Review Critical Defense Program Evaluation Results

Table of Contents

Submit a Vulnerability to the Critical Defense Program

Custom Application and Threat Signatures

Review Critical Defense Program Evaluation Results

After Palo Alto Networks deploys a virtual patch for your submission, review the exploitation telemetry returned to your Critical Defense Program portal account.

Where Can I Use This?	What Do I Need?
Prisma Access NGFW	Critical Defense Program membership Active Critical Defense Program portal account Submission in Vaulted or Active stage

Once a submission reaches the Vaulted stage, Palo Alto Networks begins collecting anonymized in-the-wild exploitation telemetry from customer networks protected by the virtual patch. This telemetry is available to you in the Critical Defense Program portal and gives you real-world visibility into how threat actors are actively targeting your products globally, before and after public disclosure. When a submission transitions to Active, the virtual patch graduates to a standard Advanced Threat Prevention content update and full signature metadata becomes publicly visible.

Sign in to the Critical Defense Program portal.
On the dashboard, locate your submission and verify the current pipeline stage.

Submissions in the Vaulted stage have an active virtual patch deployed. Submissions in the Active stage have graduated to a standard content update.
Click the submission ID to open the submission detail page.
Select Telemetry.
The telemetry report includes:
- Detection count—The number of times the virtual patch blocked or alerted on exploitation attempts across the protected customer population.
- Geographic distribution—Anonymized country-level data showing where exploitation attempts originated.
- First seen—The date the first in-the-wild exploitation attempt was detected.
- Timeline—A day-by-day graph of detection volume from virtual patch deployment to the current date.
Telemetry data is anonymized and aggregated. No customer-identifying information is included.
(Optional) Click Export to download the telemetry report as a CSV file.
Select Disclosure to coordinate your public disclosure timeline with Palo Alto Networks.

When you are ready to disclose, enter your confirmed disclosure date and click Confirm Disclosure Date. Palo Alto Networks uses this date to schedule signature graduation and prepare the public vulnerability metadata for the standard content update.

Submit a Vulnerability to the Critical Defense Program

Custom Application and Threat Signatures

Advanced Threat Prevention

Review Critical Defense Program Evaluation Results

Advanced Threat Prevention

Review Critical Defense Program Evaluation Results

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Network Security

Endpoints

Visibility & Monitoring

Best Practices