Virtual patching is a Pro extra. The Hub sends signed rules to the plugin so common plugin holes can be blocked or logged before you update. Rules are ours.

The current built-in seed is version 6. Pro and Shield Care see a Rules updated card with the pack version and when Hub last published. Validated rules are delivered as soon as they are published; the plugin applies a signed pack on the next virtual-patch sync. We do not promise a number of hours. Linked Basic sites do not receive Pro rule packs. The firewall on Basic is a request-level WordPress firewall. It is not a DNS or edge WAF.

How that differs from updating plugins or see what Pro adds.