Dive Brief:
- Broadcom bolstered VMware cyberdefense capabilities this week with VMware HyperArmor, a software package that bundles multi-factor authentication with virtual patching and positive host scripting guardrails for the ESX hypervisor. HyperArmor was built to deter AI-accelerated cyberattacks that exploit vulnerabilities faster than organizations can deploy traditional security patches, the company said in a Tuesday announcement.
- HyperArmor adds multiple layers of protection to VMware Cloud Foundation deployments. Virtual patching blocks malicious activity without requiring host reboots or software upgrades. Positive-host controls nip unauthorized hypervisor intrusions in the bud, and the MFA feature operates at the hypervisor layer to deter intruders.
- Authorized Broadcom partners can sell the HyperArmor add-on on a per-core basis, Prashanth Shenoy, VP of product marketing for Broadcom's VCF Division, told Channel Dive. The bundle is expected to be generally available in the first quarter of Broadcom’s 2027 fiscal year. Pricing has not been disclosed.
Dive Insight:
HyperArmor addresses two common security issues — attackers exploiting vulnerabilities before they can be patched and intruders gaining hypervisor access through stolen credentials. Shenoy said the product responds to the "volume, velocity and variety of attacks" confronting VMware environments as AI speeds up attacks.
Hypervisors are an attractive target. Compromising a single host can expose numerous virtual machines and their associated workloads. AI-assisted attackers have narrowed the window for testing and deploying patches.
Attacks were accelerating prior to the emergence of AI threats. Mandiant research found that average observed time to exploit fell from 32 days in 2021 and 2022 to five days in 2023. LLMs have helped attackers further compress the progression from vulnerability discovery to exploitation.
VCF already includes infrastructure hardening and live-patching capabilities that let administrators deploy hypervisor updates without taking workloads offline. But those interventions don’t guard against vulnerabilities for which patches don't yet exist. HyperArmor enforces a continuous baseline of approved software and activity at the host level, rather than adding controls in response to newly disclosed vulnerabilities. The strategy gives IT teams time to validate and deploy official patches, Broadcom said.
HyperArmor complements other VCF security offerings, including vDefend for network-level threat prevention and VMware Live Recovery for cyber recovery.
"An ESX host runs a small, fixed set of processes," Shenoy said. "HyperArmor keeps that known list and blocks anything else trying to execute or write to disk."
Broadcom said the approach can mitigate attacks targeting previously unknown vulnerabilities without disrupting workloads. Separately, HyperArmor's SSH authentication controls ensure a stolen password alone can't grant attackers command-line access.
When asked how Broadcom validates those defenses against previously unseen attacks, Shenoy explained the enforcement model without providing specific testing results or identifying technical limitations. He acknowledged that HyperArmor does not replace traditional patching.
HyperArmor arrives as VMware customers express interest in additional security capabilities. A recent survey by Unisphere Research, sponsored by third-party VMware support provider Rimini Street, found that 77% of IT virtualization security leaders said they would see value in proactive vulnerability protection and real-time threat visibility beyond Broadcom's patching program.
HyperArmor opens the door for partners to provide security assessments, deployment guidance and architecture services.
"HyperArmor helps Broadcom partners position themselves as strategic security advisors, shifting customers away from disruptive emergency patching and creating long-term, high-margin service relationships," Shenoy said. "This is a huge opportunity for them to augment licensing revenue with high-margin services such as security assessments and deployment and architecture services."
HyperArmor also aligns with Broadcom's moves to reward partners for implementation expertise and customer outcomes, rather than licensing transactions.
HyperArmor's separate, per-core pricing structure, however, introduces another consideration for VMware customers already weighing licensing costs. A CloudBolt Software survey released in February found that 85% of respondents were shaping their VMware strategies around expectations of future price increases.
Broadcom maintains that offering HyperArmor as a standalone option lets customers determine whether their exposure warrants the additional protection.
"Not every environment needs that layer," Shenoy said. "Customers with higher-risk workloads add it, and customers with lower exposure don't have to."
