New enhancements include a prescriptive workflow to accelerate Advanced Threat Prevention (ATP) deployment, an on-premises Malware Prevention System, comprehensive air-gapped support, an AI Assistant for firewall operations, major performance gains for the Distributed Firewall and Intrusion Detection and Prevention Service (IDPS), and automated migration tooling.

Earlier in May, VMware vDefend delivered Self-Service Lateral Security for VMware Cloud Foundation (VCF) 9.1, featuring support for unified lateral threat prevention for VMs and VKS workloads, high-performance threat prevention with IDPS Turbo Mode, and enhanced distributed firewall capabilities. 

As Frontier AI continues to reshape the threat landscape, enterprises face new challenges in securing, operating, and scaling their private clouds. Attackers are using Frontier AI to exploit software vulnerabilities at machine speed, and the rapid adoption of agentic AI is drastically expanding the attack surface. At the same time, fragmented tools and manual processes are slowing down security teams, while rising hardware costs make it difficult for organizations to scale efficiently. 

VMware vDefend addresses these challenges with new innovations focused on three pillars: enhanced security, simplified operations, and optimized performance and resources.

The detailed innovations under these three pillars are as follows: 

1. Enhanced Security

• Accelerated Advanced Threat Prevention with vDefend 1-2-3: Introduces a streamlined, three-step deployment workflow that accelerates time-to-value for ATP, enabling overextended IT teams to rapidly deploy defenses in just a few weeks instead of many months. 
• On-Premises Malware Prevention System: Brings malware sandboxing on-prem, analyzing static and dynamic artifacts entirely within the local network. All vDefend capabilities are now fully supported on-prem.
• Comprehensive Air-Gapped Support: All vDefend capabilities are now fully supported in air-gapped environments. This deployment model enables secure, offline threat intelligence updates, allowing highly sensitive environments to stay up to date on the latest threat signatures without connecting to the cloud. 

2. Simplified Operations

• AI Assistant: vDefend now includes AI Assistant to streamline lateral security operations. It embeds AI-powered automation directly into the platform to simplify firewall operations and troubleshooting.
• Automated Migration to vDefend Distributed Firewall: This vACT enhancement simplifies and automates the migration of legacy, agent-based firewall solutions to DFW, significantly reducing migration costs and accelerating security posture.

3. Optimized Performance and Resources

• Distributed Firewall Performance Improvements: To secure data-heavy AI workloads, vDefend significantly enhances Distributed Firewall (DFW) throughput to 22 Gbps on 25G NIC servers (a 129% increase) and 75 Gbps on 100G NIC servers (an additional 241% increase), achieving up to 75 Tbps scale-out performance per VCF instance.
• Distributed Intrusion Detection and Prevention System Performance: vDefend can now boost Intrusion Detection and Prevention System (IDPS) performance to 17Gbps per server (an 89% increase), delivering up to 17 Tbps of scale-out performance for distributed virtual patching per VCF instance.
• Leaner Security Services Platform Deployment Model: vDefend introduces a leaner Security Services Platform (SSP) deployment model that reduces the physical hardware required to run the platform, lowering infrastructure costs.

The sections below describe each vDefend innovation in detail and highlight customer benefits. 

vDefend 1-2-3 for ATP: Deployment Automation Workflows

Infiltration occurs when network traffic goes uninspected; therefore, implementing IDPS across all workloads, not just mission-critical ones, is essential. Additionally, robust network security requires zero-day threat detection and mitigation capabilities.  

vDefend 1-2-3 for ATP is a new guided workflow that accelerates the deployment of Advanced Threat Prevention across private cloud environments. Designed similarly to the vDefend 1-2-3-4 for DFW workflow for lateral (macro and micro) segmentation, ATP workflow streamlines the implementation of IDPS, Network Traffic Analysis (NTA), and Network Detection and Response (NDR), reducing deployment times from months to weeks.

The workflow consists of three stages:

• Stage 1: Conducts a threat posture assessment focused on IDPS, NTA, and NDR to evaluate current risks and provide recommendations.
• Stage 2: Applies recommended IDPS policies to protect shared services infrastructure, such as Active Directory, DNS, and NTP.
• Stage 3: Expands IDPS policies across zones (environments) such as DMZ, Dev, and Production.

By using this guided workflow, IT teams can rapidly deploy Advanced Threat Prevention, including virtual patching and zero-day threat mitigation, to strengthen security posture and compliance.

On-Premises Malware Prevention System

Highly regulated industries face strict data sovereignty requirements and compliance standards such as HIPAA and GDPR, which make it essential to keep sensitive data and files inside local data centers. vDefend now offers an on-premises Malware Prevention System (MPS) that meets these requirements without compromising threat detection. This architecture brings malware sandboxing directly into the local data center, eliminating the need to upload files to an external public cloud. By keeping all sensitive data, files, and metadata strictly inside local boundaries, enterprises remove external attack surfaces while maintaining full control over their sensitive data.

Comprehensive Air-Gapped Support

For infrastructure requiring absolute operational isolation and strict data privacy, defending against modern threats without exposing internal systems to the internet is critical. 

vDefend now offers a comprehensive, air-gapped deployment model to keep all network traffic, files, and data strictly inside the local data center. It eliminates external dependencies and public cloud connectivity. Security teams can safely download offline threat intelligence updates and manually upload them to vDefend. This maintains up-to-date signatures against new threats without connecting to external cloud services.

AI Assistant for vDefend

Complex workflows and troubleshooting slow infrastructure and security teams down, consuming time, introducing risk, and holding back business agility. To reduce this complexity, VMware is introducing an AI Assistant for vDefend. By embedding intelligence directly into the platform, the tool accelerates troubleshooting, provides version-aware design guidance, and automates policy cleanup to eliminate duplicate and redundant rules. It also offers real-time visibility into live configurations, performance metrics, security events, and API assistance for automation. This operational intelligence allows security teams to streamline day-to-day operations and improve overall efficiency.

Leaner Security Services Platform (SSP) for Lower-Footprint Entry Point

Enterprise IT teams need deep traffic visibility and security posture assessments to manage security risks effectively. The Security Services Platform (SSP) serves as a scale-out data lake that ingests network flow records and telemetry, providing granular flow visibility, security assessment scores, policy recommendations, and guided workflows. With rising server costs, vDefend now offers a leaner SSP deployment model with a lower-footprint entry point starting at 32 CPU cores. This new deployment model reduces physical server requirements by up to 33%, allowing organizations to lower infrastructure costs. The scale-out architecture of the SSP platform allows it to expand as needs grow.

Enhanced Distributed Firewall and IDPS Performance

vDefend delivers major performance improvements across both the Distributed Firewall (DFW) and IDPS engines. 

• Distributed Firewall: DFW can now scale up to 22 Tbps (129% increase) and 75 Tbps (further 241% increase) per VCF instance using 25G and 100G NIC servers, respectively. With server costs on the rise, these enhancements allow enterprises to scale performance-intensive workloads using their existing server hardware via a software upgrade.
• Distributed IDPS: IDPS now delivers up to 17 Gbps per host, providing up to 17 Tbps (89% increase) scale-out capacity per VCF instance. These enhancements allow organizations to run hypervisor-native distributed virtual patching and secure performance-intensive AI traffic at scale, all delivered via a software upgrade.
  

Automated Migration to vDefend Distributed Firewall

Migrating from legacy, agent-based firewall solutions is often slow and resource-intensive due to the manual effort required to translate complex rule sets. To eliminate this deployment friction, VMware offers the vDefend and Avi Conversion Tool (vACT) to automate security policy migrations. The tool automatically converts existing firewall rules and configurations directly into native vDefend policies. By accelerating transition and minimizing manual errors, vACT enables organizations to reduce overall migration costs and improve lateral security posture more quickly.

The new enhancements are delivered in vDefend Security Services Platform 5.2, vDefend 9.1.1, and vDefend and Avi Conversion Tool (vACT) 3.0 releases, all of which are compatible with the VCF private cloud 9.1 release.

Lateral Defense for Agentic AI workloads

As enterprises deploy agentic AI in their private cloud, Zero Trust lateral security will be necessary day one. Additionally, security technologies must recognize new agentic AI constructs, such as LLMs, agents, tools and AI protocols. One example is the Model Context Protocol (MCP), which enables agents to interact with various enterprise tools, data, and services. In addition to securing MCP traffic, it is important to harden the MCP itself in line with established enterprise-ready protocols like HTTP, SIP, SSH, and TLS. vDefend engineers took a leading role by championing a proposal to harden stateless MCP interactions, which is now reflected in Agentic AI Foundation’s updated MCP specification released in July 2026 (see coverage in the Ars Technica article). Such collaborations are critical for achieving the visibility and policy enforcement required to secure agentic AI workloads.

