TL;DR — Key Takeaways
- Real-time hypervisor protection: Broadcom’s HyperArmor adds execution-level security controls to VMware ESX, blocking unauthorized scripts and malicious activity before attackers can exploit vulnerable host environments.
- Stronger authentication and virtual patching: New SSH multi-factor authentication and script allowlisting complement existing VMware security capabilities, helping reduce unauthorized access and exposure while organizations prepare permanent patches.
- AI accelerates the vulnerability race: As attackers use AI to develop and combine exploits more rapidly, IT and cybersecurity teams increasingly need immediate, automated security controls rather than relying exclusively on traditional patching schedules.
Broadcom next month will add a HyperArmor that both intercepts malicious actions during process execution in real time and prevents any unauthorized executable or script within a host environment running the VMware ESX hypervisor.
Additionally. Broadcom has added a multi-factor authentication (MFA) capability directly into the ESX SSH login path using first a set of SSH credentials, followed by a secondary time-based one-time password challenge tied to a separately defined identity. Even if a cybercriminal obtains the root password through phishing or credential leaks, they cannot reach the command line without that second factor.
Prashanth Shenoy, vice president of product marketing for the VMware Cloud Foundation division of Broadcom, said these HyperArmor capabilities in effect add virtual patching controls that can be applied to better secure the VMware ESX hypervisor that is at the core of the VMware Cloud Foundation (VCF) platform.
HyperArmor creates an auditable inventory of scripts already on the host. Any new ones approved by administrators are then added to that inventory. Only those “known good” scripts are then allowed to run. At the same time, it prevents vulnerabilities discovered in the VMware ESX hypervisor from being exploited, which buys time for IT teams to deploy and deploy an actual patch once it becomes available.
Available on VMware ESX 8.x and later releases, this host-level capability complements an existing set of network-level virtual patching capabilities provided by VMware vDefend, a security offering that is designed to prevent malware from laterally moving across a virtual network. Broadcom also makes available live patching for VMware vSphere to apply critical updates to the hypervisor without taking workloads down or placing hosts into full maintenance mode.
Broadcom is adding these capabilities at a time when it’s become possible for cybercriminals to use artificial intelligence (AI) tools and models to create an exploit for a known vulnerability in a few hours. Once created, they can then launch a much more targeted attack at machine speed. As a result, IT and cybersecurity teams now need to be able to apply controls in real time to thwart those attacks.
For the moment, at least, cybercriminals appear to be largely using AI to augment their existing tactics and techniques for launching cyberattacks. However, it’s also been shown that AI also makes it easier to chain together multiple low-level vulnerabilities to create a more lethal exploit. IT and cybersecurity teams, as a result, can no longer rely on severity rankings to prioritize their remediation efforts. Instead, they will need to find ways to instantly apply controls to remediate a much wider range of vulnerabilities. Hopefully, those controls will buy IT and cybersecurity teams the time needed to deploy an actual patch. The challenge is that a patch might not be available for several days, sometimes even weeks. That gap creates a window of opportunity that cybercriminals are now potentially able to exploit in a matter of hours. The challenge and the opportunity then become determining how best to respond to those attacks at what is about to become an unprecedented level of scale.