Why contain instead of fix?
Because fixes take time. The owner may need a vendor patch that does not exist yet, a change window, or a test cycle for a system nobody wants to touch. Meanwhile the exposure is proven and public. A compensating control narrows the window.
Option 1: a WAF or edge rule
A web application firewall or edge security service can block the requests that exploit a weakness, without changing the application. This is often called virtual patching.
- IONIX describes identifying WAFs across Akamai, Cloudflare, AWS, Azure, Imperva, Barracuda, Fortinet, Palo Alto Networks, Fastly and more than 50 others, and turning a CVE into a deployable WAF rule within 12 hours of publication, delivered into remediation workflows.
- watchTowr describes Active Defense, which pushes mitigation rules to the edge through Cloudflare, Akamai, Imperva, F5, Fortinet, Check Point and Citrix.
Limits: a rule protects only traffic that passes through the WAF. An asset reachable around the WAF, or not behind one at all, is still exposed. That is why WAF coverage itself is worth checking; IONIX launched WAF Posture Management in August 2026 to find unprotected assets, check enforcement status and detect configuration drift, per IONIX.
Option 2: an automated response playbook
A playbook runs predefined actions when a condition is met: open a ticket, change a firewall object, disable a service, notify an owner. Palo Alto Networks describes Active Response in Cortex Xpanse as built-in automated playbooks, with further actions through Cortex XSOAR. Playbooks are as good as the actions behind them; ask which ones exist out of the box.
Option 3: reclaim the asset
Some exposures are assets an attacker could take over: an expired domain still referenced by your pages, an abandoned cloud storage bucket, a nameserver delegation left behind. The control is to take the asset back first. IONIX describes Active Protection, which purchases expired domains, claims abandoned cloud buckets and locks down exposed nameservers on the customer's behalf.
Option 4: restrict or remove access
The bluntest control is often the best: take the service off the internet, put it behind a VPN or allow only known addresses. Tools rarely do this for you; it is usually a ticket to the owner or the network team.
How do you choose?
- Is the asset behind a WAF you control? If yes, a rule is usually fastest.
- Does the service need to be public at all? If not, remove access.
- Is the risk a takeover of an abandoned asset? Reclaim it.
- Is there a playbook for this pattern already? Use it, then review what it did.
Whatever you choose, record it on the ticket, set an expiry date for the control, and keep the fix open until the retest passes.