Conclusion

Modern enterprises require a multi-layer private cloud lateral defense that is distributed, automated, and high-performance to protect workloads against evolving, AI-driven threats. The latest vDefend enhancements further strengthen the solution through streamlined Advanced Threat Prevention workflows, flexible deployment models for highly sensitive environments, AI-assisted firewall operations, and significantly improved distributed firewall and IDPS performance. Together, these innovations enable security teams to stay ahead of threats and ensure the robust, multi-layer security required for modern private clouds.

To learn more about vDefend, see the links below.

Resources

• Dark Reading: Why Virtual Patching and Multi-Layer Defense are Critical in the Age of Frontier AI
• Multi-layer Defense in the AI Era
• VMware vDefend for VCF 9.1: Zero Trust Lateral Security for the AI Era
• vDefend DFW 1-2-3-4: Deploy Zero Trust Microsegmentation
• Zero Trust Lateral Security for Kubernetes Workloads on VCF
• Advancing Zero Trust Private Cloud with vDefend Lateral Security
• Enhance Lateral Security and Ingress Load Balancing for Kubernetes Workloads
• Broadcom Unveils AI-Ready Lateral Security and App Delivery Innovations
• vDefend Webinar Series
• Customer Case Studies:  St. John’s Health | United States Senate Federal Credit Union | GCI

The post VMware vDefend Advances Multi-Layer Lateral Security, Deployment Automation and Performance for the Frontier AI Era appeared first on VMware Security Blog.

Ready to learn how to secure your private cloud workloads against a new wave of AI-driven threats while accelerating your Private Cloud and App modernization journey? VMware Explore returns to the Venetian Convention and Expo Center in Las Vegas from August 31 – Sep. 03, 2026. Step into the next generation of enterprise infrastructure and see firsthand how VMware vDefend delivers comprehensive lateral security for VMware Cloud Foundation workloads in the Agentic AI era.

Gain expertise and a competitive edge by learning what vDefend offers in today’s rapidly changing threat landscape. Catch the sessions below at VMware Explore 2026 to chart your organization’s future and protect your private cloud.

Executive Highlight Session

Umesh Mahajan at VMware Explore 2025

Operationalizing Cyber Defense and App Resilience for the Agentic AI Era [SECB1789LV]
Tuesday, Sep 1  2:00 PM – 2:45 PM PDT

Digital IT is adopting agentic AI to help businesses further differentiate and boost productivity. AI is also the cause of attack surface explosion, as bad actors armed with the same AI models autonomously infiltrate enterprises. Infrastructure operators need new innovations that accelerate their AI journey, while ensuring app resilience and complete cyber lockdown of large language models (LLMs), agents, data stores, and MCP services. Join Umesh Mahajan, GM of Application Networking and Security (ANS), Broadcom, to learn how IT is consuming lateral security and app delivery for AI and non-AI workloads. The session will cover operational best practices to implement Zero Trust and app resilience Day 1 for VMware Cloud Foundation® (VCF) 9.1 and private AI, leveraging new innovations in VMware® vDefend and VMware® Avi Load Balancer. The deployment journey will focus on rapid rollout to buy-down risk while ensuring app availability, investment protection, and consistent operations of VMs, VMware vSphere® Kubernetes Service, and agentic AI workloads.

Umesh Mahajan, VP & GM, Application Networking and Security, Broadcom
Prashant Gandhi, Head of Products, Application Networking and Security, Broadcom

People’s Choice Award Winner – Breakout Session

Enforcing Zero Trust for Apps Across Multi-Cluster VMware vSphere Kubernetes Service [SECB1079LV]
Tuesday, Sep 1  10:15 AM – 11:00 AM PDT

As VMware vSphere® Kubernetes Service (VMware VKS) becomes the go-to runtime for running modern applications and especially AI applications on VMware Cloud Foundation® (VCF), how do you enforce strict Zero Trust for workloads across multiple Kubernetes clusters and VMs? In this session, we will show how SecOps can define a central “security taxonomy” via labels, and how developers deploy apps that automatically consume those policies. We will look at how VMware® vDefend and Antrea CNI work together to enforce microsegmentation across VKS clusters from a single control plane. We will cover: • Building a label-based taxonomy for Kubernetes apps • Enforcing Zero Trust with vDefend and Antrea across L4 • Protecting L7 with end-to-end mTLS and WAF using Istio and VMware® Avi • Ensuring bad actors cannot bypass global security • Automating policy rollouts via Terraform. Finally, we will wrap up with a demo showing this entire automated workflow in action.

Chris McCain, Field CTO, Broadcom
Niran Evenchen, Principal Solution Architect, Broadcom

Breakout Sessions

Lateral Security Simplified: The VMware vDefend Distributed Firewall 1-2-3-4 Security Journey [SECB1247LV]
Monday, Aug 31  9:00 AM – 9:45 AM PDT

Stopping lateral movement within the data center is critical, yet many organizations struggle with the complexity of mapping and securing east-west traffic. The VMware vDefend Security Journey provides a prescriptive, data-driven workflow designed to simplify lateral security for VMware Cloud Foundation®. In this session, we break down the “1-2-3-4” deployment framework to help you move from zero visibility to a fully hardened environment. We will walk through the four essential stages: protecting critical shared services, segmenting broad environments, securing specific application tiers, and achieving final lockdown. Whether you are starting from scratch or refining your firewall, you will leave with a practical roadmap to eliminate lateral threats.

Catherine Fan, Technology Product Manager, Broadcom
Andrew Hrycaj, Technical Product Manager, Broadcom

Demystifying vDefend Distributed Security within VMware Cloud Foundation [SECB1358LV]
Monday, Aug 31  10:15 AM – 11:00 AM PDT

VMware® vDefend Distributed Firewall and VMware® vDefend Distributed Intrusion Detection and Prevention System (IDS/IPS) provide security services in the kernel through processing of rules and signatures intrinsically within the virtual networking infrastructure. We will show the inner workings of the distributed services from an architectural standpoint and, more importantly, the best implementation techniques, as well as troubleshooting tools for examining the effectiveness of the strategy deployed. We will show the use of AI to simplify the configuration of the centrally managed protection mechanisms and greatly reduce the time and effort needed to put a tight security policy in place.

Chris McCain, Field CTO, Broadcom
Tim (vGandalf) Burkard, Principal Technical Learning Engineer, Broadcom

Self-Service Security for VMware Cloud Foundation Automation with VMware vDefend Distributed Firewall [SECB1119LV]
Tuesday, Sep 1  9:00 AM – 9:45 AM PDT

The core of delivering a VMware Cloud Foundation (VCF) private cloud experience to enterprise customers and cloud service providers is empowering their project and tenant admins with delegated, self-service security controls. This session will explore how VMware® vDefend Distributed Firewall delivers these self-service capabilities directly to customers consuming the VCF private cloud via VCF Automation. We will specifically discuss delegating vDefend Distributed Firewall controls and how enterprise admins, providers, and tenant admins can leverage it to ensure the highest levels of security.

Geoff Wilmington, Technology Product Management, Broadcom

Prescriptive Ransomware Defense for VMware Cloud Foundation Workloads with VMware vDefend Advanced Threat Prevention [SECB1466LV]
Tuesday, Sep 1   3:15 PM – 4:00 PM PDT

Ransomware is pervasive; your defense must be proactive. For VMware Cloud Foundation® (VCF) users, the optional phase of security is over. Join us to discover how to leverage VMware® vDefend Advanced Threat Prevention, including IDS/IPS, NTA, and NDR to stay ahead of threat actors. Whether you are just getting started or looking to optimize your existing stack, you will learn about a new prescriptive, built-in guided workflow with assessments and tailored security policies that will significantly improve your security posture.

Bopaiah Puliyanda, Senior Manager, Product Management, Broadcom

Security Reference Design for VMware Cloud Foundation [SECB1630LV]
Wednesday, Sep 2  11:30 AM – 12:15 PM PDT

In the era of decentralized data and AI-driven threats, security can no longer be a bolt-on feature—it must be the foundation. As organizations consolidate on VMware Cloud Foundation® (VCF), the challenge shifts from managing disparate security tools to implementing a unified, Zero Trust architecture that protects workloads from the silicon up to the cloud. Join us as we break down the blueprint for a hardened VCF and learn how to design security for VCF management and workload domains. We will move beyond basic configuration to explore a holistic architectural approach that integrates VMware® vDefend lateral security solutions. We will walk through the framework for building a resilient VCF private cloud: infrastructure protection, application ring fencing and microsegmentation, threat visibility, and ransomware prevention.

