Contain exposures now, and know when the real fix is safe
Mitigation options as code for every verified exposure, and the state of every fix: apply it, mitigate, or wait.
The fix state decides what to do
- No fix yet Mitigate
- Released, not yet assessed Mitigate, prepare
- Released and safe here Apply
- Released, risky here Keep mitigation
Two routes for every exposure
Most exposures take both: contain now, apply the fix when it’s ready, then remove the mitigation once the path is verified closed.
Mitigate now
A compensating control scoped to exactly what makes it exploitable, without waiting for the patch.
Apply the fix when it’s safe
Know whether a fix is complete and safe here, what else it resolves, and the order to roll it out.
Three kinds of mitigation
Delivered as code your team or your agents can review and deploy.
Reduce exposure
Change the setting that makes it exploitable, harden, or cut the path.
Contain blast radius
Scope permissions, data access and network paths so an attacker can’t pivot.
Improve monitoring
Add the detections missing for that specific step of the path.
How this compares with most tools
| Mitigation | Most tools |
|---|---|
| Reduce exposure | Patch tools upgrade the component for every finding, even when a configuration change would close it. |
| Contain blast radius | Access reviews and segmentation run on their own schedule, without the vulnerability’s context. |
| Improve monitoring | Detection libraries cover technique categories, not what a given vulnerability enables on your resources. |
Released isn’t the same as safe
Defendermate tracks the state of the fix for every vulnerability in your environment.
- No fixNo fix exists upstream yet.Mitigate
- Fixed, not releasedMerged upstream, not yet in a release or package.Mitigate now
- Released, not yet assessedCompleteness and safety still being checked.Mitigate, prepare to apply
- Released and safe hereAvailable and assessed safe for your environment.Apply
- Released, risky hereIncomplete, or likely to break something.Keep the mitigation, wait
- SupersededA later fix replaced this one.Apply the newer fix
- Won’t fixEnd of life or disputed.Mitigate long term
See your options for every verified exposure
Connect read-only in minutes. Free to start.