As the cybersecurity landscape continues to evolve at breakneck speed, a recent phenomenon has been making headlines in the industry: the rise of “virtual patching” made possible by advanced AI tools. But is this supposed revolution really new? Or are we simply rebranding established security best practices with flashy names?
The truth is that virtual patching, or rather, defense-in-depth measures, have been around for decades. The recent hype surrounding Frontier AI has given some in the security industry an excuse to dust off old concepts and give them a shiny new label. But beneath the surface, nothing has fundamentally changed. Good security hygiene and fundamentals still remain the cornerstone of preventing security incidents and securing applications.
So, what should enterprises focus on when it comes to protecting their applications from vulnerabilities and exploits that are emerging faster than ever? While not an exhaustive list, here are a few essential security fundamentals that can help protect applications:
First and foremost, Identity and Access Management (IAM) is crucial. If an attacker cannot authenticate to an application, isn’t authorized to use it, and cannot bypass authorization, they’ll be severely limited in their ability to attack the application. Of course, attackers will always find ways to breach security measures, but our goal should be to make it as difficult as possible for them.
Network Segmentation is another vital measure that can help protect applications from attack. Not all applications need to be accessible from everywhere on the network, so why not restrict access to only those segments that require it? This simple yet effective approach can significantly reduce an attacker’s ability to reach sensitive areas of the network.
Least Privilege is a powerful security fundamental that enterprises can leverage to limit user access and privilege. The idea is simple: give users only the level of access they need to perform their tasks. When it comes to applications, this means limiting the damage an attacker can cause even if they manage to bypass other defense-in-depth measures.
Good Network Security will also go a long way in preventing unwanted access to applications at the network level. And let’s not forget about Endpoint Security – robust endpoint security can help detect and respond to application attacks before significant damage is done.
Proper Application Security at all layers of the application stack (infrastructure, API, AI, etc.) is essential. There are many ways to protect applications, even if they’re vulnerable. It’s worth the security organization’s time to understand which protection capabilities make the most sense at each layer of the application stack.
Finally, Data Security and preventive controls such as good security policies and the ability to enforce them are critical components of defense-in-depth for applications. Encrypting data at rest and in transit is a simple yet effective measure that can greatly hinder an attacker’s ability to leverage stolen data.
In short, while AI has certainly accelerated the pace of attacks and exploits, it hasn’t changed the fundamental principles of security. By focusing on these established best practices – IAM, Network Segmentation, Least Privilege, Network Security, Endpoint Security, Application Security, Data Security, and Preventive Controls – organizations can significantly improve their defenses against emerging threats.
Source: SecurityWeek — 2026-10-01