Broadcom has introduced VMware HyperArmor, a security solution designed to protect the hypervisor layer of VMware Cloud Foundation (VCF) against zero-day vulnerabilities, stolen administrator credentials and increasingly sophisticated cyberattacks. The solution aims to reduce security exposure without disrupting workloads or requiring host reboots and software upgrades for virtual patching.
As enterprises expand their use of virtualised infrastructure and private cloud environments, the hypervisor has become a critical security layer. Unpatched vulnerabilities and compromised root credentials can give attackers access to the underlying infrastructure, potentially putting multiple workloads at risk.
VMware HyperArmor addresses these threats through three primary capabilities. Its host-level virtual patching detects and blocks malicious actions within VMware ESX hosts before vulnerabilities can be exploited. This complements the network-layer virtual patching capabilities available through VMware vDefend, allowing organisations to strengthen protection across infrastructure and network layers.
“VMware HyperArmor takes a different approach by allowing only what is ‘known good’ to run on the host.” — Paul Turner, Chief Product Officer, VMware Cloud Foundation Division, Broadcom
The solution also introduces positive host security guardrails that establish a baseline of authorised processes and automatically block unapproved executables and scripts. Existing scripts are inventoried and allowed, while administrators can approve new ones. The approach operates at the infrastructure layer without requiring agents inside guest virtual machines.
A third capability adds multifactor authentication (MFA) directly to the ESX Secure Shell (SSH) login process. Administrators must provide standard SSH credentials followed by a time-based one-time password linked to a separately defined identity. This adds another barrier even if an attacker obtains the root password.
“Technology leaders should prioritize preventive controls that help shrink exposure windows without disrupting production,” said Stephen Elliot, Group Vice President, Software Development and IT Operations at IDC, highlighting the need to harden virtualisation infrastructure against faster, AI-assisted attacks.
HyperArmor complements VMware Cloud Foundation’s existing security capabilities, including identity management, encryption and live patching. VMware vDefend provides micro-segmentation and threat detection, while VMware Avi Load Balancer protects web applications and APIs.
Supporting VMware ESX 8.x and later releases, HyperArmor extends Broadcom’s layered security approach to the hypervisor itself. Its emphasis on preventive controls could help enterprises reduce exposure between vulnerability discovery and the application of official patches while maintaining production continuity.