Broadcom Adds VMware HyperArmor for ESX Hypervisor Protection

Broadcom said the software targets two common routes into virtualized infrastructure: stolen root credentials and unpatched vulnerabilities. HyperArmor combines host-level virtual patching, controls on executable programs and scripts, and multifactor authentication for remote access to VMware ESX hosts.

Citing the growing speed and volume of artificial intelligence-enabled attacks, Broadcom executives said the product responds to attacks that are accelerating faster than enterprises can update infrastructure software. Prashanth Shenoy, chief marketing officer and vice president of marketing for cloud platform, infrastructure and solutions at Broadcom, said, "You don’t have enough time to triage a single alert, and you can’t apply patches at machine speed."

HyperArmor operates directly at the ESX layer, which runs directly on a physical server to support virtual machines. Broadcom said protecting the hypervisor is important because it undergirds all workloads that depend on that host.

The virtual patching capability is designed to detect and block malicious actions without modifying the underlying infrastructure software. Broadcom said it requires neither host reboots nor software upgrades to mitigate vulnerabilities, allowing infrastructure teams to schedule testing and installation of official patches. Eric Chen, a Broadcom distinguished engineer involved in building HyperArmor, said, "We always still want you to patch; that is the right thing to do, but this basically buys you time." He added that customers face a steady flow of patches across their environments and want help reducing the pressure to deploy each update immediately.

HyperArmor also establishes a baseline of permitted activity on ESX hosts, which run a relatively small, fixed collection of processes. It inventories existing scripts and runs them automatically, requiring administrators to approve new scripts. Unauthorized executables and scripts are blocked by default. Chen said that approach differs from security tools protecting general-purpose applications. Because Broadcom knows which processes should run on the hypervisor, it can enforce restrictions directly within the host rather than relying solely on network inspection.

Broadcom said the product continuously monitors host processes and behavior with minimal performance overhead. It doesn’t require security agents inside individual guest virtual machines. The third component integrates multifactor authentication into the ESX Secure Shell login process. Users must provide standard SSH credentials and then complete a time-based one-time password challenge tied to a separate identity. Broadcom said that prevents someone who obtains a root password from reaching the command line without the second factor.

HyperArmor complements VMware vDefend, which provides security at the network and workload level, including microsegmentation, traffic inspection and network-level virtual patching. VMware Avi Load Balancer protects web applications and application programming interfaces. "HyperArmor is at the ESX host layer," Shenoy said. "VDefend acts at the network and workload layer, along with the Avi web application firewall."

Cloud Foundation already includes centralized identity management, encryption and live patching that applies critical hypervisor updates without taking workloads offline or putting hosts into maintenance mode. HyperArmor adds controls intended to protect the host while administrators prepare software patches. Chen said the product emerged from conversations with customers attempting to build their own hypervisor protections and struggling to sustain the effort.

HyperArmor supports ESX 8.x and later releases, extending protection to customers preparing upgrades to newer VMware platforms. Customers can purchase it directly from Broadcom or through its partners and resellers, using the same sales channels available for VMware Cloud Foundation. Pricing was not disclosed.