Miggo launches rapid defence layer for active exploits

Miggo Security has launched a defence-in-depth mitigation product designed to close the gap between vulnerability disclosure and patch deployment, stopping active exploits within minutes.

The product combines controls at the network edge with controls inside an application, allowing security teams to apply temporary protections while standard patching continues. It generates, tests and validates mitigation measures for a customer's specific exposure before deployment.

The launch targets a long-standing problem in cybersecurity operations: attackers can often turn newly disclosed vulnerabilities into working exploits far faster than companies can install patches. Even when patches are available quickly, they typically still require action by IT and engineering teams, leaving systems exposed in the meantime.

Miggo's approach focuses on the path an exploit takes through an application rather than relying only on a vulnerability identifier. In some cases, an attack can be blocked at the edge because it appears as a recognisable request pattern. In others, it must be intercepted inside the application because the malicious technique only becomes clear during execution.

That distinction is central to the product's design. The system places mitigation controls according to the application context and how a flaw is reached, rather than applying the same response to every disclosed vulnerability.

One element of the release is a tool called WAF Copilot, which works with an organisation's existing web application firewall. It analyses an exploit, generates a blocking rule, and tests variations of the attack to determine whether the rule holds up beyond a single proof-of-concept payload.

Another element is the Miggo sensor, which operates inside the application. The sensor identifies exploit techniques as they execute, with inline blocking available in early preview, and can detect malicious execution in the affected flow without broadly shutting down legitimate activity.

Recent example

Miggo said it demonstrated the new mitigation model against a group of LiteLLM vulnerabilities disclosed within one week, including a privilege escalation flaw and a remote code execution flaw with the same severity rating. According to the company, the privilege escalation issue could be blocked at the edge because it followed a recognisable request pattern, while the code execution flaw had to be caught inside the application because a simple pattern-based block could be bypassed or remain incomplete.

The company argued that this showed how two vulnerabilities in the same software component can require different mitigation methods depending on how the exploit works. Using both layers together can also help stop lower-impact flaws that might otherwise be chained into more serious attacks, it said.

Miggo said the new product can reduce exposure windows by up to 99% and lower operational overhead by 30% or more by acting before patching is completed. Those figures were provided by the company.

Daniel Shechter, Chief Executive Officer and Co-Founder of Miggo Security, described the release as an effort to move defensive action closer to the speed at which new exploits appear.

"Defence-in-depth mitigation means machine-speed protection with no business interruption. For Miggo customers, it means independent yet coordinated layers of protection: one at the edge, one inside the application," said Daniel Shechter, Chief Executive Officer and Co-Founder of Miggo Security.

Shechter said the company validates mitigations before deploying them into customer environments.

"When a new exploit drops, we place the right mitigation in the right layer, on the exact path it runs, in minutes. We run tests in Miggo Labs to validate its efficacy and safety for the customer environment before it even touches their environment. That's the fastest, smartest way to mitigate whatever's coming at you," he said.

Miggo operates in the market for application detection and response tools, which have drawn interest as organisations seek ways to secure traditional software, cloud-native services and AI-based applications against increasingly fast-moving threats. The company positions this release as a way to give security teams a temporary line of defence while patching and remediation follow their normal process.