A compensating mitigation is a temporary control used when a security flaw cannot be patched right away. Instead of fixing the vulnerable software immediately, defenders add another layer that lowers the chance of exploitation or limits the damage if an attack succeeds. Common examples include network segmentation, tighter access controls, disabling exposed services, firewall or WAF rules, application allowlisting, and increased monitoring.
This matters because patching is not always instant. Maintenance windows, compatibility testing, and operational constraints can delay remediation, while attackers may already be probing for the weakness. A compensating mitigation helps reduce exposure during that gap. In real defenses, teams use it to block attack paths, slow reconnaissance, or contain a vulnerable system until an update can be safely applied. It is not a permanent replacement for a patch, but a risk-reduction measure that buys time and helps keep systems defensible under pressure.