Patch Tuesday used to buy defenders a short head start. Now the exploit often lands before the patch does since automated scanners can weaponize a newly disclosed vulnerability within hours. That inversion is pushing security teams toward virtual patching: shielding an application from a known flaw at the network layer while the real fix is tested and rolled out.

John Maddison (pictured), chief marketing officer and head of technology alliances at F5 Inc., has spent two years at the application delivery and security vendor, which turns 30 this year. F5’s customers are increasingly demanding that kind of protection as the gap between vulnerability disclosure and exploitation collapses, Maddison noted.

“What you need now is AI-powered security that can look at the traffic, where it’s going, what it’s trying to get to and produce protection in real time to stop things like zero days,” he said. “All the protections that sit in what we call CDNs or WAFs are going to be AI-powered. They have to be going forward.”

Maddison spoke with theCUBE’s Dave Vellante and Rebecca Knight at Fal.Con, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how virtual patching can help close shrinking remediation windows and how F5’s partnership with CrowdStrike treats network appliances as endpoints. (* Disclosure below.)

F5 and CrowdStrike extend endpoint protection to the network layer

F5 and CrowdStrike embed the Falcon sensor directly onto F5’s BIG-IP appliances, which sit at the network perimeter, so CrowdStrike can treat that appliances the same way it treats a laptop or cloud workload. More than 200 customers were already running the integration before the companies formalized it, with performance overhead measured at just 1% to 2%.

“We measured it at 1 to 2%, and they’re perfectly willing to deal with that for the security that gets added to it,” Maddison said. “That was always the trade-off between security and networking, high performance versus checking everything that comes through.”

The urgency is measurable. CrowdStrike’s own threat research found that attacks by AI-enabled adversaries rose 89% year over year, with the average eCrime breakout time down to 29 minutes and the fastest recorded breakout at 27 seconds. Maddison said F5 is applying the same approach to a newer problem: guardrails for AI gateways, including a partnership announced this week with Salesforce Inc.’s MuleSoft.

“It’s more around what you do with the information, how you remediate, versus the information itself,” Maddison said. “Because everyone has the information already.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the Fal.Con event:

( * Disclosure: TheCUBE is a paid media partner for Fal.Con. Neither CrowdStrike, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE