Broadcom launches HyperArmour to protect VMware ESX

Broadcom has introduced VMware HyperArmour for VMware Cloud Foundation, a tool designed to protect the VMware ESX hypervisor.

The launch adds a new security product to the VMware portfolio following Broadcom's acquisition of VMware. It focuses on attacks targeting the virtualisation layer that underpins private cloud systems.

HyperArmour is designed to address two common paths into a hypervisor environment: stolen root credentials and unpatched vulnerabilities. It supports VMware ESX 8.x and later releases, and works without host downtime, software upgrades, or software agents inside guest virtual machines.

The product combines three host-level controls: virtual patching to block attempted exploits before vulnerabilities are used, positive security rules that allow only approved executables and scripts to run on the host, and multi-factor authentication built directly into the ESX SSH login path.

In practice, a user logging in through SSH must provide standard credentials and then complete a second authentication step using a time-based one-time password linked to a separately defined identity. This is intended to prevent command-line access even if a root password has been compromised.

Security shift

The announcement reflects a broader cyber security debate over whether patching and threat detection can keep pace with increasingly automated attacks. Vendors and analysts have argued that organisations need controls that limit exposure before a vulnerability is fixed, especially in infrastructure software that supports multiple business systems.

Paul Turner, Chief Product Officer, VMware Cloud Foundation Division, Broadcom, said the rise of artificial intelligence was changing the pattern of cyber attacks. "Frontier AI has changed the three V's of cybersecurity threats - the volume, velocity, and variety. When attacks come at machine speed, reactive detection and patching are no longer enough," Turner said.

He added: "VMware HyperArmour takes a different approach by allowing only what is 'known good' to run on the host. With VMware vDefend already delivering virtual patching capabilities for the network layer of VMware Cloud Foundation, VMware HyperArmour now expands that protection around the hypervisor component itself."

The hypervisor sits beneath virtual machines and allocates computing resources across workloads, making it a sensitive layer in data centre and private cloud environments. If compromised, it can expose multiple systems running on the same host.

HyperArmour's host-layer virtual patching is intended to detect and block malicious actions within host nodes before known vulnerabilities can be exploited. Because the approach does not require immediate reboots or upgrades, security teams may have more time to schedule formal software patching while reducing exposure in the interim.

The positive security model is based on the relatively fixed set of processes that run on an ESX host. HyperArmour records scripts already present on the system, allows those by default, and lets administrators approve new ones. The aim is to stop unauthorised code from running on the host while keeping the control set narrow.

Wider stack

Broadcom positioned the software as part of a wider set of security products for VMware Cloud Foundation. HyperArmour works alongside VMware vDefend, which applies controls at the network layer, vSphere live patching for hypervisor updates, and Avi Load Balancer for web application and API traffic protection.

This places HyperArmour within a layered security approach spanning infrastructure, network, and application access. For customers already using VMware Cloud Foundation as the basis for private cloud deployments, the product is intended to add another native control rather than rely on separate in-guest security agents.

Stephen Elliot, Group Vice President, Software Development and IT Operations, IDC, said the speed of exploitation was changing the balance between prevention and response. "Attackers are using automation and AI to exploit infrastructure weaknesses faster than most organizations can patch, which means layered defense must extend all the way to the hypervisor as the foundation of the private cloud," Elliot said.

He added: "Technology leaders should prioritize preventive controls that help shrink exposure windows without disrupting production, and approaches that harden the virtualization layer natively rather than relying on external agents or post-incident detection."