Broadcom introduced a security product for VMware on Oct. 13 that installs protection at the layer where virtual machines run, without restarting the machines, upgrading the software or dropping an agent inside each guest system. The company calls it VMware HyperArmor, and it is aimed at a problem that has grown harder to manage: the number of flaws attackers find and use before information technology teams can test and apply the fix.
Virtual patching is not new, but placing it in the ESX hypervisor, the software that sits directly on a server and divides it into virtual machines, is new for Broadcom’s VMware business. Instead of leaving a known vulnerability open between disclosure and a maintenance window, HyperArmor adds processes that detect and block attempts to exploit it. The company said the product supports ESX 8.x and later releases inside VMware Cloud Foundation, its bundled private-cloud platform, and is expected to ship in the first quarter of Broadcom’s fiscal 2027, which begins in November. Pricing has not been disclosed.
The announcement reflects a shift in how infrastructure vendors are selling security. Cisco introduced a comparable tool, Live Protect, earlier this year. The common driver is the pace at which vulnerabilities are being discovered by artificial intelligence systems and then exploited by attackers who automate the search. A maintenance window scheduled weeks in advance is a poor answer when exploitation begins within days.
“It’s a more active layer of defense at the hypervisor level, enabling a more proactive posture and adding quite a bit more detail when infrastructure teams are working with the security team,” said Stephen Elliot, an analyst at IDC. Dave Gruber of Omdia, a division of Informa TechTarget, said every infrastructure provider is facing the same pressure: they have to deliver compensating controls quickly while also helping customers decide when to deploy them and when to remove them once real patches arrive.
HyperArmor bundles three capabilities. The first is host-level virtual patching. The second, called Positive Host Security Guardrails, is agentless monitoring that locks an ESX host to a known-good baseline of approved scripts and blocks anything outside it, so that an attacker who reaches the host cannot run code there. The third is multifactor authentication for SSH logins to ESX hosts, aimed at the other common route into a hypervisor: stolen root credentials.
Not every feature drew agreement. Stephanie Walter, an analyst at HyperFrame Research, questioned whether multifactor authentication, a baseline control in most security budgets, belongs among the features Broadcom charges extra for. Broadcom has not said what the add-on will cost.
The commercial logic is straightforward. Broadcom’s infrastructure software segment, which mostly reflects the VMware business it bought for $69 billion in a deal that closed in late 2023, generated $8.752 billion of revenue in its fiscal third quarter, up 29% from a year earlier and about 30% of the company’s $29.591 billion in total revenue, according to the company’s results. That growth has come largely from moving customers onto subscription bundles, most importantly VMware Cloud Foundation, a change that raised costs sharply for many large accounts and made Broadcom’s renewal terms a recurring grievance among enterprise buyers.
Security is one of the arguments Broadcom uses to justify the bundle. The company has tied recent releases to vulnerabilities in the virtualization layer, is promoting version 9.1 of Cloud Foundation on security features, and is targeting adoption of that version by half its customer base by late 2027, according to the company. A hypervisor is valuable territory for attackers because it holds many tenants’ workloads at once, and ransomware groups have built tools aimed at ESX hosts in past campaigns. Broadcom already sells security products around the bundle, including the Carbon Black endpoint suite and network and application controls, leaving the base layer as the last place to add protection.
The customers who buy HyperArmor are betting on a trade-off. Virtual patches are compensating controls, not repairs. They block known techniques and can miss variations. They accumulate work for operations teams, which must track which controls are standing in for which missing patch and remove them after the permanent fix is deployed. Vendors that install them without reboots solve a scheduling problem, not the underlying code defect.
Gruber’s point is that customers will need help on both ends of that process, and Broadcom has not described how it will provide it. Nothing in Tuesday’s release said how HyperArmor interacts with third-party patching and monitoring tools that many enterprises already run, or how long a virtual patch will be maintained after a vendor fix becomes available.
Those are the questions that will decide whether the product sells. Enterprises on Cloud Foundation have already absorbed one round of repricing and may resist a separate line item for features that competing platforms include. Broadcom, for its part, is counting on the volume of AI-discovered flaws to make the case for them. The first quarter of fiscal 2027 is when both sides find out who is right.
