Zscaler announced on October 5 that it's working with IBM and Red Hat to protect private applications in the ugliest stretch of any vulnerability's life: the time between when it's disclosed and when it's actually patched. I'm a week late on this one. Standard disclosure: I work at Zscaler, so read the enthusiasm as informed, not neutral.
The Patch Window Used to Be a Window
Here's the stat that frames the whole thing. The release cites Mandiant's M-Trends 2026 report, which says the mean time to exploit a vulnerability has fallen below zero. Below zero. On average, attackers are exploiting flaws before they're even publicly disclosed.
That breaks the traditional deal security teams made with themselves: a CVE drops, you triage it, you schedule a maintenance window, you test the patch, you roll it out, and you hope nobody got there first. That process takes days or weeks, sometimes much longer for the internal apps nobody wants to touch. If attackers are already in before day zero, "we'll get to it in the next patch cycle" isn't a plan.
"AI is shrinking the window between vulnerability discovery and vulnerability exploitation. A window that was months or weeks is now hours and minutes."
— Gunnar Hellekson, Vice President and General Manager, Lightwell, Red Hat
Two Halves of One Fix
What I like about this collaboration is that it doesn't pretend either half is enough on its own.
The Zscaler half is the shield. Zscaler Autonomous Application Shield runs on the Zero Trust Exchange. According to the release, Zscaler App Connectors continuously run safe assessments of each private application's exposure points and vulnerabilities, and the Zscaler cloud evaluates each app individually so only the protections it actually needs get applied. When a new vulnerability shows up, protections can be applied inline and in real time, without waiting for a patch. Exploit attempts get blocked at the network level.
The IBM and Red Hat half is the fix. Lightwell, from IBM and Red Hat, provides validated remediations for affected open source software, so customers can fix the underlying flaw at the source.
Put them together and you get a sane sequence: block the exploit now, patch properly in the meantime. Zscaler's Joby Menon, SVP of Product Management, described it as bringing together inline, application-specific protection and validated remediation to reduce risk during that gap.
Why This Fits Zero Trust
This is a natural extension of how ZPA already works. Private apps behind Zscaler aren't exposed to the internet in the first place, and users connect to specific apps, not the network. Adding app-specific, inline protection on top of that means even an authorized connection can't be used to throw an exploit at an unpatched app. It's not "patch faster or die." It's "buy yourself time to patch correctly."
The open source angle matters too. Most internal apps are built on piles of open source components, and a flaw in one library can light up dozens of apps at once. Validated fixes for those components, paired with a shield that's already in the traffic path, is a much better answer than an emergency change window at 2am.
Bottom Line
The honest reality of vulnerability management is that you'll never patch faster than attackers exploit, especially now that AI is accelerating the exploit side. So stop treating the patch window as a race you can win, and start treating it as a gap you can cover. Shield the app inline, fix the code properly, and don't let a CVE number turn into a breach while you wait. Autonomous Application Shield is available now through an Early Access Program.
Full release: Zscaler Collaborates with IBM and Red Hat to Protect Private Applications from Frontier AI-Powered Threats