A system for virtual patching of security vulnerabilities in an industrial production environment includes an industrial automation device (e.g., a PLC). The industrial automation device comprises an instance of a distributed database spanning a plurality of industrial automation devices and storing one or more virtual patches and an app container comprising a virtual patching engine security application. The app container is configured to collect system information generated by the industrial automation device during operation, and apply the one or more virtual patches to the system information to identify one or more security attacks.