Short answer: A Web Application Firewall (WAF) lets you block an exploit pattern at the edge within minutes, before the vulnerable code is fixed. That is called virtual patching. As attackers use Artificial Intelligence (AI) to find and weaponize flaws faster, the gap between disclosure and attack keeps shrinking, so a WAF becomes the control that buys time for real remediation. Virtual patching as a compensating control only counts if it is governed, documented and time-limited.
Patching vulnerabilities takes time, since patches can break systems so testing patches has always been part of expected due diligence practices. A fix has to be identified, tested against your applications, scheduled and deployed, and third-party products wait on their vendors. Attackers do not wait. AI tools can help adversaries read advisories, compare patched and unpatched code and generate working exploit attempts faster than a manual process could.
The PHP issue in October 2026 is a good example of the problem. On 21 October 2026, the European Commission, ENISA, CERT-EU, Europol EC3 and the CSIRTs network issued a joint statement on two critical PHP vulnerabilities that could allow remote code execution without authentication. They advised organizations to apply the updates, find PHP-based applications including third-party products, prioritize internet-facing systems, and consider isolating exposed applications if they cannot patch immediately.
That last point is the gap a WAF fills. Isolation stops the business. A targeted WAF rule can stop the attack while the application stays online.
Virtual patching is a temporary fix, a compensating control, that relies on a WAF to detect and block requests trying to exploit a specific vulnerability. The vulnerable code is still there, exploitable. The WAF rule simply prevents known attack patterns from reaching the vulnerability system.
A WAF is
A WAF is not:
A WAF bought and switched on is a tool. A WAF that is governed is a control an auditor can rely on. Using the Hierarchical Cybersecurity Governance Framework, the documentation stacks up like this:
Virtual patching belongs inside your vulnerability management program, not beside it. The Vulnerability & Patch Management Program (VPMP) covers remediation timelines and exceptions, and our FAQ explains the difference between patch management and vulnerability management.
Several common frameworks already point in this direction. PCI DSS v4.0 includes a requirement for an automated technical solution, such as a WAF, in front of public-facing web applications to detect and prevent web-based attacks. NIST SP 800-53 addresses boundary protection and flaw remediation, and NIST SP 800-171 includes vulnerability monitoring and flaw remediation requirements for systems handling CUI. Based on how ComplianceForge documentation maps to the Secure Controls Framework, one WAF standard and one virtual patching procedure can support each of these at once.
In the "compliance vs security debate", virtual patching was not explicitly called out as part of "patching" in the ENISA statement, so the use of virtual patching may not be seen as viable alternatives in all cases. In reality though, virtual patching is focused on security by providing a viable method to quickly limit the ability of an attack vector to exploit your systems.
No. It reduces risk while the real fix is tested and deployed. The vulnerable code remains until it is patched, so every virtual patch needs an owner and an expiry date.
With a managed WAF and a documented emergency change procedure, a rule can often be deployed across protected applications within minutes or hours, compared with days or weeks for a full code fix. Your standard should set the target.
A WAF cannot stop every attack, but it shortens the time you are exposed after a disclosure, which is the window that faster, AI-assisted exploitation targets.
A WAF policy and standard, the virtual patching procedure, a log of active virtual patches with expiry dates, WAF evidence of blocked attempts, and proof the underlying fix was completed.
