VMware has uncovered so many security flaws in its products using artificial intelligence that it built a new tool to help customers manage the resulting deluge of patches, according to a report published October 13 by The Register. The virtualization giant recently shifted to monthly software updates, in part to address bugs detected by AI, but customers have struggled to keep pace with the flood of fixes. The new product, called HyperArmor, will be sold as a paid add-on to VMware Cloud Foundation (VCF), meaning the company expects users to pay extra for multi-factor authentication and other security features.
HyperArmor performs three core functions, the report explains. The first is "virtual patching," which blocks attempts to exploit a vulnerability without modifying the vulnerable software itself—similar to how VMware's existing vDefend network security product detects patterns associated with exploitation attempts and blocks the traffic. The second function rejects any actions that change known good states in VCF, though the tool will update policies to permit the altered state if a human approves the change. The third function adds multi-factor authentication to protect against attackers using stolen privileged credentials to access VMware's ESX hypervisor, requiring users to input SSH credentials plus a secondary time-based one-time password sent to a user with verified identity.
Prashanth Shenoy, vice president of product marketing in VMware's Cloud Foundation division at Broadcom, acknowledged that users struggled to keep up with the pace of change even before the move to monthly releases because testing the impact of patches takes time. He said customers need "room to breathe," despite VCF allowing non-disruptive live patching. When The Register asked whether MFA is now table stakes for security, Shenoy agreed but noted that VMware designed HyperArmor specifically to stop attackers using stolen credentials to take over a host.
The tool wasn't actually created by VMware—Broadcom's security divisions Symantec and Carbon Black developed it, according to the report. This follows a pattern: at VMware Explore on August 31, Broadcom launched AgentMinder, designed to prevent AI running inside VCF from going rogue, which came from Broadcom's CA business (formerly Computer Associates). Ram Velaga, president of Broadcom's Infrastructure Software Group, told The Register that the group operates with at least six teams, and when one team wants to add functions it looks for existing assets developed by another internal team rather than writing its own code. For broad products like VCF, the work of several Broadcom teams could be relevant, meaning customers may increasingly see repurposed security products sold as VMware add-ons.
The move to charge separately for MFA signals VMware's confidence that customers will accept paying extra for what many consider baseline security hygiene, especially given the mounting pressure from AI-detected vulnerabilities. Broadcom's strategy of repurposing existing security assets from Symantec, Carbon Black, and CA across its portfolio allows rapid feature expansion without building from scratch, but it also means customers face a growing list of paid add-ons for functions once expected in core platforms. The willingness to monetize multi-factor authentication as a discrete product may test how far enterprise buyers will stretch their budgets when patch volume itself becomes the justification for new spending.