Virtual patching is a compensating control that helps block exploitation attempts against a vulnerable system without modifying the system itself. Instead of repairing the software flaw directly, defenders add controls around it, such as firewall rules, web application firewall policies, intrusion prevention signatures, access restrictions, or protocol filtering.
It matters because many critical systems cannot be patched quickly. Downtime, safety requirements, vendor dependencies, or fragile legacy software can make immediate remediation impossible. Virtual patching buys time by reducing exposure while a real fix is tested and scheduled. In real defenses, it is often paired with segmentation and least privilege so attackers cannot easily reach the vulnerable asset. In attacks, defenders may deploy it after a new vulnerability becomes public and exploit attempts begin, especially when exploit code is already circulating. It does not remove the underlying flaw, but it can sharply reduce the chance of successful compromise until patching is possible.