Skip to main content

Zafran launches Attack Chain Killswitch in collaboration with Google Threat Intelligence
Mitigate Risk

Close the window before a patch

Zafran flags where your existing controls are missing, misconfigured, or bypassable, so policy-driven mitigations close the window on validated exposures before an exploit happens.

Get a Demo

Spring4Shell, exploited in the wild, reaches four servers: orders-api, payments-api, partner-gw and reports-svc. Each path passes a control point that belongs to one Palo Alto NGFW policy, and the policy is not enabled. Zafran enables it: every path is blocked at the firewall, the exploit stops short, and all four servers are protected without waiting for the patch.

How Zafran mitigates risk

Assess your firewall, WAF, cloud security group, and EDR configurations to show which vulnerabilities are already blocked.

Zafran's risk rings for CVE-2021-41773 in Mitigation mode, with the controls in focus. Zafran read each control's live configuration: CrowdStrike Falcon's prevention policy and the Palo Alto NGFW's threat ID 91648 already block the exploit, and the Akamai WAF has its path-traversal rule in detect mode. Switching it to block moves the controls score from -3.3 to -4.0, so the potential score after recommended actions drops from 5.9 to 5.2: possible risk Medium.

Reduce risk across thousands of vulnerabilities with a single control configuration.

Zafran's preemptive mitigations: enabling a feature on Cisco Firepower NGFW can mitigate 23.3 thousand findings across 7,772 assets, and modifying a rule action on Palo Alto NGFW can mitigate 11.6 thousand findings across 3,148 assets, each with a link to view the mitigation.

Protect end-of-life systems, OT, and business-critical apps that can't be patched or taken offline.

A Windows upstream mitigation in Zafran for ONPREM-LAB-SRV-001, a server marked End of Life, with vendor support ended. The mitigation, disable Windows IPv6, covers 26 vulnerabilities. Findings severity is Medium, with a Major (two-star) risk reduction, and the mitigation is available to deploy on the asset.

Find the choke point across attack chains and the one mitigation that breaks the most paths.

Attack Chain Killswitch: 85 attack chains, three entry points converging on one choke point. CVE-2024-4577, a PHP-CGI remote code execution flaw on internet-facing web-01, and an over-permissioned ci-deployer IAM role lead to java-svc-04; so do CVE-2024-3400 on VPN gateway vpn-gw-02 and a leaked partner API key. From java-svc-04, Log4Shell, CVE-2021-44228, opens paths to domain controller dc-01 and on to the crown jewel payments-db and an HR file share, and to a secrets vault and the S3 backups behind it. Enabling Palo Alto threat prevention signature 91991 for Log4Shell at java-svc-04 breaks every one of these chains; nothing past it is reachable.

Get a Demo

What customers see

  • Sallie Mae

    Sallie Mae found 23,000 vulnerabilities it could mitigate right away by reconfiguring controls it already owned.

    Read Case Study

  • 2,000 → 250 vulnerabilities sent to the fix team

    Large Insurance Company

    “We would have sent 2,000 vulnerabilities to the fix team. When we factor in runtime and compensating controls, we're now at 250.”

    VP Cyber Offense

Explore other use cases

Further reading

See Zafran in action

Prioritize and fix what is truly exploitable using risk context from your existing security tools.

Get a Demo