Impart Security, an AI runtime protection platform, today launched the Runtime Defense Harness, a controlled environment where AI agents write and test virtual patches for new vulnerabilities without putting AI in the traffic path. The launch comes as exploits increasingly outpace fixes.

In the harness, agents build each virtual patch against the customer’s own traffic, an engineer approves it, and Impart’s engine enforces it as deterministic code. Security teams get a tested virtual patch as soon as 60 minutes after disclosure, instead of waiting days for a vendor signature or weeks for a code fix.

When researchers disclosed the PHP2Shell vulnerabilities in October, the first exploit attempt had come four days earlier. Nearly 80% of 4.38 million internet-facing PHP services run unsupported versions, so for many teams a patch release is not protection.

Most security teams have only a handful of people who can write and ship a custom rule. Everyone else waits on them, or on an edge vendor’s generic signature, which often ships in log-only mode.

“The old rhythm of security teams responding to a vulnerability, filing a ticket, and hoping for a patch a few weeks later is long gone. AI has compressed the timeline, so exploits can arrive before the fix. We built the Runtime Defense Harness with the controls first, so teams can move fast without risking production,” said Jonathan DiVincenzo, CEO and co-founder of Impart.

The model helps write and test each rule but never sits in the live request path. Impart’s Layer 7 engine enforces approved rules inline as deterministic WebAssembly, so the same request gets the same decision every time, with no extra network hop or per-request inference.

The harness makes AI defense safe to run in production through three controls:

  • Scoped access and tiered autonomy: Agents get just-in-time access to only the traffic and systems each task needs. They investigate, draft, and test on their own, but block mode and live rule changes require an engineer’s approval.

  • Programmable enforcement: Every virtual patch is code that teams can version, test, and roll back in seconds.

  • Your model, full audit trail: Teams use Impart’s lightweight AI model or bring their own models from Anthropic, OpenAI, Azure, or Google. Every agent action lands in an event timeline showing what the AI did, why, and what changed.

“The harness coordinates agents to do what a security engineer does when a new CVE lands: understand the attack, write the rule, test it, and hand it over for approval. Your engineers make the call. The harness makes sure everything in front of them is tested and auditable,” said Brian Joe, chief product officer and co-founder of Impart.

The approach has held up under real disclosures. During a high-severity Node.js vulnerability (CVE-2026-111497) that could allow remote code execution, Impart customers had a blocking virtual patch within 24 hours. A leading CDN’s rules arrived four days later, in log-only mode, against its own published five-day response target.

The Runtime Defense Harness is available now for Impart customers at no added cost. Teams can start with Impart Defend Free, a free command-line tool that audits their current WAF rules, at impart.ai/runtime-defense-harness.

About Impart Security

Impart is an AI runtime protection platform built on a programmable Layer 7 control engine. It protects AI, web applications, and APIs, blocking threats inline with deterministic enforcement that doesn’t break production.

Media gallery

About The Author
Business Wire