitigations are unavailable (CISA). MITRE ATT&CK lists exploit protection beside software updates as a mitigation for exploited public-facing applications (MITRE ATT&CK T1190).
Security frameworks expect the same. CIS Safeguard 2.2 allows unsupported software only with a documented exception "detailing mitigating controls and residual risk acceptance" (CIS), and CISA counts unsupported software in critical infrastructure among its Bad Practices. For OT, NIST notes that "Software updates on OT cannot always be implemented on a timely basis" (NIST SP 800-82 Rev. 3), and CISA's asset inventory guidance asks owners to keep exploring controls for vulnerabilities "that cannot be patched immediately or are end of life" (CISA and partners). MITRE's Exploit Protection mitigation covers capabilities that "detect, block, and mitigate conditions indicative of software exploits."
How do the three kinds of virtual patching differ?
They sit at different points, check different things and need different things in place first. Network and host tools apply rules written for known vulnerabilities to traffic. Mimic Networks works on the server itself and checks the change an exploit tries to make.
Figure 1
Where each control sits
An exploit attempt, on its way to a vulnerable application
Network virtual patching
Inline on the network, in front of the server. A firewall or IPS applies rules to the traffic that passes through it. Fortinet describes rules on network devices at "strategic choke points" (Fortinet).
Host intrusion prevention
On the server, at its network traffic. An agent inspects the traffic coming into and going out of that server and blocks what matches a rule (TrendAI).
Mimic Networks Virtual Patching
On the server, at the kernel. Mimic checks each attempted change on the server against its baseline and stops exploitation at the point of execution.
The vulnerable application
The code with the flaw. None of the three changes it. The vendor patch does.
Figure 1. Three places a virtual patch can sit. Each is described, with its source, in the table below.
Three kinds of virtual patching, compared from each vendor's own documentation
Compared on
Network virtual patching (for example, Fortinet FortiGuard IPS on FortiGate)
Host intrusion prevention (for example, TrendAI's Intrusion Prevention module)
Mimic Networks Virtual Patching
Where it sits
Inline on the network. Fortinet: rules "on network devices (IPS/WAF)" at choke points in front of the asset (Fortinet).
An agent on the server. TrendAI's Workload Security documentation says its Intrusion Prevention module "inspects incoming and outgoing traffic" (TrendAI).
On the server, at the kernel.
What it checks
Traffic passing through the device, against signatures for known exploits (Fortinet).
The server's network packets, at the payload, session and application layers, against rules (TrendAI).
Each attempted change on the server, against its baseline.
What it needs first
Traffic routed through it and a rule for the vulnerability from FortiGuard Labs (Fortinet). For FortiOS's OT virtual patching profile, an OT license and device detection (Fortinet).
An agent on the server and rules TrendAI writes as vulnerabilities are discovered, assigned by hand or through recommendation scans (TrendAI).
A supported server and a baseline of its authorized state. For disruption, an analyzed vulnerability. A replay before each safeguard goes live.
What it does on a match
Detects and blocks the matching traffic (Fortinet).
Blocks traffic that matches an exploit pattern (TrendAI).
Disruption blocks the mechanism the vulnerability depends on. Containment limits what an exploit can do once it lands.
How it relates to the patch
"Meant as a temporary stopgap until patching" (Fortinet).
Virtual patching is "a compensating control that shields a vulnerability until the vendor's patch can be tested and deployed" (TrendAI).
Disrupts or contains the exploit while the patch is pending. The patch still removes the flaw.
Trend Micro's enterprise business has operated as TrendAI since 23 March 2026 (Trend Micro newsroom). Fortinet's pages and TrendAI's product documentation show no publication date; each was read on 22 October 2026. TrendAI's Security 101 article is dated 25 August 2026. What any rule-based control can't see is covered under What doesn't virtual patching do?, below.
What does each need before it can protect?
A rule needs a known vulnerability and traffic it can see. A baseline needs a profile of the server in its authorized state, which Mimic builds during onboarding.
Figure 2
What each needs before it can protect
Network virtual patching
Traffic and a rule
The exploit's traffic has to pass through the device.
A rule for the vulnerability, from the vendor's research. Fortinet's come from FortiGuard Labs (Fortinet).
For FortiOS's OT virtual patching profile: an OT license, device detection and the profile on the firewall policy (Fortinet).
Host intrusion prevention
An agent and a rule
An agent on each server it protects.
Rules the vendor writes for vulnerabilities "as they are discovered" (TrendAI).
Rules assigned to each server by hand or through recommendation scans (TrendAI).
Mimic Networks Virtual Patching
A baseline
Mimic on the server: Windows Server 2016 and later, or Red Hat Enterprise Linux 8 and later.