Pooja Patel, Director, Broadcom

Secure the Front Door: Hardened VMware vSphere Kubernetes Service with VMware Avi
and VMware vDefend [SECB1462LV]
Wednesday, Sep 2  12:45 PM – 1:30 PM PDT

Kubernetes (K8s) introduces a dramatically more agile model for modern applications. VMware® Avi and VMware® vDefend deliver critical security and load balancing for K8s workloads. VMware Avi and Avi Kubernetes Operator (AKO) redefine Kubernetes ingress by eliminating manual networking “plumbing.” Within VMware vSphere® Kubernetes Service (VMware VKS), installation is plug-and-play: AKO automatically provisions enterprise load balancing the moment your cluster is live. We are future-proofing this stack via the K8s Gateway API—the industry standard for modern AI Gateways. This role-oriented model simplifies life for developers and admins, providing the “front door” required for next-gen apps. Security remains a core pillar through Istio integration, where VMware Avi delivers high-performance mTLS, WAF, and deep observability. The session also highlights a top U.S. financial institution’s design and architecture for AKO. This unified approach ensures your VMware VKS environment is secure, modern, and simple to operate at scale.

Chris Grice, Technical Product Manager, Broadcom
Madhu Krishnarao, Sr. Product Manager, Broadcom

The Patching Dilemma: Do You Need Help with the Deluge of Vulnerabilities? [SECB1279LV]
Wednesday, Sep 2  2:00 PM – 2:45 PM PDT

The gap between vulnerability discovery and exploitation is shrinking at an unprecedented rate. As AI-driven tools automate the identification of zero-day flaws, traditional patch-all strategies have become mathematically impossible for modern enterprises. How do we keep up when the deluge never ends? This session explores a shift from reactive patching to risk-based orchestration. We will dive into the critical role of compensating controls, specifically focusing on how Virtual Patching via IDPS (Intrusion Detection and Prevention Systems) and Avi Web Application Firewall (WAF) provides the breathing room teams desperately need. Attendees will learn how to buy back time for testing and deployment without leaving their environment exposed to the next major exploit.

Geoff Shukin, Senior Product Manager, Broadcom
Stijn Vanveerdeghem, Senior Manager, Technology Product Management, Broadcom

Secure by Design: Eliminating Ransomware Blind Spots with VMware vDefend [SECB1311LV]
Wednesday, Sep 2  3:15 PM – 4:00 PM PDT

In a landscape where lateral movement defines modern attacks, infrastructure can no longer be a passive bystander. This session explores a security-first approach that embeds defense directly into the hypervisor to neutralize threats at the source. We provide a deep dive into the unique architectural advantage of VMware® vDefend and VMware Cloud Foundation® (VCF), demonstrating a methodology to “buy down” risk across your entire environment. Through technical insights and an end-to-end demo, you will discover how to achieve immediate “quick wins” such as virtual patching and distributed threat prevention to stop attackers before they gain a foothold.

Stijn Vanveerdeghem, Senior Manager, Technology Product Management, Broadcom

Innovation Track

Governance of Micro-Segmentation Policies [INVB1744LV]
Wednesday, Sep 2  3:15 PM – 4:00 PM PDT

This session explores the critical pillars of microsegmentation governance, moving beyond the initial visibility phase into sustainable, long-term policy management. We will dissect the lifecycle of a policy—from discovery and authoring to automated enforcement and continuous auditing.

Kausum Kumar, Senior Manager, Technical Product Management, Broadcom

Theater presentation at VMware Explore 2025

A Step-by-Step Tutorial for Stopping Brickstorm-Like Attacks Using VMware vDefend [SECT1642LV]
Monday, Aug 31  11:30 AM – 1:00 PM PDT

This session provides step-by-step guidance about how VMware® vDefend provides a robust architectural shield against such catastrophic events. We will dive into the deployment mechanics of VMware® vDefend Distributed Firewall and Distributed Intrusion Detection/Prevention (IDS/IPS) to demonstrate how micro-segmentation can effectively stop attacks in their infancy.

Andrew Hrycaj, Technical Product Manager, Broadcom
Geoff Shukin, Senior Product Manager, Broadcom

Quick Talk

The Top 10 Agentic AI Security Risks and Threats Every IT Admin Should Know [CMTYQT1710LV]
Monday Aug 31 11:00 AM – 11:20 AM PDT

Learn about the top 10 security risks and vulnerabilities facing agentic AI applications, large language (LLMs), and MCP servers. In this session, we will provide an introductory overview of agentic AI components, real-world examples of AI security threats, and how you can prepare to mitigate those risks with VMware software solutions.

Meet the Expert Roundtables

Best Practices for Tagging and Groups for VMware vDefend Distributed Firewall [SECM1748LV]
Monday, Aug 31 2:00 PM – 2:30 PM PDT

In this interactive whiteboard session, we move past the high-level marketing slides to focus on the technical “blocking and tackling” required to secure your private cloud using VMware® vDefend. Among other topics, participants will gain technical insights into virtual patching, using Distributed IDS/IPS to shield vulnerable workloads from known exploits without the immediate need for disruptive guest-level patching, leveraging network detection and response (NDR) and sandboxing to identify behavioral signals of ransomware actors, and a lot more. Bring your questions and leave with a practical blueprint for making your infrastructure immune from ransomware.

Bopaiah Puliyanda, Senior Manager, Product Management, Broadcom

Code-Driven Security: Automating VMware vDefend Policy with Infrastructure as Code [SECM1509LV]
Tuesday, Sep 1  2:00 PM – 2:30 PM PDT

Stop managing security policies manually. This session moves beyond basic configuration to focus on operationalizing automation within your private cloud defense using infrastructure as code (IaC). We will demonstrate how to leverage code to automatically generate, deploy, and manage your VMware® vDefend Policy, making security policy a function of code that protects your environment from the ground up. We will dive deep into practical methods for codifying network segmentation using vDefend with virtual private clouds (VPCs), defining granular role-based access, and standardizing critical defenses like Layer 4/7 Firewall and Gateway Firewall configurations. By operationalizing this IaC approach, you will ensure consistent, scalable, and secure resource provisioning across all your projects, leading to streamlined and reliable deployment strategies.

Andrew Hrycaj, Technical Product Manager, Broadcom

Registration is now open! Check out the content catalog and scheduling tool, using the vDefend,  Avi, and overall ANS Targeted Agendas to build your personalized VMware Explore schedule. Looking forward to seeing you in Las Vegas!

The post VMware vDefend Sessions at VMware Explore 2026 appeared first on VMware Security Blog.

VMware vDefend directly conforms to NIST CSF, HIPAA, and PCI DSS requirements, providing organizations with the critical controls needed to satisfy regulatory mandates and mitigate modern threats.

Regulatory compliance has become a strategic imperative across all industry sectors due to a growing global focus on data privacy, supply chain transparency, and operational resilience. This urgency is further amplified by the rapid adoption of AI and the rise of AI-accelerated cyberattacks. These advanced threats often target software vulnerabilities and spread laterally through east-west traffic to access high-value targets such as electronic protected health information (ePHI) or Cardholder Data Environment (CDE). As a result, security and compliance teams must deploy comprehensive controls to provide visibility and enforcement, restrict lateral movement, detect threats, and enable mitigation before damage can occur.

To effectively address these challenges and ensure compliance, organizations must align their security architecture with the necessary control points. This alignment is typically achieved through a layered approach, using regulatory frameworks tailored to their industry, data type, and security maturity:

• The Strategic Baseline (NIST CSF 2.0): A highly flexible, risk-based set of guidelines (Identify, Protect, Detect, Respond, Recover). It is often used as a baseline for overall cybersecurity maturity or mapped to fulfill other requirements.
• The Prescriptive Mandates (PCI DSS 4.0.1 & HIPAA): These granular, rules-driven standards are designed to safeguard specialized assets such as cardholder data and ePHI, requiring robust technical boundaries, workload isolation, and deep traffic surveillance.

To provide an objective, professional evaluation of vDefend’s alignment with these mandates, VMware partnered with Coalfire, a leading independent cybersecurity advisory firm. This partnership resulted in the publication of authoritative Product Applicability Guides (PAGs), which provide a detailed assessment of VMware vDefend’s capabilities against established regulatory requirements.

VMware vDefend is a comprehensive Zero Trust lateral security solution designed to protect against cyber threats. This hypervisor-native, software-defined solution provides deep visibility into both network and application activities, effectively eliminating security blind spots. It enforces a multi-layered defense and mitigation strategy against ransomware and advanced persistent threats. 

VMware vDefend is a comprehensive lateral security solution that includes multiple capabilities: distributed and gateway firewalls (DFW, GFW), distributed Intrusion Detection and Prevention Service (IDS/IPS), Malware Prevention Service (MPS), Network Detection and Response (NDR) with an NDR Sensor, and Network Traffic Analysis (NTA). This solution offers deep traffic visibility and creates a closed-loop security system for VCF private cloud, ensuring visibility, prevention, detection, and mitigation of cyber threats.

The following sections explore how VMware vDefend aligns with the essential lifecycle mandates of these critical compliance frameworks.

The Strategic Baseline: NIST CSF 2.0

The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0 serves as a foundation for modern security design. Rather than offering a simple checklist, it presents a systematic approach organized around five key technical functions: Identify, Protect, Detect, Respond, and Recover.

