Sweet launches virtual patching for cloud & AI workloads

Sweet Security has launched Virtual Patching for running cloud and AI workloads. The feature is designed to help security teams block exploitation of known vulnerabilities before permanent fixes are deployed.

It targets the gap between the discovery of a software flaw and the point at which engineering teams can test and release a code fix into production. Security teams can identify a vulnerability in Sweet's catalogue, choose an enforcement option and deploy a policy to nodes running the affected workload.

Sweet's sensor then applies the policy to the live application and blocks requests that attempt to exploit the weakness, while allowing normal traffic to continue. The protection remains attached to the workload as it scales or restarts and can be removed once the permanent fix is in place.

The launch comes as security teams face shorter timelines between disclosure and attempted exploitation of software vulnerabilities. Sweet pointed to a recent Atlassian flaw that drew exploitation attempts within hours of a proof of concept becoming public, while many software fixes still take days or weeks to reach production systems.

That lag has become a recurring problem for cloud operators and software developers. Even when a patch is available, deployment often depends on engineering work, internal testing, approval processes and release schedules, leaving running applications exposed in the meantime.

James Berthoty, Chief Executive Officer and Founder of Latio Tech, commented on the pace of the threat environment.

"AI is accelerating vulnerability discovery and exploitation to the point where exploits are emerging days before patches are available; faster patching alone isn't enough. Sweet's Virtual Patching provides a critical layer of protection against known and unknown exploits, helping teams apply protection immediately while giving them the time they need to remediate vulnerabilities at their source," Berthoty said.

Virtual patching is a recognised security approach in which protective controls are applied around an application or workload rather than by altering source code straight away. In practice, that can mean filtering or blocking malicious requests that match a known exploit pattern until developers can issue and deploy a software fix.

Sweet is applying that model to cloud and AI workloads already running in production. Its approach is intended to let security teams take action with a single click rather than wait for code changes to move through a software delivery pipeline.

Runtime focus

The new feature also links with Sweet Attack, the company's autonomous AI red-team agent. Sweet said the tool continuously validates exploitable attack paths using runtime context from live environments. When it identifies a vulnerability, it can suggest a virtual patching policy for immediate enforcement.

That creates a workflow in which an exploitable path is identified, a policy is proposed and the runtime sensor applies protection to the workload. Sweet presented the process as a way to reduce manual investigation and handoffs between security and engineering teams.

Dror Kashti, Chief Executive Officer and Co-Founder of Sweet Security, said the product is intended to shorten the time between identifying an exposure and acting on it.

"When a team knows an application can be exploited, waiting is not an option," Kashti said.

"Sweet's new Virtual Patching gives security teams the ability to protect production immediately while engineering finishes the permanent fix. That changes the economics of cloud security by reducing the time and effort between identifying a risk and doing something about it," he added.

Sweet is positioning the launch around a broader shift in security operations as AI tools lower the cost and speed up the process of finding and exploiting weaknesses. That trend has increased pressure on cloud security teams, particularly in environments where software updates cannot be pushed instantly without operational risk.

Competition in cloud runtime security has intensified as vendors try to move beyond detection and posture management into direct intervention in production environments. Sweet said its virtual patching approach is available for cloud and AI applications running in production and is intended to work while engineering teams continue with standard remediation processes.

For security teams, the practical question is whether temporary controls can reliably reduce exposure without disrupting legitimate application traffic. Sweet said its sensor blocks exploit attempts against the targeted vulnerability while leaving normal requests unaffected.

The feature reflects a wider move in cyber security towards compensating controls that can be deployed at runtime when conventional patching cannot happen immediately. In sectors where uptime, testing and change management slow the release of fixes, that model is increasingly being treated as an operational necessity rather than a fallback.