The velocity of vulnerabilities being discovered using Frontier AI and OpenWeight models such as Cisco Anteras is unprecedented and defenders need more time. All vendors are dealing with an influx of vulnerabilities and addressing them as soon as possible. On Oct 13 Microsoft released 1,411 patches of which 70 were critical flaws and 3 were zero days! It included 317 remote code executions flaws, 677 privileged escalation flaws, and 40 security feature flaws. Fair play to Microsoft for addressing these vulnerabilities and Cisco as well as others are not immune to vulnerabilities but over time we all should see less of them. 🤞Remember that every door we close the adversary looks for a new door – the cat and mouse game will continue.
It still takes organizations up to 43 days to patch and there lies the problem. We need options!
Cisco provides customers with additional risk-mitigating options to buy all defenders much-needed time.
Virtual Patching vs. Live Protect (Shielding) #
Live Protect is a differentiating capability – we are not built the same.
Virtual patching is the network-layer shield, and we are never touching the vulnerable host. Talos writes Snort rules that match the exploit traffic, those rules sit in an Intrusion Policy on Secure Firewall, and anything that crosses the firewall gets inspected.
Matching packets get logged and/or dropped. If you want tighter coverage, Secure Workload can inventory what’s actually running on the workloads, push a filtered CVE map up to FMC, and Firepower Recommendations only turn on the signatures that matter for those specific hosts.
It works for third-party software, OT, and anything whose traffic you can force through an inspection point. Talos can ship a rule long before the vendor ships a binary patch, and one policy can cover a lot of hosts using Secure Firewall control point. The trade-off is obvious once you’ve run it: it only sees what hits the firewall, a novel variant can slip past a signature, and the CVE is still sitting on disk. SnortML casts a prescriptive based net that catches variants for certain protocols and encrypted visibility without decryption comes into play. When decryption is required, we use TLS and QUIC proxy.
The workload in the environment still sits vulnerable and that’s where Secure Workload can be expanded to drive controls based on CVE directly in the workload using native capabilities and once patched the control disappears. That’s an example of “virtual patching” workflow. Prescriptive and defense in depth but there is more.
Shielding with Live Protect #
Shielding with Live Protect is different. It’s a temporary runtime shield that goes on the Cisco box itself—starting with NX-OS on Nexus 9000, expanding from there. After PSIRT discloses a vulnerability, Talos and engineering validate a small eBPF (Tetragon) policy that can intercept a specific syscall, process, or file access. You deploy it from Nexus Dashboard or SD-WAN Manager, start in monitor, move to enforce, then retire the shield when the real image is installed. No image upgrade, no reboot.
The value is reducing exposure days while the permanent patch still has to go through change control. It’s not a patch and Cisco is clear about that. It covers bugs that never show up as clean network traffic—local file abuse, some control-plane issues, privilege escalation on the switch itself. Because the policy is narrow and Cisco-validated, the false-positive risk is low. Mitigating capabilities can be extended using Isovalent runtime protections to a variety of workloads such as containers.
In practice I treat them as complementary. A true testament of defense in depth. Virtual patching buys you time and coverage for the systems you can’t or won’t patch quickly. Live Protect buys you time on the infrastructure boxes themselves without forcing an emergency upgrade window. Workload and runtime protections drive controls directly into the workload itself. None replaces the actual patch; they all just keep the exposure window smaller while you get there.
Compensating controls that matter #
Resources:
- SnortML: https://secure.cisco.com/secure-firewall/docs/snortml-machine-learning-based-exploit-detection
- Cisco Live Protect: [https://www.cisco.com/site/us/en/about/trust-center/live-protect.html](https://www.cisco.com/site/us/en/about/trust-center/live-protect.html)
- Cisco Secure Workload: [https://www.cisco.com/site/ca/en/products/security/secure-workload/index.html](https://www.cisco.com/site/ca/en/products/security/secure-workload/index.html)
- Isovalent: [https://isovalent.com/solutions/security-compliance/](https://isovalent.com/solutions/security-compliance/)
- Cisco Talos: [https://www.talosintelligence.com/](https://www.talosintelligence.com/)
Cisco Cybersecurity Viewpoints
Where security insights and innovation meet. Read the e-book, see the video, dive into the infographic and more…