The following sections detail how vDefend’s comprehensive security capabilities align with the objectives of each NIST framework function.

Identify

Proper identification and mapping of various critical IT assets form the foundation of a comprehensive defense strategy. With vDefend, enterprises can organize workloads statically or dynamically using a tag-based labeling system to trigger specific security policies. Static policies apply to a fixed set of tagged workloads, while dynamic policies automatically adjust and apply based on ‌specific tags. This dynamic enforcement ensures that the corresponding level of compliance, be it regulatory (e.g., HIPAA, PCI DSS) or internal security posture requirements, is met instantly and consistently as new workloads are spun up or existing ones change.

VMware vDefend’s Security Intelligence provides real-time, distributed visibility across the entire data center and cloud infrastructure by continuously monitoring and analyzing all identified traffic flows between workloads. By observing these communication patterns, the Security Intelligence platform can automatically detect and map the “desired” or “baseline” behavior of applications. Based on this traffic flow analysis, the platform provides highly calibrated, actionable policy recommendations that can significantly reduce the attack surface and enhance the overall security posture.

With a clearly identified asset inventory and defined policy baselines, the focus then shifts to proactive enforcement.

Protect

Protecting enterprise workloads from known and previously unseen (zero-day) threats is a core capability of the vDefend solution.

While vDefend Gateway Firewall (GFW) provides conventional NGFW edge controls, albeit with a modern software-defined architecture, the vDefend Distributed Firewall (DFW) employs a distributed (and scale-out) ‘security-per-workload’ model, ‌securing each workload at the virtual NIC layer. Lateral movement, the technique in which attackers pivot from a compromised system to high-value targets, is the primary mechanism by which modern threats, such as sophisticated ransomware and advanced persistent threats, spread internally. By enforcing security policies for every workload, vDefend DFW effectively stops unauthorized lateral movement and restricts breaches from spreading. This critical defense-in-depth mechanism dramatically shrinks the attack surface to an individual workload.

While the Distributed Firewall restricts spread, continuous detection is required to flag anomalies and sophisticated threats that bypass conventional defenses.

Detect

The Detect function focuses on identifying a cybersecurity event in real time, not just after the fact, enabling rapid response and containment. In today’s dynamic threat landscape, this function has undergone a significant transformation. vDefend Advanced Threat Prevention (ATP) has evolved the detection capability by leveraging a multi-layered approach to threat detection, ensuring that security gaps are minimized and evasive threats are captured:

• Distributed Intrusion Detection/Prevention System (IDS/IPS): The vDefend distributed IDS/IPS inspects network traffic and actively matches traffic patterns against an extensive, continuously updated library of over 10,000 known threat and vulnerability signatures. This distributed deep inspection – applied on a per-workload basis – is crucial for detecting both external attacks and east-west traffic anomalies, and for identifying potential vulnerabilities before they can be exploited.
• Network Traffic Analysis (NTA): NTA detects highly sophisticated attacks that bypass perimeter defenses by using behavioral analytics and machine learning on network metadata and flow information. NTA excels at immediately flagging subtle signs of an ongoing internal breach, particularly lateral movement, a key indicator of a successful intrusion.
• Sandboxing for Malware Analysis: vDefend provides an advanced sandboxing feature to neutralize the threat of zero-day exploits and polymorphic malware. This technology isolates suspicious files and URLs in a secure, virtualized environment (the “sandbox”), where the file is “detonated” or executed within a limited blast radius to observe the true behavior. If the file exhibits malicious characteristics, it is blocked, and the signature information is updated to prevent future occurrences.
• Network Detection and Response (NDR): vDefend NDR correlates multiple disparate data points from various sources into visually intuitive attack maps. These detailed, chronological, and graphical representations of an attack campaign result in highly relevant, actionable security intelligence for security teams. 

Taken together, these capabilities give organizations a holistic, real-time picture of threats across their environment. The comprehensive, correlated data and visual attack maps also serve as verifiable evidence of due diligence during audits.

Respond

The response involves a rapid, coordinated incident management effort to contain threats and minimize damage. 

When a threat is detected, vDefend can automatically trigger a Quarantine Policy, moving the infected VM into an isolated “Security Group” with access limited to forensics tools. When coupled with correlated intrusion campaign data from NDR, the incident management team can visualize the entire attack chain on a map. Furthermore, vDefend’s advanced troubleshooting tools—such as traceflow, packet capture, and detailed firewall logs—provide the forensic data needed to demonstrate compliance during an audit.

Once the immediate threat is contained and the attack chain is documented, the final step is ensuring full operational recovery.

Recover

The Recover function focuses on the rapid and complete restoration of services to the pre-incident operational state, ensuring the integrity of all reinstated data. VMware vDefend offers robust capabilities for incremental and full configuration backups. Furthermore, integrating VMware Live Recovery with vDefend significantly enhances the overall resilience strategy, covering both incident response and subsequent recovery.

In summary, the VMware vDefend solution enables foundational security controls that not only provide enterprise-grade protection but also streamlines the complex process of achieving and maintaining continuous compliance across diverse regulatory landscapes. Coalfire’s evaluation recognizes vDefend for its excellent structural coverage throughout the entire NIST lifecycle.

Coalfire assessed vDefend against all 106 subcategories in NIST CSF 2.0, and the results demonstrate the breadth and depth of vDefend’s compliance coverage. vDefend achieves full or strong coverage across the vast majority of applicable subcategories. The ability to monitor, inspect, and enforce policy on east-west traffic within a VCF environment is the architectural advantage that drives this coverage, translating directly into measurable, assessor-validated outcomes across Identify, Protect, Detect, and Respond.

It is worth noting that NIST CSF 2.0 is intentionally broad — many of its subcategories address organizational and business processes that extend beyond any single technology platform. vDefend delivers deep, validated coverage of the technical control layer, and when combined with the organizational security program built around it, organizations are strongly positioned to demonstrate comprehensive CSF 2.0 alignment.

The detailed NIST CSF 2.0 Product Applicability Guide is available here. 

The Prescriptive Mandates: PCI DSS 4.0.1 & HIPAA

In contrast to the broad NIST framework, data-specific regulations such as PCI DSS and HIPAA involve highly prescriptive technical requirements. Whether securing credit card data or electronic health records, vDefend serves as an essential, independently validated technical control point for both standards. The sections below explain these in detail.

PCI DSS 4.0.1 Alignment

The Payment Card Industry Data Security Standard places a strong emphasis on isolating the Cardholder Data Environment (CDE) and restricting access to it. In a virtualized environment, this means enforcing precise east-west traffic controls—the core architecture vDefend is built around. Coalfire’s Product Applicability Guide highlights vDefend’s coverage across all 12 major PCI DSS requirements:

Note: Requirements 3 and 9 are marked N/A as they address stored account data and physical access controls, respectively — areas outside the scope of a network security platform.

The detailed PCI DSS 4.0.1 Applicability Guide is available here. 

HIPAA Technical Safeguards Mapping

In healthcare environments, the stakes of inadequate security controls are particularly high. East-west traffic between clinical applications, databases, and administrative systems creates a wide attack surface for ePHI exposure. vDefend directly addresses this risk through its distributed enforcement model.

Under the HIPAA Security Rule, healthcare covered entities must deploy specific technical safeguards to ensure the confidentiality, integrity, and availability of ePHI. Coalfire’s validation confirms that vDefend aligns directly with these rigorous provisions: 

The Administrative Safeguards (requirements 1–5) address process and access governance; the Technical Safeguards (requirements 6–9) enforce those controls at the system level. vDefend is independently validated across all nine, providing covered entities with a strong, documentable compliance foundation.

The detailed HIPAA Applicability Guide can be found here. 

VMware vDefend provides essential technical control points for data-specific regulations. Coalfire’s validation confirms its direct alignment with both the PCI DSS 4.0.1 requirements for isolating the Cardholder Data Environment (CDE) and the HIPAA Security Rule’s rigorous provisions for safeguarding the confidentiality, integrity, and availability of ePHI.

Conclusion

VMware vDefend delivers a comprehensive set of control points for both broad frameworks, such as NIST CSF, and data-specific compliance mandates, such as PCI DSS and HIPAA. Adopting VMware vDefend allows organizations to implement a robust security strategy while gaining the necessary control points for compliance. By integrating visibility, prevention, detection, and mitigation directly into a closed-loop security system, vDefend significantly accelerates an organization’s journey toward a Zero Trust posture and continuous compliance. 

To learn more about the benefits of vDefend, see the links below.

• vDefend Product Applicability Guide for PCI-DSS
• vDefend Product Applicability Guide for HIPAA
• vDefend Product Applicability Guide for NIST CSF 2.0
• VMware vDefend Distributed Firewall
• VMware vDefend Advanced Threat Prevention
• VMware vDefend Datasheet
• vDefend DFW 1-2-3-4: A Prescriptive Path to Zero Trust Microsegmentation
• VMware vDefend How to Videos on YouTube

The post Validated Compliance: VMware vDefend Conforms with NIST CSF, HIPAA and PCI DSS appeared first on VMware Security Blog.

