VMware creates HyperArmor to help customers manage flood of AI-found patches

Virtual patching and state enforcement

VMware has discovered so many flaws in its products using artificial intelligence that it has created a new product to help users manage the flow of fixes, according to Prashanth Shenoy, vice president of product marketing in the VMware Cloud Foundation division of Broadcom. He told The Register that VMware recently moved to deliver monthly software updates, in part to address bugs found by AI.

Shenoy admitted users struggled to keep pace with releases before the switch to monthly updates, because testing the impact of patches takes time, even though VCF supports non-disruptive live patching. Customers therefore need "room to breathe," he said.

The resulting tool, called HyperArmor, offers three functions. The first is virtual patching, which blocks attempts to exploit a vulnerability without changing the vulnerable software itself. VMware already offers virtual patching in its vDefend network security product and describes how it detects patterns associated with exploit attempts and blocks the traffic, citing CVE-2024-5806, the authentication bypass flaw in the file transfer tool MOVEit that made waves in 2024. HyperArmor will apply similar blocking to malicious traffic heading toward VCF implementations.

A second job is rejecting any actions that alter known good states in VCF. If a human approves a change, the tool updates policies to allow the altered state.

MFA for hypervisor access

The third function is multi-factor authentication. Shenoy agreed with The Register that MFA is now table stakes for security, but explained that HyperArmor is designed to protect against attackers using stolen privileged credentials to access VMware's ESX hypervisor. To stop those attackers taking over a host, HyperArmor requires users to input SSH credentials plus a secondary time-based one-time password sent to a user with a verified identity.

HyperArmor is a discrete product that VMware will sell as an add-on to VCF, which suggests VMware believes customers are willing to pay extra for MFA.

Built inside Broadcom

VMware did not create HyperArmor itself. Broadcom security businesses Symantec and Carbon Black developed it, and Broadcom's CA business, formerly Computer Associates, has done similar work before.

The pattern matches Broadcom's broader approach. At VMware Explore on August 31, Broadcom launched AgentMinder, a tool aimed at stopping AI running inside VCF from going rogue. AgentMinder came from CA but was launched as a tool for VCF and third-party Kubernetes stacks.

Ram Velaga, president of Broadcom's Infrastructure Software Group, told The Register the group combines focused individual teams with a central approach, saying individual teams deliver innovation speed. The group operates with at least six teams, and when one wants to add functions it looks for existing assets developed by another internal team rather than writing its own code, meaning work from several Broadcom teams can be relevant to broad products like VCF.

Sources: Theregister