Virtual patching closes the gap as AI erases the patch window

Patch Tuesday used to give defenders a brief breathing room. That window is disappearing fast. Automated scanners can now turn a newly disclosed bug into a working attack within hours, which leaves security teams scrambling for something that can hold the line while the real patch gets tested and deployed.

That is where virtual patching comes in. Instead of waiting on the application to be fixed, the protection sits at the network layer and blocks traffic aimed at a known weakness. John Maddison, F5’s chief marketing officer and head of technology alliances, said customers want that kind of cover because the gap between disclosure and exploitation is collapsing. He described a world where security has to inspect traffic in real time and stop zero days before they reach their target.

F5 is also leaning on the same idea with CrowdStrike. The two companies put the Falcon sensor directly on F5’s BIG-IP appliances, which sit at the network perimeter, so CrowdStrike can treat that traffic like endpoint activity. More than 200 customers were already using the integration before it was formalized, and the measured overhead was only 1% to 2%. That trade-off, Maddison said, is easier to accept now than the old choice between speed and inspection.

The urgency is not hypothetical. CrowdStrike’s research says AI-enabled adversary activity rose 89% year over year, average breakout time fell to 29 minutes, and the fastest recorded intrusion took 27 seconds. F5 is now applying similar thinking to AI gateways too, including a new partnership with Salesforce’s MuleSoft. The message is blunt: if attackers are using AI to move faster, security products have to do the same.

Maddison’s broader point is that the old separation between network gear and endpoint security is getting fuzzy. Even the protection layer itself is turning into an AI problem. And that is probably the right direction, because the patch window is not coming back.