Topic starter
25/06/2026 10:30 pm
TL;DR: Vulnerability discovery, virtual patching and software remediation are being tied together to reduce the time between finding a flaw and protecting exposed systems, including open source software, commercial applications, OT and healthcare technologies, according to Palo Alto Networks, IBM and Red Hat. The real issue is not faster disclosure, but whether security teams can shrink exposure windows faster than AI-driven discovery expands them.
Editorial analysis by NHI Mgmt Group, based on content published by Palo Alto Networks: “IBM, Red Hat and Palo Alto Networks Expand Project Lightwell to Help Organizations Respond to Software Vulnerabilities”.
Key questions
Q: How should teams reduce the gap between vulnerability discovery and protection?
A: Teams should treat the gap as a response-control problem, not just a patching problem.
Q: Why do AI-driven vulnerability findings create more operational risk for large programmes?
A: They increase risk because large programmes already have longer approval paths, more dependencies, and more systems that must change together.
Q: What breaks when organisations rely on patching without identity containment?
A: Patch programs reduce exploit opportunities, but they do not stop a threat actor who already has valid access.
Practitioner guidance
- Measure vulnerability-to-protection time Track the elapsed time from validated discovery to the first enforceable protection across critical software, not just the time to final patch approval.
- Separate containment from remediation Assign network-level blocking, validation, and code repair to distinct owners so interim protections can be deployed while fixes are tested.
- Map slow-change assets first Prioritise OT, healthcare, and other regulated environments where patch latency is structurally higher and compensating controls matter most.
Bottom line: The article frames vulnerability response as a race to close the interval between discovery and enforceable protection, not just to finish patching.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 11:04 pm
Exposure-window management is now the primary governance problem in vulnerability response. The article shows that discovery speed is no longer the only issue, because protection can lag even when the flaw is known. That changes the control objective from patch completion to time-bounded exposure reduction. Practitioners should treat the interval between validated discovery and enforceable protection as a measurable governance gap.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should security teams use virtual patching without delaying real remediation?
A: Use virtual patching as a compensating control, not as the final fix. The goal is to block exploit traffic quickly while engineering completes code remediation, testing, and release. Track each rule as a temporary control with explicit ownership, review dates, and a linked remediation ticket so containment does not become permanent drift.
👉 Read our full editorial: Project Lightwell narrows vulnerability-to-protection gaps across software