Close the patch window, instantly.

Virtual patching is the practice of protecting a vulnerable application from exploitation without applying the underlying vendor patch. It intercepts or contains exploitation attempts at the system level, closing the exposure window while the vulnerability remains in the code. Traditional virtual patching approaches (WAF rules, IPS signatures, EDR mitigation modules) do this by recognizing the exploit. Mimic's Virtual Patching does it by enforcing the application's known-good baseline at the kernel layer — no prior knowledge of the attack required.

Mimic establishes a known-good baseline for each protected component during onboarding — a precise profile of every authorized file, process, registry key, and configuration the component uses in its approved operational state. From that point, every change to a protected component is evaluated at Ring 0, the kernel layer, before it executes. An exploitation attempt must modify a protected component to produce impact. That modification is evaluated against the baseline and blocked if unauthorized — regardless of whether the exploit has a CVE number, a signature, or has ever been seen before.

The programmable runtime enforcement engine is the kernel-level mechanism underlying Mimic's Virtual Patching capability. It intercepts and evaluates change attempts at the runtime layer — the point where exploitation attempts must ultimately produce their unauthorized modification to a protected component. "Programmable" refers to the fact that the enforcement policy is established during onboarding by profiling the system in its authorized operational state, creating a precise, system-specific enforcement standard. Unlike signature-based defenses that require pre-written rules for each known attack, the enforcement engine evaluates whether any change — known or novel — falls within the authorized baseline.

No. Mimic's Virtual Patching does not depend on a vendor patch existing, being available, or being deployed. Enforcement is against the application's known-good baseline at the kernel level — not against a description of the exploit or a corrected version of the code. The protection holds for vulnerabilities with no CVE number, vulnerabilities where no patch has been released, end-of-life systems where no patch is coming, and systems where the patch cannot be deployed without breaking compatibility. Protection holds whether the vendor fix ships in a day or never ships at all.

Patch management resolves the underlying vulnerability by modifying the code — that is the long-term fix. Virtual patching closes the exposure window while patch management runs and continues holding for systems patch management cannot reach. Virtual patching does not replace patch management: it operates on a different timeline toward the same outcome. The practical difference is coverage and speed: virtual patching takes effect immediately, without testing or change management approval cycles, and extends to systems that will never receive a vendor patch.

End-of-life systems are unpatched by definition. Under a patch-dependent virtual patching model, they carry permanent exposure once a vulnerability is discovered. Mimic's enforcement is against the known-good baseline at the kernel, not against the patch status of the code. An end-of-life system that Mimic enforces receives identical protection to a fully maintained, up-to-date system. A Mythos-discovered vulnerability in an unmanageable system is covered the same way as one in a current, actively maintained component. The enforcement question — was this change authorized? — is unchanged by patch availability or vendor support status.

No. Mimic is not tracking the CVE or its patch status. It enforces the system's known-good state regardless of which vulnerability a given unauthorized change relates to. When the vendor patch deploys, it lands as an authorized change to the baseline — the baseline updates to reflect the new authorized state, and enforcement continues without modification. There is nothing to unwind or reconfigure. The patch and the enforcement are entirely decoupled.

Yes. Mythos-class discovery compresses the time from vulnerability disclosure to working exploit from weeks to hours. Traditional virtual patching defenses — which protect by recognizing the exploit through signatures or behavioral rules — degrade against Mythos because the model generates novel exploits faster than rules can be written. Mimic's enforcement does not require prior knowledge of the exploit. Every Mythos-discovered exploit still requires an unauthorized change to a protected component to execute. Mimic evaluates that change at Ring 0 and blocks it if unauthorized, regardless of when the vulnerability was discovered or how novel the exploit technique is.

In-memory exploitation still requires changes to process state, registry keys, services, or configuration that fall outside the known-good baseline for that component. Pure shellcode execution that achieves impact without any persistent change to a protected component would represent an edge case worth discussing with our engineering team. For the vast majority of real-world exploits, including sophisticated in-memory techniques, the attack chain passes through at least one protected change point before producing its intended outcome.

No. Mimic's Virtual Patching is additive to WAFs, IPSs, and EDR exploit-mitigation modules — it does not replace them. Those tools continue doing what they were built for. Mimic closes the specific gap those tools cannot cover: novel exploits with no prior signature, end-of-life systems with no patches coming, and attacks with no published proof of concept. Running Mimic alongside existing controls strengthens the overall posture; it does not require removing or replacing existing investment.

Virtual Patching is the PATCH pillar of Mimic's AI Shield capability. AI Shield addresses two threat vectors from agentic AI: what AI agents do inside the enterprise environment (governed by the GUARD pillar, AI Guardrails), and what AI-powered discovery models like Mythos expose from outside (closed by the PATCH pillar, Virtual Patching). Both run on the same kernel-level enforcement engine. Virtual Patching stands alone as a product — organizations that don't yet have AI agents in production may still face Mythos-class vulnerability exposure. AI Shield is the combined deployment for organizations facing both threat vectors.

Yes. Mimic's enforcement runs continuously during scheduled maintenance windows without gaps. Authorized maintenance changes — patches, configuration updates, approved modifications — execute normally within the baseline. Unauthorized changes during a maintenance window are blocked and flagged with the same priority as unauthorized changes at any other time. Maintenance windows do not create enforcement gaps or periods of reduced protection.