A baseline of the server's authorized state. Both forms require it.
For disruption, an analyzed vulnerability. Containment covers a whole family of exploits.
A replay against the host's recorded behavior before each safeguard goes live.
Figure 2. What has to be in place before each kind of virtual patch protects anything.
How do the controls work together?
In layers. Fortinet says virtual patching works best paired with microsegmentation, zero trust policies and strict access controls (Fortinet). CISA and its partners list virtual patches through network defenses among the compensating controls for OT systems that can't be patched promptly (CISA and partners). Mimic doesn't replace either layer. It checks a different thing at a different point, so an exploit that gets past the traffic rules still meets the server's baseline.
Figure 3
How the controls work together
The network control checks the traffic. If it matches a rule for a known vulnerability, the firewall or IPS blocks it before it reaches the server.
Host intrusion prevention checks it again at the server. If it matches a rule there, the agent blocks it.
Mimic checks what the exploit tries to change. Disruption blocks the mechanism an analyzed vulnerability depends on. Containment limits what an exploit can do once it lands.
A change outside the server's baseline stops at the point of execution.
The vendor patch removes the flaw. Test it, deploy it and retire the safeguards that covered the gap. Virtual patches roll back instantly.
Each layer answers a different question at a different point. OWASP's advice holds for all three: code fixes and virtual patching "are NOT mutually exclusive" and "can be run in tandem" (OWASP).
Figure 3. One exploit attempt meeting each control in turn. Not every estate runs all three.
Can virtual patching protect against a zero-day?
It depends on what's known. A zero-day is a flaw with no vendor patch, and many are analyzed before the patch ships: disclosed early, or found by researchers. TrendAI's TippingPoint filters, for example, include ones that protect vulnerabilities its Zero Day Initiative found before the vendor's patch (TrendAI). A rule or a disruption safeguard can exist for those.
For an exploit nobody has analyzed, rules have nothing to match. Containment limits what an exploit can do once it lands, and known-good enforcement checks the change it needs to make on a protected server, so it stops at the point of execution when that change falls outside the baseline.
What doesn't virtual patching do?
It doesn't fix the flaw. OWASP's advice is to keep tracking virtual patches "in your normal Patch Management processes" (OWASP).
It doesn't see everything. OWASP notes that a virtual patch covers only the traffic it inspects and the attack variants its rules recognize (OWASP). Mimic doesn't inspect network traffic, and it protects only the servers it's installed on.
Mimic doesn't cover operating systems older than Windows Server 2016 and Red Hat Enterprise Linux 8, or laptops, workstations, network devices and OT controllers.
In Maintenance Mode, Mimic suspends enforcement and keeps monitoring.
Virtual Patching works in two forms, and both require baselining. Disruption blocks the specific mechanism an analyzed vulnerability depends on, so the exploit doesn't succeed. Containment limits what an exploit can do once it lands, so one safeguard can cover a whole family of exploits. It's part of Mimic's known-good enforcement approach.
Disruption blocks the specific mechanism an analyzed vulnerability depends on, so the exploit doesn't succeed, whether or not the vendor has shipped a patch.
Contain what lands.
Containment limits what an exploit can do once it lands, so one safeguard can cover a whole family of exploits.
Start from the baseline.
Both forms require a baseline of each server's authorized state. It's the same baseline known-good enforcement checks each attempted change against, so a change outside it stops at the point of execution.
CONTAIN
What does containment do once an exploit lands?
01.
Limit the blast radius.
Confine a compromised application to what its baseline allows, at the kernel.
02.
Hold the server's state.
Changes outside the baseline stop at the point of execution, whichever process attempts them.
03.
Keep the patch in the plan.
A safeguard covers the gap while the patch is tested and deployed. The patch still removes the flaw, so track both in the same plan.
How does Virtual Patching fit with the rest of your stack?
In place before the attack.
Mimic enforces the baseline before an attacker arrives, not after an alert.
Source-agnostic enforcement
One question for each change on a protected server, whatever its source: ransomware, a signed installer, an insider, a compromised vendor update or an AI agent.
Decoupled from the patch cycle
Keep the safeguard in place while the patch is tested and scheduled, or for as long as no patch exists. Virtual patches roll back instantly.
Baseline set at onboarding
Mimic profiles each protected server in its authorized state during onboarding. Both forms of Virtual Patching build on that baseline.
Runs alongside your stack.
Keep your WAF, IPS and EDR. Each answers a different question at a different point, so nothing gets ripped out.
Separate from AI Guardrails.
