Decoupling AI from the Traffic Path: Impart's 60-Minute Virtual Patch

SAN FRANCISCO – November 04, 2026 – The cybersecurity infrastructure that underpins our digital economy is buckling under a systemic timing failure. As enterprise software stacks grow more complex, the window between the disclosure of a critical vulnerability and its automated exploitation in the wild has shrunk from weeks to mere hours. Traditional security vendors, reliant on manual triage and generic signature updates, are increasingly losing this race. Today, Impart Security introduced a compelling architectural shift designed to close this gap. The company launched its Runtime Defense Harness, a controlled environment where artificial intelligence agents autonomously draft, test, and deploy virtual patches in as little as 60 minutes.

The 60-Minute Defense in the Zero-Day Era

The fundamental challenge facing modern infrastructure is the inversion of the traditional disclosure timeline. When researchers disclosed the PHP2Shell vulnerabilities in October, the first exploit attempt had already been recorded four days earlier. This highlights a severe structural vulnerability in modern IT environments, exacerbated by the fact that nearly 80% of the 4.38 million internet-facing PHP services currently run on unsupported versions.

In industrial and enterprise environments, ripping and replacing legacy systems is rarely a viable immediate option. Upstream application patches often require weeks of regression testing before they can be safely deployed into production. This creates a massive window of exposure. A 60-minute virtual patching capability provides critical air cover, allowing infrastructure teams to secure their perimeter while the longer, more arduous process of fundamental software remediation takes place.

"The old rhythm of security teams responding to a vulnerability, filing a ticket, and hoping for a patch a few weeks later is long gone. AI has compressed the timeline, so exploits can arrive before the fix," said Jonathan DiVincenzo, CEO and co-founder of the runtime protection platform. "We built the Runtime Defense Harness with the controls first, so teams can move fast without risking production."

The efficacy of this accelerated timeline has already been demonstrated under real-world conditions. During a high-severity Node.js vulnerability (CVE-2026-111497) that could allow remote code execution, customers utilizing this new harness had a blocking virtual patch within 24 hours. In stark contrast, rules from a leading content delivery network arrived four days later, and only in log-only mode, missing its own published five-day response target.

Decoupling AI from the Live Traffic Path

For all the transformative potential of large language models, enterprise security architects remain deeply skeptical of placing non-deterministic AI directly in the live traffic path. A hallucination or unpredictable inference decision could block legitimate e-commerce traffic, disrupt industrial APIs, or introduce synthetic bypasses.

The new harness addresses this pragmatic reality by strictly decoupling the generation of security rules from their execution. The AI model helps write and test each rule but never sits in the live request path. Instead, the agents draft rules against historical customer traffic in a sandboxed environment. Once approved, the Layer 7 engine enforces these rules inline as deterministic WebAssembly (Wasm).

Traditional Web Application Firewalls (WAFs) have long relied on static signatures and regular expressions (regex) to identify threats. However, these legacy mechanisms are increasingly obsolete against modern, AI-augmented attacks. Threat actors can easily bypass regex filters by altering payload encoding, splitting malicious payloads across multiple requests, or chaining tool calls in novel sequences.

By utilizing AssemblyScript, these code-based Wasm rules operate at machine speed, ensuring that the same request receives the exact same decision every time, without the latency of an extra network hop or per-request AI inference. While WebAssembly offers strong isolation and sandboxing, it presents its own complex security landscape. Unchecked dependencies or memory corruption within its linear memory can introduce risks. However, by compiling well-defined, human-approved detection logic into isolated Wasm sandboxes, the platform mitigates the risks associated with both traditional native code execution and unpredictable AI models.

Automating the AppSec Engineer

The harness effectively functions as an automated extension of a Tier 3 application security team. Most security operations centers possess only a handful of engineers capable of writing and shipping custom, code-based rules. The rest of the organization typically waits on this bottleneck or relies on an edge vendor's generic signature—which frequently ships in log-only mode to avoid breaking production traffic.

Under the new system, agents are granted just-in-time access to only the traffic and systems required for a specific task. They investigate the vulnerability, draft a rule, and test it independently. Crucially, the system relies on tiered autonomy. Block mode and live rule changes strictly require an engineer's approval.

"The risk of deploying an autonomous agent directly inline is simply too high for most enterprise risk models," noted one independent application security researcher familiar with Wasm security filters. "By forcing a human-in-the-loop approval process before a rule moves to active blocking, organizations can leverage the speed of generative AI without surrendering operational control."

"The harness coordinates agents to do what a security engineer does when a new CVE lands: understand the attack, write the rule, test it, and hand it over for approval," said Brian Joe, chief product officer and co-founder. "Your engineers make the call. The harness makes sure everything in front of them is tested and auditable."

The Pragmatic Future of Runtime Protection

To maintain transparency and trust, the platform allows organizations to utilize a lightweight proprietary AI model or bring their own enterprise-managed models from Anthropic, OpenAI, Microsoft Azure, or Google. Every action taken by an agent is logged in a comprehensive event timeline, detailing what the AI did, its reasoning, and the specific code changes proposed. Every virtual patch is treated as programmable code that teams can version, test, and roll back in seconds.

The Runtime Defense Harness is available immediately to existing customers at no additional cost. Furthermore, the San Francisco-based firm has released Impart Defend Free, a command-line tool aimed at auditing current web application firewall rules, signaling an aggressive push to capture market share from legacy WAF providers.

As the digital infrastructure of the modern workspace continues to evolve, the tools used to protect it must adapt to the speed of automated adversaries. By decoupling the analytical power of AI from the deterministic requirements of production enforcement, this hybrid approach offers a realistic, grounded blueprint for the next generation of runtime defense. It acknowledges the harsh reality of the zero-day era: survival is no longer just about having the right defenses, but about how quickly those defenses can be built and deployed.