In the past, data center security mostly relied on perimeter protection—”building walls” to keep bad actors out. Today, safeguarding the data center’s “east-west” or lateral traffic traversing within applications and data is just as critical. Threat actors are leveraging “Frontier AI” security models to automate and accelerate attacks against private cloud workloads. 

To help enterprises achieve best-of-breed protection with significantly reduced complexity, we are excited to announce new VMware vDefend blueprints to speed up lateral security roll-out across VCF private cloud workloads and help organizations quickly buy down risk. The “Lateral Security for VMware Cloud Foundation with VMware vDefend” VVS is now integrated into core VCF 9.1 design documentation as “Lateral Security with vDefend” Blueprints. The blueprints for Securing the Management and Workload domains are now included with the core VCF 9.1 design documentation.

Here is a closer look at what this change means, what these blueprints cover, and how you can start using them to modernize your private cloud security and protect against both conventional and AI attacks.

What are the Design Blueprints for VMware Cloud Foundation?

A blueprint is a prescriptive, end-to-end architecture designed to accelerate your time-to-value when building and operating a VMware Cloud Foundation (VCF) private cloud platform. It provides predefined deployment models that conform to specific profiles. A blueprint also includes a set of planning, implementation, and design elements (requirements and recommendations) tailored to the selected deployment model. You can streamline your VCF private cloud provisioning by using them as a template, swapping out models to match your unique infrastructure layout.

What does Lateral Security with vDefend Blueprints cover?

The Lateral Security with vDefend Blueprints describes the architectural components and design selections required to provide unified, enterprise-grade security services for a VMware Cloud Foundation platform using VMware vDefend security solutions.

The design consists of three individual blueprints that cover pre-defined models to address network and application security corners of your platform:

• Security Services Platform for VCF: Outlines the design details, planning and preparation, and implementation steps for deploying the vDefend Security Services Platform on VCF.
• Management Domain Security: Tailored guidelines to protect the critical management components powering the VCF and establish a foundational, security-robust private cloud environment.
• Workload Domain Security: Dedicated blueprint aimed at utilizing the vDefend DFW-1-2-3-4 staged prescriptive workflow to meet the Zero Trust lateral security model for applications within a VCF workload domain.

Getting Started

Ready to eliminate blind spots and lock down your east-west traffic? Check out the new Lateral Security with vDefend design blueprints today and take your private cloud security to the next level.

Summary

By integrating VMware Validated Solutions into the core VCF 9.1 design documents, Broadcom aims to streamline documentation and provide straightforward guidance for building a robust, secure private cloud.

The Lateral Security with vDefend Blueprints equips you with verified configurations and guidelines to streamline setup, reduce guesswork, and accelerate the path to a cyber-resilient private cloud. Whether you’re new to security or an experienced professional, these blueprints make it easier than ever to transform your security plans into a practical security strategy.

Deployment and Design Resources:

Design Library for vDefend

Securing vSphere Supervisor and VKS

DFW 1-2-3-4: Security Journey Self-Deployment Guide

The post Introducing VMware vDefend Lateral Security Design Blueprints for VCF 9.1 appeared first on VMware Security Blog.

We would like to bring your attention to a security bulletin from AMD: AMD-SN-2001: Ionic Driver Vulnerabilities.

The bulletin details three vulnerabilities — CVE-2025-62623, CVE-2025-62624, and CVE-2025-62627 — present in the AMD ionic cloud driver for VMware ESX. These issues affect ESX hosts using AMD-Pensando DPU (Data Processing Unit) products.

We strongly encourage you to review the bulletin if you are using AMD-Pensando DPU products.

For technical inquiries, please contact VMware Support for assistance.

The post AMD Ionic Driver Vulnerabilities Affecting VMware ESX appeared first on VMware Security Blog.

Update, July 29, 2026

Today, Broadcom has released the following new VMware security advisory:

VMSA-2026-0006 – VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709)

The advisory documents the remediation of the Critical severity vulnerability (VMXNET3 out-of-bounds write vulnerability- CVE-2026-47876) demonstrated at the Pwn2Own 2026 hacking contest. Customers should review the security advisory and direct any questions to VMware Support.

Update, May 16, 2026

Pwn2Own 2026 has finished and we have witnessed one successful attempt on our products. On May 16, 2026, Nguyen Hoang Thach of STARLabs SG successfully demonstrated an exploit targeting VMware ESX.

We are actively working on the remediation and we plan to publish a VMware Security Advisory to provide information on updates for the affected products.

We would like to thank the Zero Day Initiative (ZDI) for allowing us to participate and the team from STARLabs SG for working with us to address the reported issue.

Initial post

The Broadcom PSIRT Team (VCF Division) is pleased to announce VMware’s participation in Pwn2Own Berlin 2026, organized by the Zero Day Initiative (ZDI). The competition will run from May 14–16, alongside OffensiveCon in Berlin, Germany.

Members of our team will be on-site to validate any VMescape demonstrations on ESX. If you are attending and have any questions for us, we would be happy to connect with you in-person.

VMware ESX continues to be a primary target in the virtualization category. A successful VMescape demonstration carries prize money of $150,000, with an additional $50,000 bonus available. This year, the contest is limited to ESX as VMware Workstation has been removed from the competition’s target list.

We would like to thank the Zero Day Initiative (ZDI) for the opportunity to participate. We will update this post as additional details become available. To stay informed on the latest VMware Security Advisories (VMSAs), please sign up here.

The post VMware at Pwn2Own Berlin 2026 appeared first on VMware Security Blog.

New enhancements include Self-Service Lateral Security with VCF Automation, Unified Lateral Threat Prevention for VMs and VKS Workloads, High-Performance Threat Prevention with IDPS Turbo Mode, and Enhanced Distributed Firewall capabilities.

The rapid adoption of production AI workloads is reshaping the enterprise technology landscape, driving the growth of Kubernetes environments alongside existing VM-based infrastructure. As organizations deploy AI agents and AI workloads across private cloud environments spanning VMs and Kubernetes, the attack surface becomes larger and more dynamic. The result is a rapidly evolving threat landscape, driving the need to secure both VM- and Kubernetes-based environments efficiently and consistently.

Recent incidents, including the CISA-reported BRICKSTORM malware activity and the rise of AI-assisted semi-autonomous cyberattacks, underscore that adversaries are now operating at machine speed. At the same time, enterprises face several practical challenges: reducing the attack surface to prevent lateral propagation of threats, securing workloads at the speed of application deployments, enforcing consistent security across VMs and Kubernetes environments, delivering the performance required for AI and high-capacity workloads, and consolidating security within the core platform rather than relying on fragmented point solutions.

VMware vDefend is integrated with the VMware Cloud Foundation (VCF) platform, providing plug-and-play zero-trust lateral security that protects modern distributed workloads, including AI and high-performance computing, without compromising the performance and agility they demand.

vDefend’s hypervisor-native, distributed, software-defined model provides a closed-loop security architecture that uniquely enables visibility, prevention, detection, and mitigation for comprehensive multi-layer defense. Additionally, vDefend’s distributed policy orchestration allows policies to be created once and automatically enforced as workloads are created or moved.

New vDefend innovations for VCF 9.1

• Self-Service Lateral Security with VCF Automation: VCF Automation’s Self-Service Lateral Security enables infrastructure and security teams to establish guardrails, such as predefined VPC security profiles and delegated distributed firewall (DFW) settings, allowing tenant admins to access security features on demand. This facilitates quicker application onboarding and ensures a uniform security baseline across all tenants.
  
• Unified Lateral Threat Prevention for VMs and VKS Workloads: As agentic AI and cloud-native applications drive Kubernetes adoption, VMware vSphere Kubernetes Service (VKS) clusters can now be inspected and protected by the same high-performance distributed IDS/IPS that currently secures VMs. Security teams get one console, one policy model, and consistent lateral threat prevention across VMs, containers, and bare-metal workloads, eliminating the blind spots attackers exploit. Customers deploy IDS/IPS (1) to meet compliance requirements (PCI-DSS and HIPAA) and (2) to enable virtual patching that quickly protects against software vulnerabilities while patches are rolled out enterprise-wide.
  
• High-Performance Lateral Threat Prevention: The new IDPS Turbo Mode delivers 3x throughput, increasing from 3 Gbps to 9 Gbps per host and up to 9 Tbps per VCF domain, enabling security teams to protect against software vulnerabilities (virtual patching) and behavioral threat detection for modern AI and high-capacity workloads.
• Enhanced Distributed Firewall Capabilities: A 5x increase in Application Identification support for greater L7 visibility and simpler, granular security enforcement. Additionally, identity-based firewalling now supports a federated (multi-site) environment for consistent, simplified policy enforcement.

