Vulnerability Defense Shifts From Patching to Runtime Blocking
Summary
F5 and Check Point say AI now exploits flaws faster than the 43-day patch cycle, so customers block attacks in-line; F5 has 300+ AI WAF customers, over 75% blocking.
F5 (FFIV) and Check Point Software (CHKP) both told investors on their latest earnings calls, held between October 27 and November 2, 2026, that AI is pushing vulnerability exploitation ahead of the enterprise patch cycle, and that customers are responding by blocking attacks in the traffic path instead of relying on patches alone [1][2]. F5 said mean time to exploit has fallen to negative seven days [1].
Why the Patch Cycle No Longer Closes the Exposure Window
The standard way to handle a software vulnerability is to patch it: the vendor publishes the flaw and a fix, and the enterprise tests the fix and rolls it out system by system. On its call, F5 said this typically takes 43 days [1]. What changed is the discovery side. F5 said frontier AI has accelerated vulnerability discovery to "machine speed": more than 70,000 vulnerabilities were discovered and published through September this year, roughly 50% more than in all of 2025, and mean time to exploit has collapsed to negative seven days, meaning flaws are often exploited before they are publicly disclosed [1]. Systems therefore stay exposed for the whole period between disclosure and a completed patch.
The products that can cover that gap sit in the traffic path. A web application firewall (WAF) sits in front of websites and applications and inspects each incoming request; an intrusion prevention system (IPS) does similar checks at the network layer. These tools can simply log suspicious requests, or they can run in "blocking mode" and drop malicious traffic outright. If the rules recognize a new attack technique, an enterprise can stop the attack first and patch on its own schedule. Every company that exposes websites and APIs to the internet faces the same patch gap, so this approach could spread across security vendors' customer bases.
AI WAF Adoption and Runtime Blocking at F5 and Check Point
F5 offered the most direct numbers. Its AI-powered WAF launched in March, and in less than six months it ended the fourth fiscal quarter with more than 300 customers deploying it, over 75% of them in blocking mode [1]. F5 also said security is increasingly leading customer conversations and that investment is moving away from fragmented point products toward converged platforms that enforce consistent policy in real time across every environment [1].
On its November 2 call, Check Point management described the situation as a "vulnerability apocalypse" and said defenders will lose if they stay in reactive mode [2]. PHP2Shell, a critical PHP flaw that surfaced in late October, served as a live test: many governments, banks and companies suspended online services while they patched [3], while Check Point said its customers were protected before they needed to do anything [2]. In the same quarter, Check Point signed an eight-figure deal with a Fortune 200 energy company that delivers both network modernization and exposure management [2]. Exposure management means continuously finding which systems are open to attack. Check Point's email security, AI security and exposure management (CTEM) businesses together grew annual recurring revenue (ARR) by more than 38% year over year, with calculated billings up more than 47% [2].
Two direct competitors, each speaking from its own customers and deals, describe the same shift. Neither company breaks out how much revenue in-line blocking generates, so the change shows up today in customer deployments and deal structure, not in separable financial figures.
Security Budgets Move Toward In-Line Blocking in the Traffic Path
If the trend holds, vendors that can bundle exposure discovery with in-line blocking should win larger orders. Check Point's energy-company contract combines network modernization with exposure management [2], and F5 describes demand shifting from point products to unified platforms [1]. For buyers, that would send more of the protection budget to subscriptions and appliances deployed in the traffic path.
This conclusion has clear limits. Fortinet (FTNT) also said on its October 28 call that AI is discovering more vulnerabilities and that firewalls are best positioned to stop these intrusions, but what it sells for this is signatures, IPS and virtual-patching subscriptions [4]. In-line blocking therefore follows different technical routes across vendors, and the AI-based detection F5 emphasizes is not a shared industry practice. Tenable (TENB) said usage of its HEXA AI assistant rose up to 5x after PHP2Shell [5], so demand for scan-and-remediate tools is also rising rather than being displaced. The many organizations that took services offline during PHP2Shell [3] also show that in-line blocking is still shallowly adopted. Metrics to track include F5's AI WAF customer count and blocking-mode share, and the ARR growth of Check Point's newer businesses.
Companies Exposed to the Shift
- Radware (RDWR): Focused on application security, Radware has cloud ARR of about $107 million, 41% of total ARR. Its Exploit Shield module provides runtime protection while customers remediate, and it won its first large deal with an Asian telecom operator in the third quarter [6]. Whether this revenue accelerates as the patch gap widens depends on future disclosures.
- Akamai (AKAM): Security is Akamai's largest segment, led by its WAF. On its second-quarter 2026 call, management already attributed WAF demand to vulnerabilities exposed by frontier models and cited a $14 million upgrade [7]. It is exposed to the same customers who want to block first and patch later.
- Tenable (TENB): Tenable sells vulnerability scanning and exposure management. Check Point's bundle of exposure validation with in-line enforcement competes directly with that market, while Tenable's own AI tool usage is also rising, so it is not yet clear whether the shift diverts demand from Tenable or lifts it.
Sources
[1] Drillr · F5 (FFIV) · 2026-10-27 · Q4 fiscal 2026 earnings call
"A typical 43-day patching cycle is now a liability."
[2] Drillr · Check Point Software (CHKP) · 2026-11-02 · Q3 2026 earnings call
[3] Drillr · News search · Organizations Take Websites Offline Over Critical PHP Flaw · 2026-11-02 · News report
[4] Drillr · Fortinet (FTNT) · 2026-10-28 · Q3 2026 earnings call
[5] Drillr · Tenable (TENB) · 2026-10-28 · Q3 2026 earnings call
[6] Drillr · Radware (RDWR) · 2026-10-28 · Q3 2026 earnings call
[7] Drillr · Akamai (AKAM) · 2026-08-06 · Q2 2026 earnings call
This article only helps surface industry changes and companies that may be overlooked. It is not a stock recommendation.