Broadcom shipped VMware HyperArmor on 13 October, and the reason it exists is more interesting than the feature list. Broadcom says its own AI tooling is finding hypervisor flaws faster than customers can absorb the fixes.
What it does
- Blocks the behaviour of a known exploit at the ESX host layer, before an official patch is installed.
- Baselines which scripts and executables a host may run, and blocks anything new until an administrator approves it.
- Adds a time-based one-time password to SSH logins on the host, so a stolen root password is not enough.
- Sells as a separate add-on to VMware Cloud Foundation, second factor included.
- Broadcom positions it as the host-layer twin of vDefend, which already does this for network traffic. Support starts at ESX 8.x.
Virtual patching stops a technique someone has already written down. It does not remove the flaw, and Broadcom’s own engineers describe it as buying time to test rather than permission to skip the update.
Read the full analysis. Broadcom Built HyperArmor Because Patching the Hypervisor Is Too Slow
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data center economics. No vendor spin.