Built upon these key capabilities, vDefend serves as the comprehensive lateral security foundation for VCF, protecting VMs, containers, and AI workloads. The following sections will detail each of these key features.

Self-Service Lateral Security with VCF Automation

VDefend 9.1 introduces a comprehensive self-service security model that empowers Tenant Admins to manage network security directly within VCF Automation through five system-defined Security Profiles. The VPC Simplified Security feature provides one-click security for Virtual Private Clouds (VPCs) using consistent, repeatable security profiles. Tenant Admins can select a security profile for new and existing VPCs, automatically setting the default security posture and eliminating the need to manually create foundational Distributed Firewall (DFW) rules. The system-defined per-VPC DFW rules cannot be modified manually. Security policies follow a precedence order, with user-defined policies enforced before system-defined VPC security policies. This structure supports a self-service security model with automated DFW policies. In addition, this new release provides granular firewall control for both Distributed and Gateway Firewalls while enabling automated orchestration using Privileged Labels. 

Unified Lateral Threat Prevention for VMs and VKS Workloads

vDefend delivers unified lateral threat prevention by extending its hypervisor-native IDS/IPS capabilities from VMs to vSphere Kubernetes Service (VKS) workloads via CNI integration. This architecture allows security teams to enable IDS/IPS at the pod level. This capability enables vDefend IDS/IPS to continuously inspect traffic, detect, and prevent threats for mixed-mode hosts (VMs and Kubernetes). 

High-Performance Lateral Threat Prevention

VMware vDefend 9.1 delivers a major performance boost with the introduction of “Turbo Mode” for Distributed IDS/IPS, which triples threat-prevention throughput from 3 Gbps to 9 Gbps per host and up to 9 Tbps within a single VCF instance. In addition, this release provides granular control over inspected traffic with exempt actions. The new exempt actions allow security admins to select which traffic to inspect and exclude trusted traffic, such as nightly backup traffic. This also improves efficiency. 

Enhanced Distributed Firewall Capabilities

The Distributed Firewall enhancements include Layer 7 (L7) visibility and simplified policy management based on Application identification. A 5x increase in Application identification, adding ~4,000 new Application IDs, provides enhanced application visibility and enables security teams to create granular firewall rules based on the application itself rather than relying solely on ports and protocols, making security enforcement simpler and more effective. Additionally, federated identity-based firewalling has been introduced to enable uniform policy enforcement across large (multi-site) deployments. 

Conclusion

The rapid growth of AI workloads and distributed infrastructure has made traditional perimeter-based security measures insufficient. This evolving threat landscape is further complicated by AI-assisted, semi-autonomous attacks and the emergence of software vulnerabilities identified by AI models, which greatly widen the attack surface. As a result, lateral security is now an essential part of a comprehensive security strategy, not just an optional addition to perimeter defenses. Security teams need controls that match the agility of their workloads, enforce policies uniformly across containers and VMs, and enable lateral security to prevent the lateral movement of threats. VMware vDefend, along with its new capabilities, enables infrastructure and security teams to implement Zero Trust lateral security to protect VCF workloads at the speed and scale the AI era demands.  

To learn more about vDefend, see the links below.

Resources

• Zero Trust Lateral Security for Kubernetes Workloads on VCF
• vDefend DFW 1-2-3-4: Deploy Zero Trust Microsegmentation

• Advancing Zero Trust Private Cloud with vDefend Lateral Security

• Enhance Lateral Security and Ingress Load Balancing for Kubernetes Workloads

• Broadcom Unveils AI-Ready Lateral Security and App Delivery Innovations

• vDefend Webinar Series
• Customer Case Studies:  St. John’s Health | United States Senate Federal Credit Union | GCI

The post VMware vDefend for VCF 9.1: Zero Trust Lateral Security for the AI Era appeared first on VMware Security Blog.

This article was originally published December 2025 in:

Hugely disruptive ransomware attacks can be thwarted by distributed lateral security embedded at the private cloud level, using macro- and micro-segmentation and integrated threat detection and prevention.

Ransomware attacks in 2025 have caused business operations to close for weeks and months resulting in massive financial losses in organizations across the globe in sectors such as retail, manufacturing or healthcare. 

These major breaches go well beyond the purview of the security team alone. They demand boardroom attention and a fundamental rethinking of enterprise defense strategies.

Much of the urgency stems from how AI has rapidly transformed the threat landscape. AI-powered autonomous attacks now probe enterprise networks with minimal human intervention, discovering thousands of potential entry points where human attackers might find only a handful. 

The automated nature of these attacks means they’re finding far more vulnerabilities much faster. What happens after infiltration hasn’t changed — lateral movement, hunting for high-value assets, and initiating the ransom process. But AI makes the need for proper security hygiene even more pronounced.

The automated nature of AI-driven attacks means the enterprise needs to take a different approach to security. Traditional perimeter-based security assumes a fortress model, with strong walls that protect sensitive internal assets from external threats. But modern enterprises deploy distributed workloads, containers, and dynamic infrastructure that renders static perimeter defenses obsolete. Once attackers breach the perimeter, they can move laterally (freely) through flat (unsegmented) networks like burglars in an empty mansion.

Breaking the ransomware kill chain

Breaking the ransomware kill chain requires distributed security controls at multiple stages. During initial infiltration, intrusion prevention capabilities must operate wherever vulnerabilities exist, such as across private clouds, virtual desktop environments, and application layers. This distributed approach is critical because a single Java or Linux vulnerability might expose dozens of applications simultaneously across hundreds of servers.

Macro- and micro-segmentation is the crucial second line of defense. By creating virtual barriers at the workload and hypervisor level, organizations prevent lateral movement even after initial compromise. Rather than allowing attackers to roam freely once inside, macro- and micro-segmentation contains any threats, limiting damage and buying security teams critical response time.

However, implementation requires discipline. Organizations often mistake micro-segmentation’s ultimate goal for the first step, attempting to jump directly to granular application-level controls. The more effective path progresses systematically, guided by in-built deployment tooling in the firewall itself: assess the environment, segment shared infrastructure services, establish zone-based protections, then evolve toward application-level microsegmentation.

Network detection and response (NDR) provides the third critical capability. As attackers leave behavioral signatures while moving laterally, AI-powered integrated threat defense can correlate these indicators across the environment, identifying malicious activity before data exfiltration and encryption begin. Locking down protocols like Remote Desktop Protocol becomes essential.

The operational reality, however, is that security tool sprawl undermines even sophisticated strategies. Multiple disconnected solutions create deployment delays, policy management nightmares, and incomplete coverage across the attack chain. Organizations purchase numerous tools but deploy only a fraction and across a subset of applications, leaving dangerous gaps.

The solution lies in integrated, software-defined security that deploys at the data center private cloud level, where applications and data reside. VMware vDefend exemplifies this approach: a unified stack that provides distributed firewall capabilities for macro- and micro-segmentation with automated deployment workflows, as well as advanced threat detection and prevention that automatically extends as environments scale. By embedding security into the virtualization and Kubernetes layer with policy mobility and dynamic workload protection, organizations gain comprehensive visibility without IP address complexity or deployment delays.

Modern ransomware demands modern defenses. Not more disparate tools, but smarter architecture that breaks the kill chain before attacks succeed.

To learn more about how VMware vDefend can help your security approach meet AI-powered threats, visit here.

The post Breaking the Ransomware Kill Chain: Why Distributed Lateral Security Is No Longer Optional appeared first on VMware Security Blog.

As the digital landscape enters the age of Artificial Intelligence, the traditional methods of securing applications are being fundamentally challenged. The emergence of advanced AI models has shifted the advantage towards attackers. With AI, even a novice attacker is now weaponized into a sophisticated hacker while operating semi-autonomously at very low cost, and unprecedented scale. Imagine the massive damage that ransomware gangs and/or nation-state actors could do with these cyber weapons.  In recent times, ransomware attacks have led to business operations going offline for weeks and months, resulting in financial losses in hundreds of millions of dollars. To maintain a cyber resilient posture, organizations must move beyond reactive security and embrace a proactive defense-in-depth strategy centered on lateral security and virtual patching.

AI-discovered Tsunami of Exploits

Frontier AI models have the intelligence to identify unknown (zero day) software vulnerabilities (bugs) and find ways to exploit them faster than ever before. Attackers can leverage these exploits to infiltrate digital enterprises, propagate laterally, hopping and hunting, to find high value assets for ransom or for stealing secrets. They can initiate widespread, volumetric and/or targeted attacks semi-autonomously – leading to an exponential increase in the attack surface. “Security through obscurity” is no longer a viable cyber security strategy.

If enterprises can quickly patch software vulnerabilities, they can certainly reduce the risk of a breach and/or its spread. However, this is an extremely time consuming and resource intensive endeavor. There are thousands of software tools and apps, each with varied software versions, deployed on different types of hardware and operating systems and spread across multiple data centers. In larger organizations, “race to patch” can take weeks to months to roll out patches enterprise wide, leaving the organization exposed to infiltration, ransom and potentially business disruption.

