VMware launches HyperArmor to manage AI-discovered flaws and enforce MFA

Broadcom’s VMware introduces a new security add-on to help customers cope with the surge of monthly patches driven by AI vulnerability discovery.

Threat Times Exposure DeskOctober 13, 20262 min read

Share LinkedIn Reddit

Illustration: A generic firewall appliance sits on a desk with a sleek dashboard on its blank screen. — AI-generated illustration: Threat Times

Key points

VMware is shifting to monthly software updates to address bugs identified by artificial intelligence tools.
The new HyperArmor product provides virtual patching, state validation, and mandatory multi-factor authentication.
Customers previously struggled to test and deploy patches quickly enough, even with live patching capabilities.

VMware has introduced a new security product called HyperArmor to help enterprise customers manage the rapid pace of software updates driven by artificial intelligence vulnerability discovery. According to Prashanth Shenoy, vice president of product marketing in the VMware Cloud Foundation division of Broadcom, the company recently moved to a monthly release schedule partly to address bugs found by AI systems.

Shenoy told The Register that users previously struggled to keep up with the volume of changes before the move to monthly releases. Testing the impact of patches takes significant time, even though VMware Cloud Foundation allows for non-disruptive live patching. Shenoy stated that customers need "room to breathe" to safely integrate these updates into their environments without causing operational disruptions.

Context and Background

HyperArmor is designed as a discrete add-on product to VMware Cloud Foundation. It performs three primary functions to enhance security posture. The first feature is virtual patching, which blocks attempts to exploit vulnerabilities without requiring changes to the underlying vulnerable software itself. This approach allows organizations to mitigate risks immediately while they prepare for official software updates.

VMware already offers virtual patching capabilities through its vDefend network security product. The company explains this mechanism by referencing CVE-2024-5806, a bug in the MOVEIt file transfer tool that gained attention in 2024. VMware says vDefend can detect traffic patterns associated with exploitation attempts of that authentication bypass flaw and block the malicious traffic accordingly. HyperArmor will apply similar detection and blocking logic to traffic heading toward VCF implementations.

The second function of HyperArmor involves rejecting any actions that alter known good states within VMware Cloud Foundation. If a human administrator approves a specific change, the tool will update its policies to allow the altered state. This ensures that only authorized modifications are permitted, maintaining the integrity of the infrastructure configuration against unauthorized or accidental deviations.

Who is Affected

The third capability of HyperArmor is the enforcement of multi-factor authentication. When The Register questioned Shenoy about whether MFA is now standard for security, he agreed but clarified that VMware designed HyperArmor specifically to protect against attackers using stolen privileged credentials to access the ESX hypervisor. The goal is to stop attackers from using those credentials to take over a host system.

To achieve this, HyperArmor requires users to input SSH credentials along with a secondary time-based one-time password. This second factor is sent to a user with a verified identity, adding an extra layer of authentication beyond simple passwords. By requiring this dual verification, VMware aims to mitigate the risk of credential theft leading to full host compromise.

What should you do?

Organizations using VMware Cloud Foundation should evaluate their current patch management processes to see if they can keep pace with monthly updates. Administrators should review their authentication policies to ensure privileged access to hypervisors is protected by multi-factor authentication. IT teams should also consider how virtual patching tools can provide immediate protection while they test and deploy official software updates in their environments.

What to do and how to stay safe: VMware

Review your current patch management workflow to ensure it can handle monthly software updates without causing service disruptions.
Implement multi-factor authentication for all privileged access to hypervisors and management interfaces to protect against stolen credentials.
Evaluate virtual patching solutions that can block exploitation attempts at the network level while you test and deploy official software fixes.
Monitor vendor announcements for new security tools or add-ons that may help manage the increased frequency of security updates.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why is VMware moving to monthly software updates?

VMware shifted to monthly updates partly to address the high volume of bugs discovered by artificial intelligence tools, although this has created challenges for customers testing patches.

What does the HyperArmor product do?

HyperArmor provides virtual patching to block exploits, rejects unauthorized changes to known good states, and enforces multi-factor authentication for privileged access to the ESX hypervisor.