It’s no secret that AI-fueled research projects are placing a spotlight on vulnerabilities across the industry. While large catalogs of vulnerabilities have been created, automation plays a key role in your organization’s ability to address them before they impact the business. When patches for vulnerabilities exist, they should be triaged and applied. Customers have also accelerated patching cycles to handle more of these patches more quickly. In this blog, I will detail a series of mitigations and techniques you can use to address areas where patches are forthcoming but not yet present, as well as patching production environments in this dynamic world. These strategies are in addition to good perimeter defenses and comprehensive clearinghouse and “find-and-fix” patching initiatives, including IBM and Red Hat’s recently announced Lightwell. You can align these practices around the common recommended phases for incident response: Containment, eradication, and recovery. Each phase can be treated as a deliberate, repeatable process, which is precisely what automation is built for. Phase 1: Containment When a vulnerability has been identified but there are no available patches, the first step to mitigate the threat is containment. Containment could mean many things, such as isolation, restricting access, disabling accounts of vulnerable services, or revoking credentials. Containment can also include hardening surrounding infrastructure or moving critical workloads to other platforms. Automating these tasks creates a rapid response workflow when time is of the essence. Let’s look at a few examples: Example 1: Contain now, patch when ready Your vulnerability scanner triggered an alert to the event-driven automation capabilities included in Red Hat Ansible Automation Platform. This alert provides all the relevant information such as the vulnerability’s severity and scoring data, which are mapped against the conditions in the rulebook you defined. When you meet the conditions in the rulebook, Event-Driven Ansible triggers a workflow that moves the system onto an isolated virtual local area network (VLAN) for quarantine, restricts port or network traffic, and applies a stricter firewall configuration. Once the patch is available, Ansible Automation Platform automates the process of removing these controls and applies the patch in a controlled manner, including at-scale. This deterministic approach provides a repeatable, automated way of containing systems that is auditable and can include human-in-the-loop approval steps. This phased approach can be your standard, automated method of responding rapidly to a new threat that initially had no patch. This automation can integrate with your security information and event management (SIEM) and observability infrastructure, allowing you to go quickly from insight into action with speed and control. Example 2: Mitigations for business-critical workloadsNot every service lends itself to the process described in workflow example 1. Critical IT or application platforms might not be as forgiving to containment. How can we improve on this workflow dynamically? When a patch does not exist, experienced engineers typically reach for workarounds such as: disable a vulnerable feature, tighten firewall rules, redirect traffic, expand monitoring, or add authentication checkpoints. These are well-understood techniques. The problem has never been knowing what to do—it has been doing it fast enough, across enough systems, with enough confidence that the workaround does not break something else.This is where Ansible Automation Platform’s generative AI assists. Integrating Ansible Automation Platform with AI tooling allows you to enhance response quality and speed. The included generative AI and Model Context Protocol (MCP) server can connect to security intelligence services to accelerate the entire cycle. Instead of an engineer manually researching common vulnerabilities and exposures (CVEs), writing a one-off remediation playbook, testing it on a single host, and then manually rolling it out, the workflow uses AI to expedite understanding of the CVE impacts, generate code (for testing), and remediate as desired.