Protected the moment we find it.
Defend takes the exploits Assess finds and neutralizes them at your middleware layer in 30ms — as a Generative Counter Exploit (GCE), not a generic WAF signature. No code changes. No tuning. No 30–90 day exposure window while developers work.
A GCE is not a WAF signature. It's a targeted mitigation.
When Assess confirms an exploit against your app, Defend generates a Counter Exploit: a piece of code that intercepts the specific request pattern that broke your app and neutralizes it — using one of six mitigation strategies, chosen by vulnerability type.
Rewrite
Remap the request before it hits your handler. Example: an untrusted client-sent price is replaced with the server's canonical price.
Block
Drop the exploit outright when no safe reinterpretation exists. Example: a known-malicious payload against a path that has no legitimate use.
Sanitize
Clean the input. Example: a withdraw form takes a -500 amount; the GCE coerces it to a positive integer before the handler sees it.
Validate
Enforce stricter input constraints than the app itself does. Example: a date field that should be ISO-8601 rejects SQL fragments.
Redirect
Reroute the request to a safe path or a canonical endpoint. Example: a vulnerable legacy route is redirected to its v2 equivalent.
Header inject
Add the protective header the app forgot. Example: missing CSRF, Content-Security-Policy, or X-Frame-Options.
Negative numbers, a withdraw form, and one line of GCE
A real finding from a banking application. The kind of flaw scanners systematically miss and WAF signatures can't describe.
// Attacker submits:
POST /api/withdraw
Authorization: Bearer <victim-token>
Content-Type: application/json
{ "account": "...",
"amount": -50000 }
// Server trusts the sign.
// balance += amount → balance increases.
// Attacker just "withdrew" -$50K.
Status: 200 OKScanner response: HTTP 200, valid JSON, nothing to flag. No CVE matches. The signature layer has no concept of "negative withdrawal is a fraud vector."
// GCE-2847 · middleware · 30ms
defend.intercept('POST /api/withdraw', (req) => {
if (req.body.amount < 0) {
req.body.amount = Math.abs(req.body.amount);
}
return req;
});
// Attacker sees:
Status: 200 OK // withdraw of +$50K,
// denied by insufficient-funds.
// Attack dead.Three lines of targeted code. Generated from the exact exploit payload. Shipped to your middleware in 30ms. Zero impact on any other route, user, or legitimate request.
Where Defend actually runs
No network proxy. No CDN dependency. No tuning phase.
SDK at the middleware layer
Language-agnostic at the SDK level
30 ms added latency — benchmarked at 27 ms
Also exports as WAF rules
One-click enable / one-click disable
What Defend is not
Scope discipline. Here's what we don't claim.
Not a WAF signature set
GCEs are generated from the specific exploits Assess ran, not a generic rule library.
Not a replacement for code fixes
GCEs buy time. Architecturally, your team still owns the underlying fix — that's where
Not an always-on blocker
Every GCE is scoped to a specific route and payload shape. It doesn't re-inspect every request against a thousand rules.
Not a CDN or reverse proxy
It runs in your application process, not in front of it. No traffic redirection, no TLS terminator in the middle.
What GCE neutralizes — and what routes to Fix
Honesty about the seam. Defend covers the majority of findings; Fix covers the rest.
- Business-logic flaws (price tampering, negative amounts, coupon stacking)
- Injection (SQLi, XSS, SSRF, command injection, path traversal)
- Broken auth (weak sessions, missing CSRF, MFA gaps, cookie flags)
- API authz (IDOR, BOLA, mass assignment, excessive data exposure)
- Missing security headers (CSP, X-Frame-Options, HSTS)
- Rate-limit evasion on sensitive endpoints
- Architectural rewrites (redesigning a whole auth flow)
- Cryptographic algorithm changes (moving off a weak hash)
- Vulnerable dependency upgrades
- Schema / data-model changes
- Anything the GCE can only mask, not cure
When you reach for Defend
The zero-day window
A critical finding lands. Devs need weeks to ship the architectural fix. GCE closes the exposure in 30 ms.
Vulnerable third-party dependency
Library has a known CVE, upgrade breaks compatibility. GCE neutralizes the specific call path until upgrade lands.
Legacy systems you can't easily touch
Platform you inherited, team that's moved on. Defend protects at the middleware layer without requiring a release.
Auditor-window mitigation
Audit finding, 30-day remediation SLA. Defend is active within hours and evidenced in the Assess replay stream.
Close the 30–90 day exposure window
Defend ships bundled with