Today, Sweet is releasing Virtual Patching, enabling security teams to protect running applications against exploitable vulnerabilities, including zero-days, without waiting for a vendor patch or permanent code fix. Teams can apply immediate runtime protection and keep applications operating while the underlying vulnerability is remediated.

Close the Exposure Window Attackers Can Exploit

Fixing a vulnerability takes coordination. Engineering develops the change, builds and tests it, gets approval, and deploys it across the affected environment. Each step serves a purpose, but each may belong to a different team with its own priorities and schedule. That process can take days or weeks. Until the fixed version reaches production, a ticket, remediation recommendation, or planned deployment leaves the application exposed. For zero-day vulnerabilities, that exposure window can begin before a patch even exists. 

AI is making that exposure window more dangerous by lowering the cost and effort required for attackers to discover weaknesses and exploit them. Defenders still depend on investigation, handoffs, and release schedules, with every finding competing for limited human capacity. Changing the economics of cloud security requires reducing the time and effort between understanding a risk and protecting the application. Security teams need a way to act immediately while engineering completes the permanent repair.

“AI is accelerating vulnerability discovery and exploitation to the point where exploits are emerging days before patches are available; faster patching alone isn’t enough. Sweet’s Virtual Patching provides a critical layer of protection against known and unknown exploits, helping teams apply protection immediately while giving them the time they need to remediate vulnerabilities at their source.” - James Berthoty, Latio

Turn Prioritized Vulnerabilities into Immediate Protection

A virtual patch is a policy that protects a running workload from a specific vulnerability, whether it is a known CVE, a newly discovered zero-day, or a flaw in your own application code.. Sweet applies that protection directly to the running application through its sensor by targeting the vulnerable code path and blocking exploitation while legitimate application traffic continues. No code change is required.

The workflow begins in Sweet’s Vulnerabilities Catalog, where findings are ranked by Sweet Score using runtime context: what actually runs, what is exposed, and how likely a vulnerability is to be exploited. Teams can identify the findings that matter and see where the affected workloads are running. From a vulnerability, the user selects “Respond > Enforce Protection,” enters a short reason, and clicks “Run”. Sweet distributes the policy to its sensor on each node running the affected workload. Once the sensors confirm enforcement, the workload is marked Protected from that vulnerability. That status represents an enforced control on the application. Requests attempting to exploit the weakness are blocked. Protection follows the workload as it scales and restarts, covering new instances too. With Virtual Patching from Sweet, security can now address immediate exposure while engineering completes the permanent repair. The release schedule can proceed with protection already in place.

‍

Keeping Production Running During an Active Attack: Shai-Hulud

During an active attack, investigating and updating every affected workload can take longer than the time available to intervene. Sweet’s response to a Shai-Hulud supply-chain attack demonstrates the value of targeted runtime protection during that window.

A Sweet customer facing Shai-Hulud needed to protect production against malicious processes capable of harvesting credentials, propagating, and exfiltrating sensitive data. Sweet applied targeted runtime protections across active sensors. When the associated malicious behavior appeared, those protections terminated the malicious process at its source while leaving the surrounding workload operational. The customer stopped the malicious activity without operational downtime while security and engineering investigated the affected software and completed permanent remediation.

That response illustrates the operating principle behind Virtual Patching: apply a precise runtime control while the underlying repair proceeds. Shai-Hulud involved malicious package behavior; virtual patching applies that principle to a specific exploitable vulnerability. The same approach helps when a newly disclosed CVE affects production, a dependency update requires extensive testing, or a flaw in proprietary code needs engineering work. Teams can protect the application throughout the remediation window.

Sweet Delivers Security Outcomes with The Sweet Learning Loop

Security teams are judged on outcomes: the systems they actively protect and the risk they actively reduce. The data they collect matters when it helps deliver those results, but alone it is a signal. The Sweet Learning Loop connects runtime intelligence to outcomes through Attack, Fix, Defend. Virtual Patching strengthens the path from proving an exploit to protecting production.

• Attack: Sweet Attack continuously tests a defined scope of the environment and runs again whenever an image changes. It tests from the outside, as an attacker would, and reports an exploit only after validating it.
• Fix: Virtual Patching gives teams immediate protection against the identified weaknesses while engineering develops, tests, and deploys the permanent fix.
• Defend: Sweet’s lightweight eBPF sensors enforce that protection against the running workload, blocking exploitation attempts in 100 milliseconds or less while legitimate application

Runtime information is only as useful as the security outcomes it enables. Sweet transforms unified runtime visibility into action through its patented LLM-driven reasoning agent and its Learning Loop of Attack, Fix, and Defend

Together, these capabilities turn runtime vulnerability intelligence into enforced protection: less time exposed, exploitation blocked, and production kept running while engineering completes the permanent fix. Those are security outcomes a team can demonstrate.

Ready to change the economics of cloud security? Request a customized demo to see how Sweet helps your team prove real attack paths, protect production faster, and deliver measurable risk reduction with less manual effort.

‍