Tech Bytes: Get Ahead of AI-Driven Vulnerabilities with Frontier Virtual Patching (Sponsored)

SPEAKER_1 (0:04)

Today on the Tech Bytes Podcast, we explore Frontier Virtual Patching with sponsor Palo Alto Networks. Palo Alto Networks recently announced Frontier Virtual Patching as part of Pan-Os 12.2. We're going to talk about how this release can help IT and OT organizations deal with the increased speed and scale of vulnerabilities being uncovered. Frontier Virtual Patching can help give organizations more time to test and deploy patches while still protecting against exploits. We'll also talk about how it works, how Palo Alto Networks itself is using AI to find vulnerabilities in open source and commercial software, and how it partners with industry groups to support maintainers and developers as they deploy fixes. My guest is Taylor Edema, VP of Product Management at Palo Alto Networks. And Taylor, welcome to the podcast. So our listeners are obviously aware that AI models have proven adept at finding vulnerabilities. What does this all look like from your perspective?

Yes.

Taylor Edema (0:51)

Well, thank you so much for having me. You know, as I think we're all seeing, Frontier AI has fundamentally changed the vulnerability landscape. These latest Frontier models are showing themselves to be incredibly capable at finding novel vulnerabilities in software, being able to prove those vulnerabilities out, create proofs of concept, create weapons out of those vulnerabilities that they discover, and be able to launch attacks really within minutes of novel vulnerability discovery. And so the net effect of that is that the vulnerability timeline is compressing to virtually zero.

Patching alone is just not a strategy anymore. Enterprise defenders around the world are saying, we need another mitigation, we need another layer of defense because we just can't keep up with the patching.

SPEAKER_1 (1:36)

I mean, frankly, this is just adding fuel to the fire that's existed of, it's very hard for vendors to get patches out. It's very hard for organizations to roll out patches because sometimes they want to test them, sometimes they need to do proof of concept, they've got a whole backlog, they need to get through, emergencies come up and so on.

Taylor Edema (1:56)

That's right. I mean, patching has always been somewhat of a challenge. You're dealing with, as you said, validating the fix of doing trial deployments in your environment, making sure nothing breaks. In critical industry, you'll have change control windows, outage windows, things like that, that you have to plan around.

But for the most part, at least you could generally rely on the fact that most vulnerabilities were found, were responsibly disclosed to the vendor. The vendor works on the patches, deploys those patches to customers, and customers ultimately deploy those to their environment. And ideally, if everything works perfectly, you get those patches deployed ahead of general awareness by the attacker community. And as we're just saying, with these models now, that floor or that bar has fallen to the floor in terms of the technical know-how and skill required to go out and do your own vulnerability discovery.

Really, everyone has access to these tools by and large at this point.

SPEAKER_1 (2:52)

Yeah, for sure. So we are here to talk about Frontier Virtual Patching. Can you talk about how it works? That is, how does Palo Alto Networks get from a discovered vulnerability to something that can deploy to a firewall?

Taylor Edema (3:03)

Yeah, certainly. So the concept of virtual patching, virtual patching itself is not necessarily a new term or a new concept. Virtual patching has been around, arguably since the late 90s, early 2000s as intrusion detection started to evolve into an intrusion prevention or IPS systems as the cybersecurity industry and network defenders overall became more comfortable with deploying this in-line network mitigation in a blocking mode to detect and stop exploitation against vulnerable software. And so Palo Alto Networks, we've been doing this for going on 20 years now since inception of the company. We've been doing the IPS mission for our customers. We think what's changed and where we needed to take this area of capability to the next level is, if the new reality is that vulnerability discovery now is basically democratized and everyone's using these models to go find vulnerabilities and weaponize them in record time, we needed to evolve what's traditionally been known as virtual patching or IPS.

And we developed a capability we call frontier virtual patching. And essentially, we've changed or evolved three specific attributes of how we do virtual patching. The first is, we can't react to vulnerability exploits in the wild, find them in use after the fact, and deliver protections. We can't wait for code to show up on a dark web form or come through a bug bounty program. We really need to be extremely proactive, and as some might say, fight AI with AI. If the bad guys have these tools, we need to be at the forefront using these tools first, and going out and finding as many of these vulnerabilities as possible that are discoverable with AI. And so that's what we've done. We have relationships with all of the top frontier labs. We're using these models and helping us find these vulnerabilities as quickly as possible. And we're also partnering with the closed source ecosystem, enterprise software vendors, OT manufacturers, medical device manufacturers, etc. And we're inviting them to partner with Palo Alto Networks through a partner program. We actually just launched last month. They were called the Critical Defense Program. And this program essentially is a way to invite vendors to share private vulnerability information about their own products in a safe and private way with Palo Alto Networks so that we can be more proactive and develop virtual patches for vulnerabilities coming through their own P-Sert pipelines and just get that much farther ahead of the threat.