Rapid7 integrates Active Patching for automated risk mitigation

Rapid7 has released Active Patching, an automated patching and remediation feature developed in partnership with Automox and integrated into the Rapid7 Exposure Command platform.

Active Patching is designed for security and IT teams to address vulnerabilities on exposed endpoints by automating patch deployment, applying compensating controls when patches are not available, and giving real-time insight into the status of remediation efforts.

The new capability comes as organisations face increasing challenges from attackers who are quick to exploit zero-day vulnerabilities and system misconfigurations. Traditional approaches to patching, which often rely on manual processes, can lead to delays and incomplete coverage, potentially leaving systems exposed. Active Patching aims to tackle these issues by combining threat intelligence, contextual risk insights and automated workflows for faster response to vulnerabilities.

Automated risk mitigation

Active Patching works in conjunction with Automox's Autonomous Endpoint Management technology, giving security and IT teams the ability to prioritise and implement patches efficiently across a wide selection of IT assets. This approach provides proactive mitigation and helps maintain compliance through exposure management. The solution facilitates the identification of vulnerable systems, keeps track of which require patches, and highlights those with no currently available fixes.

Craig Adams, Chief Product Officer at Rapid7, commented on the product's aims and functionality.

"The visibility and context Exposure Command delivers is unmatched. It's not just about seeing where you're vulnerable, it's about knowing exactly what to do next. We've built a platform that doesn't just highlight risk, it contextualises it. Active Patching is another way that Rapid7's Command Platform turns insights into action, enabling teams to automatically remediate vulnerabilities or apply compensating controls in real time, even when a patch doesn't exist. That's the difference between reactively managing vulnerabilities and proactively eliminating exposures."

By leveraging Automox's automation capabilities, Active Patching seeks to deliver scalable, impact-driven risk mitigation by automating remediation actions across multiple devices at once. According to Rapid7, threat intelligence is embedded in every finding, empowering organisations to prioritise remediations that matter most to essential business assets. The platform compiles contextual insights, dynamic risk scores, and actionable intelligence sourced from Rapid7 Labs to ensure confidence in decisions regarding vulnerability management.

Key features and integration

The system introduces several features to improve the remediation process: pre-built virtual patching templates to protect assets lacking known fixes, out-of-box workflows to drive compliance and quick remediation, and closed-loop vulnerability management for continuous status tracking. Additionally, Active Patching enables automated fixes for a wide range of operating systems, including Linux, MacOS, Windows, and their associated third-party applications.

Jason Kikta, Chief Information Security Officer and Senior Vice President of Product at Automox, highlighted the joint value brought by the partnership between the two companies.

"Modern security demands more than just knowing where you're exposed, it requires the ability to take action, fast. Our partnership with Rapid7 brings that capability to life. By embedding our patch and configuration automation technology into Exposure Command, we're enabling customers to go from identification to remediation in a matter of minutes, dramatically reducing risk while eliminating manual overhead."

Rapid7 states that Active Patching enhances the Exposure Command platform's existing visibility of an organisation's attack surface, vulnerability management capabilities, and threat intelligence. The company indicates that this approach enables security teams to operate more efficiently and respond more quickly to critical security issues in their environments.