Mimic AI Guardrails governs what AI agents do inside the environment. Virtual Patching closes the exposure that AI-accelerated vulnerability discovery opens before a vendor patch exists.
Virtual patching is a security control that blocks exploitation of a vulnerability without changing the vulnerable code. OWASP describes it as an enforcement layer that detects and blocks exploitation attempts against a known vulnerability, and notes that it doesn't remove the vulnerability. It protects a system while the vendor patch is tested and deployed, or where no patch will come. The patch still has to go in.
How does virtual patching work when no vendor patch exists?
+
A safeguard stands between the exploit and the flaw. Network and host intrusion prevention apply rules written for a known vulnerability to the traffic they inspect. Mimic Networks works on the server: disruption blocks the mechanism an analyzed vulnerability depends on, and containment limits what an exploit can do once it lands. Both build on a baseline of the server's authorized state, so a change outside it stops at the point of execution.
How does Mimic's Virtual Patching work?
+
Virtual Patching works in two forms, and both require baselining. Disruption blocks the specific mechanism an analyzed vulnerability depends on, so the exploit doesn't succeed. Containment limits what an exploit can do once it lands, so one safeguard can cover a whole family of exploits. It's part of Mimic's known-good enforcement approach. Before a safeguard goes live, Mimic replays it against the host's recorded behavior to show what it would block.
What does Mimic need before Virtual Patching can protect a server?
+
Three things. Mimic runs on the server, which needs Windows Server 2016 or later, or Red Hat Enterprise Linux 8 or later. It needs a baseline of the server's authorized state, which Mimic profiles during onboarding; both forms of Virtual Patching require it. And before a safeguard goes live, Mimic replays it against the host's recorded behavior to show what it would block on that host.
How is it different from IPS or WAF virtual patching?
+
They sit at different points. Network IPS and WAF virtual patching inspect traffic on its way to the application and block what matches a rule for a known vulnerability. Host intrusion prevention does the same with the server's own traffic. Mimic works at the server's kernel and checks what an exploit tries to change against the server's baseline. They answer different questions, so they work together rather than replacing each other.
Can virtual patching stop a zero-day exploit?
+
It depends on what's known about it. A rule or a disruption safeguard needs an analyzed vulnerability, and many zero-days are analyzed before the vendor ships a patch. For an exploit nobody has analyzed, rules have nothing to match. Containment limits what an exploit can do once it lands, and known-good enforcement checks the change it needs to make on a protected server, stopping it when that change falls outside the baseline.
Does virtual patching replace patching?
+
No. Virtual patching closes exposure while the patch is tested, scheduled and deployed, and covers software that won't get one. The patch removes the flaw. OWASP advises tracking virtual patches in your normal patch management process, and NIST's patch management guide treats mitigation as one response when a patch can't be applied yet. Keep both running: patching on its schedule, virtual patching for the gap.
Can virtual patching protect software past its end of support?
+
On a server Mimic supports, yes. An application the vendor no longer fixes still gets a baseline, and the same check applies to the changes an exploit tries to make. Mimic runs on Windows Server 2016 and later and Red Hat Enterprise Linux 8 and later, so an older operating system isn't covered. CIS Safeguard 2.2 asks you to document an exception, with mitigating controls and residual risk, for unsupported software you keep. The how-to walks through it.
Can a virtual patch break a production server?
+
That's what the replay is for. Before a Virtual Patching safeguard goes live, Mimic replays it against the host's recorded behavior to show what it would block, so your team sees the effect on that host before it's enforced. If it blocks something your team needs after it goes live, virtual patches roll back instantly. No reboots required.
What happens during a maintenance window?
+
In Maintenance Mode, Mimic suspends enforcement and keeps monitoring. Plan it like any change window: keep it short, make only the changes you planned and review what changed before you leave it. That's the trade-off for making authorized changes on a protected server: the check stops for the window, and monitoring doesn't. Schedule the window with the server's owners, as you would a patch.
Does Virtual Patching replace a WAF, IPS or EDR?
+
No. A WAF or IPS inspects traffic for patterns that match known exploits, and EDR looks for activity it recognizes as malicious. Mimic checks what changes on a protected server against its baseline. They answer different questions at different points, so they run side by side. Keep your WAF, IPS and EDR, and use Virtual Patching for the servers whose fix is late or never coming.
How does Virtual Patching relate to AI Guardrails?
+
Mimic AI Guardrails and Virtual Patching are separate solutions in the Mimic Platform. Both govern threats that agentic AI presents. AI Guardrails governs what AI agents do inside the environment. Virtual Patching closes the exposure that AI-accelerated vulnerability discovery opens before a vendor patch exists. Read about Mimic AI Guardrails for the agent side.