To help quickly protect against this tsunami of exploits unleashed against workloads & apps and to buy down risk, enterprises need to focus on two key defenses for their private cloud workloads:

• Enable virtual patching using intrusion prevention systems and web application firewall
• Restrict propagation of attacks with lateral segmentation

What is Virtual Patching?

Virtual patching is a vulnerability-shielding tactic that protects assets by implementing a minimal layer of security policies at the network or application delivery level, front ending that asset. These measures intercept and block exploit attempts before they can reach the vulnerable software, effectively “patching” the flaw in the communication path rather than the software itself. 

Key Benefits of Virtual Patching

• Application availability: Ensures that applications/assets are available while the risks are mitigated
• No code changes: It protects applications without requiring deployment of updated software/patches. Software patches can introduce regressions: this approach eliminates that risk
• Targeted signatures: Reduces the risk of false positives and performance impact
• Zero-Day Protection: Provides a rapid response to vulnerabilities for which no official patch yet exists.
• Legacy Support: Shields older, unsupported systems that are still critical to business operations. Patches may not even exist for legacy applications
• Buys Time: Grants security teams the necessary cycles to test and deploy permanent vendor patches without remaining exposed
• Helps with Compliance: Many regulations such as PCI-DSS and HIPAA, require timely deployment of security controls to remain compliant

vDefend Distributed IDPS: Hypervisor-embedded Virtual Patching 

VMware vDefend provides a revolutionary approach to virtual patching of workloads by integrating security directly into the VMware Cloud Foundation (VCF) hypervisor fabric. The vDefend IDPS (Intrusion Detection and Prevention System) is applied directly to the vNIC of every workload, enabling deep, granular inspection of application traffic (every packet) moving across the VCF private cloud, specifically targeting network-layer exploits and lateral movements.

How vDefend IDPS Enables Virtual Patching

• Hypervisor-Integrated Inspection: vDefend’s Distributed IDPS inspects network traffic at the vNIC of every VCF workload. This ensures unpatched servers cannot be exploited by attacks originating from the outside or from inside the network. 
• Automated dynamic policies: Run a vulnerability scan to identify workloads, apply appropriate tags and create a virtual patching policy with a limited set of IDPS signatures. As new vulnerable workloads are identified and tagged, the policies are applied automatically and vulnerable workloads get immediate protection.
• East-West Security: IDPS prevents attackers from exploiting vulnerabilities to move laterally within the environment (and eventually compromising high-value assets).

Examples of Vulnerabilities Protection

• Moveit Transfer Auth Bypass (CVE-2024-5806): This flaw in the SFTP module of Moveit Transfer allowed attackers to bypass authentication and steal files without a password. vDefend can detect the “insufficient validation” logic patterns during the initial connection phase and stop the attack in it’s tracks. 

• Ni8mare (CVE-2026-21858): This unauthenticated RCE flaw in the n8n automation platform allows attackers to achieve full system takeover via “Content-Type confusion.” vDefend identifies these malformed JSON payloads and malicious header mismatches, blocking the exploit before an attacker can hijack internal workflows to move laterally through the data center.

• Log4Shell (CVE-2021-44228): vDefend IDPS can detect and prevent against attempts at exploiting the Log4shell vulnerability. This exploit, residing in the Java Naming and Directory Interface (JNDI), can download malicious scripts and perform remote code execution, allowing full control of the targeted system. (Demo: Protecting against Log4Shell with VMware vDefend ATP)

The vDefend Advantage: What makes vDefend IDPS powerful for this use case is its architectural advantage, signature strategy, and operational simplicity. 

• Speed matters in the era of AI-driven threats. vDefend’s built-in closed-loop security architecture — through integration with the VCF private cloud platform — delivers detection as well as rapid mitigation, thus dramatically reducing attacker dwell time. 
• vDefend IDPS supports IDPS signatures that are frequently updated (multiple times a day), ensuring protection against the latest global threats. Broadcom has a threat intelligence team that actively analyzes new exploits, creates signatures, and updates the signature bundles (see IDPS signature portal)
• Furthermore, IDPS supports custom IDPS signatures: customers can import trusted signatures from third-parties or develop in-house to virtually patch their applications. This provides a truly bespoke security posture.

vDefend Distributed Firewall: Restrict Unauthorized Lateral Propagation

To further restrict lateral propagation of threats, vDefend also provides a high-performance hypervisor-embedded Layer-7 Distributed Firewall (DFW). It allows comprehensive lateral segmentation of VCF workloads through highly streamlined context (or tag) based security policies. Lateral segmentation includes both macro and micro-segmentation, applied to ensure trusted (least-privileged) access to infrastructure services, environments (or zones), and applications. DFW is fully scale-out, eliminates traffic tromboning and the need for network changes (unlike traditional firewalls), and preserves the segmentation posture during vMotion events. It also includes a built-in prescriptive deployment tool, DFW 1-2-3-4 (blog), enabling rapid self-deployment across all workloads in as little as a few weeks.

Avi Web Application Firewall: Virtual Patching for Web Applications

While vDefend secures the internal network, the Avi Web Application Firewall (WAF) acts as the first line of defense for web-facing applications, providing virtual patching at the web layer.

How Avi WAF Prevents Exploitation

• Edge Defense: Avi WAF analyzes incoming north-south traffic, identifying and neutralizing OWASP Top 10 threats before they reach the application.
• Protocol-Aware Inspection: Its robust HTTP/HTML parser understands complex protocol features, ensuring that even obfuscated exploit attempts are caught within the application payload.

Examples of Vulnerabilities Protection

• SQL Injection (SQLi): Avi WAF virtually patches vulnerable databases by stripping malicious SQL commands from web entry fields. An example is CVE-2025-31044 in the Premium SEO Pack plugin of WordPress. Avi uses a pipeline-based security model to provide protection against SQLi at different stages of the incoming traffic.
• Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) : Avi WAF’s built-in CSRF (Cross-Site Request Forgery Protection) prevents attackers from injecting client-side scripts into web pages by sanitizing incoming requests. For example, Avi protects against the MCP inspector tool vulnerability (CVE-2025-49596) that exposes a new class of browser-based attacks against AI developer tools. 
• React2shell (CVE-2025-55182): Avi WAF blocks Remote Code Execution (RCE) attempts like Command Injection, Application Language Specific attacks, and also blocks attempts to include remote files (RFI) or local system files (LFI) that could lead to attackers to execute arbitrary commands on application server.

Avi WAF for Vulnerability Scanner to further Virtual Patching: Avi WAF provides an inbuilt SDK that can import Dynamic Application Security Testing (DAST) scanner results to construct the customized WAF policy to protect the application from security threats found by the scanner. Avi WAF supports Qualys Web App Scanning and OWASP ZAP Attack Proxy DAST scanner results.

The Avi Advantage:  Key differentiators for Avi WAF are its software-defined architecture, scale-out and full access to the Avi customer base.

• Unlike alternative WAF solutions that require a separate, expensive license, Avi WAF is available to all Avi customers as part of the Avi license. Essentially every Avi Load Balancer customer also has the built-in capability to secure their web applications by default. 
• Avi is also fully integrated with VCF, thus delivering plug-and-play operational experience and self-service load balancing and WAF – for both VM and Kubernetes (VMware Kubernetes Service – VKS) workloads.

Conclusion

In the era of AI-accelerated threat landscape, the “race to patch” has reached a breaking point. Organizations can no longer rely solely on eventual roll-out of code updates to stay secure. By leveraging vDefend Distributed IDPS for lateral virtual patching, vDefend DFW for lateral segmentation and Avi WAF for web application security, enterprises can implement a comprehensive private cloud cyber defense strategy. This multi-layered approach provides an immediate and comprehensive defense that blocks hackers from exploiting vulnerabilities, buying the IT team the critical time needed to maintain long-term application integrity.

To learn more about how to protect your environment from AI exploits, watch the following videos:

Multi-Layer Defense in the AI Era

Defeating AI-Accelerated Exploit Chains with vDefend Virtual Patching

The post Virtual Patching: Guarding Against a Tsunami of AI-discovered Exploits with vDefend and Avi appeared first on VMware Security Blog.

In a cloud-native environment, Kubernetes-based containerized orchestration has brought developer agility – but it has also fundamentally changed the security paradigm. Traditional “castle-and-moat” security designs that rely on a perimeter firewall are no longer enough to protect modern workloads. Once an attacker breaches that outer shell, the flat network architecture common in many Kubernetes environments allows them to move laterally with ease, potentially compromising many applications in their hunt for high-value assets to ransom. The cyber landscape is further exacerbated by recent cyberattacks that have halted business operations for weeks and months, causing massive financial losses (hundreds of millions of dollars or more) and the emergence of AI-driven autonomous attacks.

