At a Glance
Industry: Financial Services · Global Institution
A global financial services company applies virtual patches without code changes while vulnerable applications continue to run in production.
| Metric | Result |
|---|---|
| In production, zero false positives | 2 years |
| Emergency virtual patch turnaround | Less than 24 hours |
| Average overhead under attack | ~3% |
| Patch cycles previously required | 4x per year |
Waratek’s virtual patching lets customers instantly apply routine and emergency security patches in a more cost-effective and time-efficient manner — without code changes or removing an application from production. This dramatically reduces the risk of a cyberattack, while decreasing the human and financial resources needed to stay current on required patches.
The Challenge
Prior to evaluating Waratek, the customer assessed hundreds of internal web applications, finding multiple Java versions that required quarterly patching of security vulnerabilities. A traditional upgrade or patching program was not feasible due to:
- Significant financial costs and staff time required to patch hundreds of applications at least four times per year on a timely basis
- Operational burdens that could negatively impact customers
Waratek’s Solution
Waratek is integrated into the Company’s application hosting platform and applies virtual patches that are the code equivalent of an Oracle Critical Patch Update (CPU). Virtual patching hundreds of applications means development teams no longer spend time upgrading Java versions, testing, and deploying traditional physical patches.
Results
In global production for two years, the company has realized further benefits from Waratek’s virtualization approach to application security:
- Zero false positives in two years of production in unconditional blocking mode.
- Sub-24-hour emergency patches developed for newly discovered high-severity vulnerabilities like Struts 2.
- Protection beyond the OWASP Top Ten: Name-Space Layout Randomization (NSLR) and Component Privilege De-Escalation mitigate complex attacks.
- Staff refocused on higher-value work: real-time attack alerts and forensic data guide development teams directly to vulnerable code.
Performance overhead while under attack averages a very low 3%. Other clients have seen performance improvements during normal operations after modernizing applications on out-of-date platforms.
See What Waratek Can Do for Your Java Applications
Request a demo to see how Waratek virtual patching keeps your Java applications secure and current — without code changes or downtime.
Oracle, Java, and related marks are trademarks of Oracle Corporation. Waratek does not claim ownership of any Oracle brand names, trademarks, or intellectual property.
