VMware HyperArmor blocks exploit traffic with virtual patching to counter AI-driven vulnerability discovery surge

VMware is launching a new security add-on called HyperArmor to assist customers in managing the rapid pace of software updates. The company states that AI tools have accelerated the discovery of flaws, creating a need for better management capabilities.

What happened

VMware has introduced HyperArmor as a discrete add-on product for its VMware Cloud Foundation (VCF) platform. According to The Register, the move comes after VMware shifted to a monthly software update schedule to address bugs identified by artificial intelligence. Prashanth Shenoy, vice president of product marketing for VCF within Broadcom, explained that users previously struggled to keep up with the volume of patches. Testing the impact of these updates takes time, even though VCF supports non-disruptive live patching. Shenoy stated that customers needed "room to breathe" to handle the operational load.

HyperArmor addresses this pressure by performing three primary functions. First, it offers virtual patching, which blocks exploitation attempts against known vulnerabilities without altering the underlying software code. VMware already utilizes this technology in its vDefend network security product. The company cites CVE-2024-5806, a flaw in the MOVEIt file transfer tool, as an example of how vDefend detects and blocks traffic associated with authentication bypass attempts. HyperArmor will apply similar traffic inspection to protect VCF implementations.

The second function involves change management within the VCF environment. The tool is designed to reject any actions that alter a known good state of the system. If a human administrator approves a specific change, HyperArmor updates its policies to permit that new state. This mechanism aims to prevent unauthorized or accidental modifications that could compromise system integrity.

The third function is the enforcement of multi-factor authentication (MFA). Shenoy acknowledged to The Register that MFA is now a basic requirement for security. However, he explained that HyperArmor specifically targets threats involving stolen privileged credentials. Attackers often use these credentials to gain access to VMware’s ESX hypervisor. To mitigate this risk, HyperArmor requires users to provide SSH credentials along with a secondary time-based one-time password. This second factor is sent to a user with a verified identity, adding a layer of protection against credential reuse.

Why it matters

The introduction of HyperArmor highlights the growing operational burden placed on security teams by AI-driven vulnerability research. As automated tools discover flaws faster than manual processes, organizations face a constant stream of patches that must be tested and deployed. Traditional patching cycles may not keep pace with this volume, leaving systems exposed for longer periods.

By offering virtual patching, VMware provides a method to reduce exposure without the immediate need for software updates. This allows teams to prioritize patches based on risk and operational impact rather than urgency alone. The inclusion of strict MFA for hypervisor access addresses a critical attack vector where stolen credentials can lead to total host compromise.

The product is sold as an add-on to VMware Cloud Foundation, indicating that these enhanced security controls are positioned as premium features. This approach suggests that managing the complexity of modern virtualization environments now requires additional tooling beyond standard platform capabilities. Organizations using VCF will need to evaluate whether the benefits of automated blocking and stricter access controls justify the additional cost.

Our take on the response

• VMware acknowledges that AI has increased the frequency of discovered vulnerabilities, necessitating new management tools.
• Virtual patching allows for immediate protection against known exploits without disrupting live systems.
• Enforcing MFA for hypervisor access specifically targets the risk of stolen privileged credentials.
• The tool integrates change management to prevent unauthorized alterations to system states.

Background: Multi-factor authentication

Deploy multi-factor authentication across all user accounts using phishing-resistant methods like FIDO2. Enforce strict policies for privileged accounts. Monitor for authentication anomalies. Combine MFA with conditional access rules to balance security and usability without creating excessive friction for legitimate users.

Read the full guide: Multi-Factor Authentication Best Practices for Secure Access

What to do and how to stay safe: VMware

• Audit your current patch management process to identify bottlenecks in testing and deployment for virtualization platforms.
• Verify that multi-factor authentication is enabled for all privileged accounts accessing hypervisors and management consoles.
• Review network traffic patterns to identify potential exploitation attempts against known vulnerabilities before patches are applied.
• Assess whether virtual patching solutions can provide temporary protection for critical systems during patch testing windows.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is VMware HyperArmor?

HyperArmor is a new add-on product for VMware Cloud Foundation that provides virtual patching, change management, and multi-factor authentication.

Why did VMware create this tool?

VMware created HyperArmor to help users manage the high volume of patches resulting from AI-driven vulnerability discovery.

How does HyperArmor protect against stolen credentials?

It requires SSH credentials and a secondary time-based one-time password for users with verified identities to access the ESX hypervisor.