Zscaler (NASDAQ: ZS) is pairing an early-access application-security capability with remediation services from IBM (NYSE: IBM) and Red Hat to help enterprises protect private applications in the interval between a vulnerability disclosure and a software patch. The collaboration is aimed at a practical security problem: business applications can remain exposed while teams assess a flaw, obtain a fix and schedule deployment.
Zscaler said Zscaler Autonomous Application Shield will work with Lightwell from IBM and Red Hat in a coordinated path from inline protection to source-level remediation. The company said the combined approach applies adaptive protections to a particular application while Lightwell provides tested fixes for affected open-source software, with advisory and deployment support.
Protection Moves Ahead of the Patch Cycle
For enterprise IT leaders, the significance is less about eliminating patch management than reducing the risk that accrues before a patch can be applied. Zscaler cited Mandiant’s M-Trends 2026 report for its view that attackers are increasingly exploiting vulnerabilities before a public patch exists. The company did not provide customer deployment measurements for the collaboration.
According to Zscaler, its App Connectors assess the exposure points and vulnerabilities of each private application, while the company’s cloud evaluates protections individually rather than applying the same policy across every workload. When a new vulnerability emerges, the platform can apply protections inline while remediation proceeds. That design is intended to keep a reachable application from becoming an open path into a broader environment without waiting for the underlying software change.
The model addresses a gap that many infrastructure and security teams recognize in practice. Patch deployment may depend on testing, maintenance windows, application ownership and the availability of a validated fix. A temporary control can be useful during that period, but it must be specific enough not to disrupt a production application or create a large volume of policy exceptions that teams cannot operate.
Coordinating Defense and Remediation Changes the Operating Model
Zscaler said the collaboration will cover exposure discovery, application-specific protection, machine-speed response and validated source-level remediation. In the proposed workflow, Zscaler blocks an exploit attempt at the network level, while Lightwell helps organizations address the underlying open-source flaw. The companies describe the arrangement as a way to move from immediate containment to a durable fix in one coordinated response.
That division of labor matters for organizations that operate private applications across complex environments. Security operations teams need a current view of which application is exposed, application owners need confidence that an interim control will not break service, and remediation teams need a fix they can validate and deploy. The source does not specify supported application environments, pricing or a general-availability date; Zscaler said Autonomous Application Shield is currently available through an Early Access Program and that collaboration timing and capabilities may change.
Why the Patch Window Becomes a Competitive Security Issue
The collaboration positions Zscaler’s Zero Trust Exchange around a capability that legacy patch-management approaches often treat as separate work: enforcing application-specific protection while the remediation process catches up. For CIOs, the purchase decision will turn on integration with existing vulnerability, change-management and application-operations processes, as well as the accuracy of the controls applied to production systems.
The broader competitive shift is from tools that identify a weakness but leave protection and repair in disconnected workflows to platforms that attempt to link the two. If the integration performs as described, it could give enterprises more control over the period when a known vulnerability is not yet fixable in production. The value, however, will depend on validated coverage, operational fit and whether teams can safely apply and later remove the interim controls.