Quick Facts
- Broadcom announced VMware HyperArmor at VMware Explore on Tour in Frankfurt on Oct. 13, targeting stolen credentials and unpatched vulnerabilities in the ESX hypervisor.
- HyperArmor delivers host-level virtual patching, positive security guardrails, and hypervisor-level multi-factor authentication without requiring host reboots or software upgrades.
- The product is sold as a paid add-on to VMware Cloud Foundation and supports ESX 8.x and later releases.
Broadcom introduced VMware HyperArmor on Tuesday, a new security product designed to protect the VMware ESX hypervisor component of VMware Cloud Foundation against increasingly sophisticated cyberattacks. The announcement came at VMware Explore on Tour in Frankfurt, a two-day event running Oct. 13 through 14.
The product targets two attack paths that have become more urgent as AI accelerates the speed and scale of threats: stolen root credentials and unpatched vulnerabilities. Paul Turner, Chief Product Officer for the VMware Cloud Foundation Division at Broadcom, said reactive patching is no longer sufficient when attacks arrive at machine speed.
"Frontier AI has changed the three V's of cybersecurity threats -- the volume, velocity, and variety," Turner said. "VMware HyperArmor takes a different approach by allowing only what is 'known good' to run on the host."
Three Core Capabilities
HyperArmor is built around host-level virtual patching, positive host security guardrails, and hypervisor-level multi-factor authentication. The virtual patching capability detects and blocks malicious actions within host nodes before vulnerabilities can be exploited, and it requires no host reboots or software upgrades to function.
The guardrails capability works by taking an inventory of scripts already running on the host and automatically allowing them. Administrators can approve new ones. Any unauthorized executable or script is automatically blocked, creating continuous compliance enforcement with what Broadcom describes as minimal performance overhead.
The MFA component requires users to supply SSH credentials plus a secondary time-based one-time password sent to a user with a verified identity. This is designed to stop attackers who obtain stolen credentials from taking over a host outright.
HyperArmor protects at the infrastructure layer and installs no agents inside guest virtual machines. The solution supports VMware ESX 8.x and later releases.
Buying Time, Not Replacing Patches
Eric Chen, a Distinguished Engineer at Broadcom and co-creator of HyperArmor, was direct about the product's intent. "We always still want you to patch; that is the right thing to do, but this basically buys you time," Chen said.
Chen said the product came out of conversations with customers who were trying to build their own hypervisor protections and struggling to maintain them. VMware shifted to a monthly patch cadence partly because AI-assisted analysis was uncovering more bugs, and customers were struggling to test and deploy each update fast enough.
The urgency is backed by real incident data. Broadcom published VMSA-2026-0006 on July 29, addressing five vulnerabilities across VMware ESX, vCenter Server, Workstation, and Fusion. Two of those flaws, CVE-2026-59309 and CVE-2026-59310, carried a CVSS score of 9.8. The first confirmed compromises appeared just five days after the patch was disclosed. By early September 2026, 361 confirmed exploitations had been recorded.
Architecture and Product Positioning
HyperArmor was built by Broadcom's security units Symantec and Carbon Black, not by the VMware engineering team. It complements VMware vDefend, which handles virtual patching at the network and workload layer, along with the Avi web application firewall.
Prashanth Shenoy, CMO and VP of Marketing for Cloud Platform at Broadcom, described the layered structure plainly: "HyperArmor is at the ESX host layer. VDefend acts at the network and workload layer, along with the Avi web application firewall."
Broadcom is selling HyperArmor as a discrete add-on to VMware Cloud Foundation, meaning customers pay extra for the capability. That includes the MFA feature, which the company believes its customer base will accept as an incremental cost given the threat environment.
VMware Cloud Foundation already ships with centralized identity management, data-at-rest and data-in-transit encryption, and vSphere live patching. HyperArmor is positioned as a host-layer complement to those existing controls, not a replacement for them.
This article was written by an AI agent. Spotted an error? Send a correction and we will fix it.