Bridging this lateral security gap with VMware vDefend is crucial for organizations leveraging vSphere Kubernetes Service (VKS) within VMware Cloud Foundation (VCF). The fact that vDefend is fully integrated with VKS and completely plug-and-play with VCF makes a comprehensive rollout of Zero Trust lateral protection across all VKS clusters operationally simple and fast. Businesses can finally implement a true Zero Trust security model consistently across Virtual Machines and Containers – the same policy model, the same management console and APIs, the same troubleshooting tools. The powerful combination of vDefend with VKS Clusters decouples security policy from static, ephemeral IP addresses and instead uses workload-based identity to enforce granular protection.

In a typical Kubernetes cluster, network identity is fleeting. Containers are designed to be short-lived; when a pod is terminated, and a new one is created, a completely different IP address is assigned. This “ephemeral” nature makes traditional IP-based firewall rules obsolete almost instantly, leading to administrative overhead or, worse, massive security holes.

The integration of VMware vDefend and vSphere Kubernetes Service (VKS) solves this by decoupling security from the networking layer. Instead of relying on static IPs, vDefend uses Antrea CNI, the default CNI with VKS, to enforce context-aware policies based on logical metadata – such as labels applied to namespaces, services, and pods. Because the security policy is tied to the workload’s identity rather than its IP address, the protection follows the Pod automatically, even as it scales or is recreated on a different node. Furthermore, this enforcement occurs at the immediate point of origin—the Pod interface for containerized workloads and the vNIC for Virtual Machines within the Hypervisor. This ensures that security is applied at the ‘first hop,’ neutralizing threats before they ever traverse the physical or virtual network. 

Unified Management: One Policy to Rule Them All

Operational silos, where separate security stacks have to be implemented for virtual machines and Kubernetes clusters, are a major hurdle in modern infrastructure, often leading to inconsistent protection and blind spots. vDefend addresses this by providing a unified security management solution for VMs and Kubernetes (VKS) workloads through a single pane of glass within VCF. This enables security administrators to define a global security posture that is consistently applied across the entire Supervisor cluster and all guest VKS clusters, without treating the VKS clusters as opaque entities.

Bridging the Gap: Securing the “In-Between”

The most critical vulnerability in modern architecture often lies at the intersection of different workload types. A typical application might host its frontend in a containerized VKS pod while keeping its mission-critical database on a traditional virtual machine. Traditionally, these two worlds lived in separate security boundaries, making inter-workload traffic difficult to monitor and secure. VMware vDefend bridges this critical gap. Because it is natively integrated into the ESXi hypervisor, vDefend can inspect traffic closest to the source, as it moves between a container and a VM – even if they are on the same host. This cross-workload security ensures that the “mixed-mode” applications are protected by a continuous zero-trust boundary, stopping lateral movements regardless of whether the threat is hopping from a pod to a VM or vice versa.

Control for Security Admins and Freedom for App Developers

In modern enterprises with Kubernetes workloads, security often becomes a shared responsibility between centralized security teams and application owners. While security teams typically define the organization’s overarching security model, application owners frequently control the security policies for their specific applications. While this ops model offers flexibility, it could create security gaps. vDefend addresses this by enabling security administrators and application owners to co-own container security policies through a central management view. Security administrators can control cluster-level firewall policies (ingress and egress traffic for a VKS cluster) to focus on environmental and infrastructure security. By utilizing vDefend’s distinct firewall categories, they can ensure these essential policies are always enforced first. Meanwhile, application owners retain complete autonomy to define application-tier Kubernetes networkPolicies without requiring explicit approval from security administrators. This collaborative approach ensures comprehensive protection across the board.

To truly understand the power of a unified security stack, it helps to look at how it handles real-world threats. By applying vDefend to VKS, administrators can move beyond broad “allow-all” rules and implement surgical precision in the security posture.

• Quarantining a Compromised Workload

One of the most important scenarios for a DevSecOps team is a “malicious-pod” – a container that has been compromised and is now attempting to scan the network for vulnerabilities and exfiltrate data. In a standard Kubernetes setup, this pod might have a “flat” path to every other service in the cluster. With vDefend firewall policies, you can execute a “Quarantine” strategy. By applying specific tags (e.g., quarantine = malicious) to the suspected pod, a high-precedence Emergency Category policy is instantly triggered. This policy overrides all other existing rules, immediately dropping all inbound and outbound traffic to the pod except for a secured connection to a “forensic pod” or a “jump host” for investigation. This drastically reduces the blast radius of the breach, stopping lateral movement before it starts.

• Hardening External Egress Traffic

In a Zero Trust environment, what goes out of your VKS cluster is just as important as what comes in. Many modern attacks, such as the Log4Shell exploit, rely on compromised workloads contacting malicious command-and-control systems. Protecting egress traffic in VKS is uniquely challenging because IPs are typically lost behind a generic Source Network Address Translation (SNAT) at the node. The solution is to leverage Antrea Egress to provide a stable, predictable identity for outbound traffic. By associating specific pods with an Egress IP, you can create granular vDefend firewall rules that allow only a specific production application to talk to an external database while blocking the rest of the cluster. This ensures that even if a workload is compromised, it cannot reach unauthorized external endpoints.

Future-Proofing with VCF and vDefend

By deeply integrating vDefend with VKS, the platform eliminates the traditional trade-off between developer agility and enterprise security.

Key Benefits for VCF Customers:

• Zero-Trust by Default: Organizations can now enforce a granular, Zero Trust model that covers the entire stack – from legacy virtual machines to ephemeral Kubernetes pods. This intrinsic security model stops ransomware and other sophisticated threats from moving laterally across your environment.
• Operational Simplicity: VCF and vDefend introduce a “single pane of glass” for policy management. Instead of juggling fragmented tools for container and VM security, administrators use a unified operational model that reduces the learning curve and eliminates manual configuration drift.
• Accelerated Time-to-Market: With self-service capabilities and automated policy orchestration, developers can spin up secured applications in minutes rather than months. Security is applied as soon as a workload is provisioned – security at the speed of apps, ensuring compliance from the very first packet without requiring tickets to multiple infrastructure teams.
• Deep Insights and Troubleshooting: The vDefend integration with VCF and VKS provides unparalleled insights into VM and container traffic flows. Features like Antrea Traceflow allow teams to synthetic-test their network paths, ensuring that every firewall rule functions as intended before an issue escalates.

Making VKS clusters vDefend Ready – video demo

Safeguarding your containerized workloads on VKS with vDefend shouldn’t be a complex hurdle. This video demonstrates just how simple it is to make the VKS cluster vDefend ready. By following the streamlined process, you can make your clusters vDefend-ready in minutes, unlocking powerful macro and microsegmentation capabilities. Whether you are managing existing deployments or spinning up new environments, this tutorial shows how remarkably easy it is to have your VKS cluster ready for vDefend.

Core insights from the video:

• Seamless Integration: Learn how the registration process acts as the “handshake” between your VKS cluster and vDefend
• Operational Simplicity: See firsthand that making a VKS cluster vDefend ready doesn’t require complex coding; it’s a straightforward workflow within the management console
• Automated Discovery: Discover how VKS namespaces, pods, and services are automatically recognized, enabling set-and-forget policies that scale as your cluster grows

Securing Modern Applications with VMware vDefend – video demo

Here is a video walkthrough of the simple steps for protecting modern applications deployed across a virtual machine environment and a VKS cluster. It showcases how robust security policies can be implemented in vDefend to prevent lateral movement between services in VKS clusters and also easily block unauthorized access to external systems from the VKS cluster.

Core insights from the video:

• Simplified Management: See how a single pane of glass with VKS and vDefend allows administrators to quickly and efficiently manage policies for both containerized workloads and virtual machine workloads
• Unified Security Policy: Understand how registering a VKS cluster allows you to apply consistent firewall rules across both traditional virtual machines and modern containerized workloads
• Egress Security: As mentioned above, Antrea Egress provides a stable, predictable identity for outbound traffic. This can be used to create granular vDefend firewall rules to allow only a specific service to communicate with an external database

vDefend is Key to a Secure and Agile Private Cloud

By adopting the models described above, VCF operators who deploy vDefend are building resilient, scalable, and automated security foundations. As applications continue to evolve into complex webs of containers and VMs, having a unified security layer is no longer just a “best practice” – it is the key to maintaining a secure and agile private cloud.

Further Reading:

Check out the detailed Securing vSphere Supervisor and VKS with vDefend reference design, which serves as both an architectural blueprint and a practical implementation handbook for using VMware vDefend security solutions. It offers essential design insights and security recommendations to enhance the protection of vSphere Supervisor and the mixed-form-factor workloads running on it: Virtual Machines, vSphere Pods, and VKS.

The post VMware vDefend: Zero Trust Lateral Security for Kubernetes Workloads on VCF appeared first on VMware Security Blog.