Cisco Live Protect Brings Runtime Shielding to Network Infrastructure
Cisco’s new infrastructure-security platform combines faster vulnerability research with runtime protections. It could reduce emergency patch pressure, provided temporary shields do not become permanent exceptions.
Cisco announced an agentic platform for operating and defending critical IT infrastructure on 2 June. Among its security capabilities is Live Protect, a form of runtime shielding intended to block exploitation on supported network devices without a reboot, upgrade or service interruption.
The company also plans to move towards twice-monthly vulnerability disclosures from July and says AI-assisted analysis is scanning 1.8 billion lines of code across 25 programming languages. Live Protect is expected to become generally available with Cloud Control in July, initially for Nexus 9000 systems before broader portfolio support.
A shield can buy safer remediation time
Network infrastructure is difficult to patch quickly. A core switch or gateway may support many services, have narrow maintenance windows and require a carefully tested change. When a high-risk vulnerability appears, the choice can feel like accepting exposure or accepting downtime.
A verified runtime control can create a third option: block the exploit path while the organisation tests and deploys the permanent fix. The important word is temporary. The underlying vulnerable code remains, and the shield may not cover every variant or alternative path.
Treat virtual patches as changes
An automatically generated or vendor-delivered protection still changes production behaviour. It needs ownership, evidence and a rollback path.
Before enabling runtime shielding, define:
- which devices and software versions are supported;
- the vulnerability and traffic conditions the control addresses;
- how effectiveness is validated without unsafe production testing;
- the expected effect on latency, routing and legitimate protocols;
- who can approve, monitor and disable the protection;
- when the permanent software update will be installed;
- what happens if the management service is unavailable.
Record every active shield in the vulnerability register. A dashboard showing “protected” must not automatically close the remediation ticket.
Faster disclosures change operational tempo
A predictable twice-monthly cadence can help teams plan triage, but it may also create concentrated bursts of work. Network owners should reserve capacity around publication dates, keep device inventories current and pre-classify critical services so impact analysis does not begin from scratch.
AI-assisted code analysis may increase the number of findings rather than reduce it. Organisations need a risk-based process that combines vendor severity, exploit evidence, device exposure, available mitigations and service criticality.
Management platforms become critical assets
Cloud Control and similar systems sit above large portions of the network. They can observe state and push protective changes, which makes their identities, APIs and update channels highly valuable.
Use phishing-resistant administrator authentication, least-privilege roles, separate approval for fleet-wide actions and independent logs. Test how devices behave if their cloud connection is lost, and ensure the organisation can still recover or patch through an alternative route.
The useful promise—and its boundary
Live Protect addresses a real operational gap between disclosure and maintenance. It will be valuable where protection is precise, observable and easy to retire. It becomes a risk if “no reboot required” turns into “no upgrade required”.
Runtime shielding should shorten the window of unmitigated exposure while preserving a controlled path to permanent remediation. That is a resilience capability, not a replacement for lifecycle management.
