VMware unveils HyperArmor to automate virtual patching and MFA for VCF users

VMware announced a new security add-on called HyperArmor aimed at easing the burden of its recent move to monthly software releases for VMware Cloud Foundation (VCF). HyperArmor delivers three core functions: virtual patching that blocks exploitation attempts without changing the underlying software, enforcement of known-good configuration states unless explicitly approved, and multi-factor authentication that adds a time-based one-time password to privileged SSH access.

The virtual-patching feature extends the approach used in VMware’s vDefend product, which previously protected against threats like the MOVEIt authentication bypass (CVE-2024-5806). HyperArmor’s MFA component is designed to stop attackers who have obtained privileged credentials from compromising ESX hypervisors. Although marketed as a VMware product, the underlying technology originates from Broadcom’s security businesses, Symantec and Carbon Black, and aligns with other Broadcom tools such as AgentMinder launched at VMware Explore. The add-on will be sold separately, indicating VMware expects customers to pay extra for these enhanced protections.