Cybersecurity glossary
What is Mitigation?
Learn what security mitigation is, how it differs from remediation, common temporary controls like WAF rules and isolation, and how to manage mitigations without forgetting the real fix.
Definition
Mitigation is an action that reduces the likelihood or impact of a security weakness without necessarily eliminating the root cause—such as virtual patching, network isolation, feature disablement, or stricter monitoring—often used until permanent remediation is possible.
Why mitigations buy time—not absolution
Sometimes the patch breaks production. Sometimes the vendor has only a workaround. Mitigation is how responsible teams shrink the blast radius today while engineering works the permanent fix.
The failure mode is cultural: temporary controls that become invisible permanent debt.
Choosing a mitigation under pressure
Clarify the abuse conditions
Know the vector, required access, and what successful exploitation looks like.
Pick the fastest effective barrier
Disable feature, block path, isolate host, enforce MFA, or virtual-patch.
Measure residual risk
Document what the mitigation does not cover and who remains exposed.
Monitor for bypass attempts
Add detections for exploit patterns the barrier is supposed to stop.
Drive toward remediation
Track expiry and replace the mitigation with a verified permanent fix.
Common mitigation patterns
Exposure reduction
Pull services off the internet, restrict source IPs, close ports.
Virtual patching
WAF/IPS rules that interrupt known exploit payloads.
Feature disablement
Turn off vulnerable modules, preview flags, or legacy protocols.
Intensified detection
Hunt and alert on exploitation attempts while the bug remains.
Mitigation vs remediation vs acceptance
| Approach | Means | End state |
|---|---|---|
| Mitigation | Barrier or workaround | Risk reduced; root issue may remain |
| Remediation | Patch, code, or config correction | Root issue removed |
| Risk acceptance | Documented decision | Risk retained with owner approval |
- Label every mitigation with owner, start date, and mandatory expiry.
- Pair virtual patches with a calendar item for the real upgrade.
- Test bypasses—assume attackers will try encodings and alternate paths.
- Do not close vulnerability tickets as “fixed” when only mitigated.
- Communicate residual risk to asset owners clearly.
- Automate alerts when mitigated CVEs enter KEV or EPSS spikes.
- Prefer mitigations that fail closed when rules break.
- Review long-lived mitigations in change advisory boards monthly.
The practical takeaway
Mitigation reduces risk quickly when you cannot remediate yet. Use it deliberately, monitor it, and retire it when the real fix lands.
A workaround without an end date is just unmanaged vulnerability with better branding.
Related security terms
Remediation
Permanent correction that mitigations are meant to bridge toward.
Compensating Control
Alternate safeguards closely related to mitigation strategies.
Defense in Depth
Layered model where mitigations add intermediate barriers.
Web Application Firewall (WAF)
Common platform for temporary virtual patches.
Exploitability
Mitigations often aim to lower practical exploitability quickly.
Frequently asked questions
What is mitigation in simple terms?
It means reducing the danger of a security problem now—even if you have not fully fixed the underlying bug yet.
Is mitigation the same as remediation?
No. Remediation removes the root issue. Mitigation lowers risk while the issue may remain.
What is virtual patching?
A mitigation that blocks exploit traffic (for example via WAF/IPS) without changing the vulnerable application code yet.
When should teams mitigate instead of remediate?
When a reliable patch is unavailable, change windows are constrained, or emergency exploitation requires immediate risk reduction—then schedule the real fix.
Can mitigations fail?
Yes. Attackers bypass signatures, and mis-scoped network rules leave paths open. Treat mitigations as incomplete.
How long should a mitigation last?
Only as long as necessary. Every mitigation needs an owner, expiry, and remediation plan.
Do regulators accept mitigation?
Often as interim risk treatment, especially with compensating controls documented—not as endless substitutes for available patches.
References
Explore authoritative guidance and frameworks related to mitigation.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.