WAF Security Specialist

Miggo adds AI and emerging threat rules to AWS WAF. August 4, 2026 Miggo Security has made two partner-managed rule sets available directly through the AWS WAF console, giving customers access to application protection for actively exploited vulnerabilities and attacks targeting AI and machine learning applications. The rules are offered through AWS Marketplace and can be added to existing AWS WAF deployments without introducing a separate security platform. The first rule set focuses on emerging application threats, including vulnerabilities with known exploitation activity, publicly available proof-of-concept code, or inclusion in the CISA's Known Exploited Vulnerabilities catalog. The second is designed to protect AI and machine learning applications, including frameworks and technologies that are increasingly being targeted as enterprise AI adoption grows. Miggo said its rules are created using validated exploit code and tested against bypass techniques and modified attack patterns before release. The company will update the rules as new threat intelligence and exploit activity emerge, giving security teams another way to reduce exposure while application owners test and deploy patches. For AWS customers, the integration adds a more targeted layer of application security inside the infrastructure they already manage. It also gives security providers and internal teams a way to respond more quickly when newly disclosed vulnerabilities begin appearing in active attacks, while keeping patching and remediation work on a controlled schedule. For MSSPs, the launch adds another layer they can bring into managed AWS security services without introducing a separate platform. Its value will come down to how well the rules perform in live customer environments, how easily they can be managed across accounts and whether the pricing supports a repeatable service model. As more applications and AI workloads move into production, protections tied to active exploitation will become a more important part of how providers help customers reduce risk between disclosure and patching.

Miggo Security has launched two partner-managed rule sets within AWS WAF's console, offering protection against emerging CVEs and AI/ML attacks. The Tel Aviv and San Francisco-based company is among a select group of providers chosen by AWS to offer integrated WAF protection. The rule sets provide exploit-aware protection against actively exploited vulnerabilities, those with publicly available proof-of-concept code, or vulnerabilities designated by CISA as known exploits. Unlike traditional static WAF rule sets, Miggo generates rules from validated proof-of-concept code and tests them against bypass variations before release. The solution delivers continuous updates with real-time threat intelligence, allowing security teams to mitigate exploitable vulnerabilities whilst patching proceeds. Both rule sets are available directly through AWS Marketplace, requiring no additional configuration.

Miggo launches rapid defence layer for active exploits. Wed, 29th Jul 2026 (Today) Miggo Security has launched a defence-in-depth mitigation product designed to close the gap between vulnerability disclosure and patch deployment, stopping active exploits within minutes. The product combines controls at the network edge with controls inside an application, allowing security teams to apply temporary protections while standard patching continues. It generates, tests and validates mitigation measures for a customer's specific exposure before deployment. The launch targets a long-standing problem in cybersecurity operations: attackers can often turn newly disclosed vulnerabilities into working exploits far faster than companies can install patches. Even when patches are available quickly, they typically still require action by IT and engineering teams, leaving systems exposed in the meantime. Miggo's approach focuses on the path an exploit takes through an application rather than relying only on a vulnerability identifier. In some cases, an attack can be blocked at the edge because it appears as a recognisable request pattern. In others, it must be intercepted inside the application because the malicious technique only becomes clear during execution. That distinction is central to the product's design. The system places mitigation controls according to the application context and how a flaw is reached, rather than applying the same response to every disclosed vulnerability. One element of the release is a tool called WAF Copilot, which works with an organisation's existing web application firewall. It analyses an exploit, generates a blocking rule, and tests variations of the attack to determine whether the rule holds up beyond a single proof-of-concept payload. Another element is the Miggo sensor, which operates inside the application. The sensor identifies exploit techniques as they execute, with inline blocking available in early preview, and can detect malicious execution in the affected flow without broadly shutting down legitimate activity. Recent example Miggo said it demonstrated the new mitigation model against a group of LiteLLM vulnerabilities disclosed within one week, including a privilege escalation flaw and a remote code execution flaw with the same severity rating. According to the company, the privilege escalation issue could be blocked at the edge because it followed a recognisable request pattern, while the code execution flaw had to be caught inside the application because a simple pattern-based block could be bypassed or remain incomplete. The company argued that this showed how two vulnerabilities in the same software component can require different mitigation methods depending on how the exploit works. Using both layers together can also help stop lower-impact flaws that might otherwise be chained into more serious attacks, it said. Miggo said the new product can reduce exposure windows by up to 99% and lower operational overhead by 30% or more by acting before patching is completed. Those figures were provided by the company. Daniel Shechter, Chief Executive Officer and Co-Founder of Miggo Security, described the release as an effort to move defensive action closer to the speed at which new exploits appear. "Defence-in-depth mitigation means machine-speed protection with no business interruption. For Miggo customers, it means independent yet coordinated layers of protection: one at the edge, one inside the application," said Daniel Shechter, Chief Executive Officer and Co-Founder of Miggo Security. Shechter said the company validates mitigations before deploying them into customer environments. "When a new exploit drops, we place the right mitigation in the right layer, on the exact path it runs, in minutes. We run tests in Miggo Labs to validate its efficacy and safety for the customer environment before it even touches their environment. That's the fastest, smartest way to mitigate whatever's coming at you," he said. Miggo operates in the market for application detection and response tools, which have drawn interest as organisations seek ways to secure traditional software, cloud-native services and AI-based applications against increasingly fast-moving threats. The company positions this release as a way to give security teams a temporary line of defence while patching and remediation follow their normal process.