Broadcom armors VMware ESX hypervisor with virtual patching
Amid a barrage of security flaws uncovered by AI, Broadcom joins other infrastructure vendors, such as Cisco, in supporting faster fixes for vulnerabilities.
By
Beth Pariseau, Lead Editor, IT Infrastructure News
Published: 13 Oct 2026
Broadcom hardened the core of its VMware Cloud Foundation (VCF) platform this week as AI-driven vulnerabilities proliferate faster than IT infrastructure teams can apply permanent patches.
VMware HyperArmor, introduced this week, is an add-on for the ESX hypervisor and VCF that's expected to ship in the first quarter of Broadcom's fiscal 2027, which starts in November. It adds support for virtual patching to help keep up with the AI vulnpocalypse.
Rather than allowing vulnerabilities to go unaddressed in a VM environment after their discovery and before permanent patches become available, virtual patching tools add processes that detect and block attempts to exploit them. This offers some protection against agentic cyberattacks, which have proven adept at rooting out and quickly exploiting sometimes obscure software vulnerabilities, until IT teams can introduce and test more permanent patches. Virtual patches also don't require VM host reboots or upgrades.
As with Cisco's Live Protect, introduced earlier this year, the move reflects growing concerns among enterprises about the volume and velocity of attacks driven by frontier models such as Anthropic's Mythos.
Dave Gruber
In the past, IT teams would wait until a patch and a maintenance window became available to fix vulnerabilities. Those traditional approaches are no longer sufficient, said Dave Gruber, an analyst at Omdia, a division of Informa TechTarget.
"In general, every infrastructure provider is caught in the middle of the same problem," Gruber said. "Every infrastructure vendor needs to deliver here, while further investing in helping their customer manage the process of how and when to deploy these compensating controls, and when to remove them, once proper patching has been deployed."
HyperArmor add-on vs third-party tools
In addition to virtual patching, HyperArmor also includes agentless monitoring and allow-list enforcement for scripts that run on VM hosts. This feature, called Positive Host Security Guardrails, locks the ESX host to a known-good baseline and automatically blocks any other processes from running. Thus, even if an attacker gains access to the host, they can't execute malicious scripts.
It's a more active layer of defense at the hypervisor level, enabling a more proactive posture and adding quite a bit more detail when [infrastructure teams are] working with the security team.
Stephen Elliot,Analyst, IDC
Finally, HyperArmor includes multifactor authentication (MFA) for SSH logins to ESX hosts, so that attackers can't use stolen credentials to access the system using a command-line interface.
Broadcom and VCF offer other products, such as Carbon Black for security monitoring, along with vDefend and Avi for network and application security, but HyperArmor fleshes out similar protections for the base layer of VM infrastructure, in keeping with the security theme Broadcom has touted in version 9.1 of VCF.
"It's a more active layer of defense at the hypervisor level, enabling a more proactive posture and adding quite a bit more detail when [infrastructure teams are] working with the security team," said Stephen Elliot, an analyst at IDC. "It complements what most teams already have for a multi-layered security approach."
Although Broadcom will charge an undisclosed add-on price for HyperArmor, it might still be more economical for enterprises than using third-party tools to get similar features, Elliot said.
While there's a case to be made for charging for advanced host monitoring capabilities, Stephanie Walter, an analyst at HyperFrame Research, questioned whether MFA should be among those premium features.
"Where does foundational security end and premium protection begin?" Walter said. "MFA for privileged host access is something customers may reasonably expect in the core platform."
MFA is just one of the features users get with HyperArmor, according to Prashanth Shenoy, vice president of product marketing at Broadcom's VCF Division.
"HyperArmor adds a layer the base platform doesn't have: enforcement at the ESX host that blocks any execution not on an approved list, regardless of which vulnerability is behind it, plus MFA on SSH access to the host," Shenoy wrote in an email. "Not every environment needs that layer. Customers with higher-risk workloads add it, and customers with lower exposure don't have to. That's why it's offered as an optional add-on."
Beth Pariseau, senior news writer for Informa TechTarget, is an award-winning veteran of IT journalism. Have a tip? Email her or connect on LinkedIn.
Dave Gruber
