Critical Defense Program
Learn how the Frontier AI: Critical Defense Program lets software vendors share
pre-disclosure vulnerability intelligence to enable virtual patches for their
customers.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- An Advanced Threat Prevention Plus license
- PAN-OS 12.2.4 or later
- Critical Defense Program membership (software vendors,
open source software foundations, or ICS/OT and medical
device manufacturers)
|
The Frontier AI: Critical Defense Program is a private consortium operated by
Palo Alto Networks® that gives software vendors a secure, embargoed channel to share
pre-disclosure vulnerability intelligence. When you submit a vulnerability through the
Critical Defense Program portal, Palo Alto Networks uses that intelligence to build and deploy network-level
virtual patches that protect your customers during the highest-risk window: after
AI-accelerated threat actors discover a vulnerability but before you can ship a software
update.
The Critical Defense Program operates on three pillars:
- Secure vulnerability sharing—You submit pre-disclosure vulnerability details
through an embargoed channel. Palo Alto Networks holds all submission data under
strict confidentiality until coordinated public disclosure.
- Virtual patch deployment—Palo Alto Networks generates proof-of-concept
exploits, builds multivariate network protections that cover the root vulnerability,
and deploys vaulted signatures to the Frontier Virtual Patching cloud. Customers
with an Advanced Threat Prevention Plus subscription receive these protections
automatically, without installing a software update.
- Exploitation telemetry—After virtual patches are live, Palo Alto Networks
returns anonymized in-the-wild exploitation telemetry to you. This gives you
real-world visibility into how threat actors are actively targeting your products
globally, before and after public disclosure.
The Vulnerability Lifecycle Management System processes each submission through two
downstream pipelines. A Deduplication and Correlation Engine normalizes and deduplicates
submissions to prevent redundant signature development across the partner network. An
Agentic IPS pipeline then automatically generates proof-of-concept exploits, builds
multivariate network-level protections, and validates them against evasion techniques.
These pipelines produce the signatures that deliver coverage through
Advanced Threat Prevention Plus and Frontier Virtual Patching.
Palo Alto Networks cryptographically seals vaulted protections in the Frontier Virtual
Patching cloud. Palo Alto Networks does not expose signature details, inspection logic,
or vulnerability metadata to your customers or to the public while a submission remains
under embargo. After you coordinate public disclosure and a patch is available, the
virtual patch graduates to a standard Advanced Threat Prevention content update and
the full vulnerability metadata becomes visible.
The Critical Defense Program is open to enterprise software vendors, open source software
foundations, and ICS/OT and medical device manufacturers. For ICS/OT environments where
operational constraints make patching impractical, virtual patching provides immediate
protection for legacy and unpatchable systems without requiring downtime or maintenance
windows.
