A step-by-step guide to calculating your security score, generating your first report, and turning it into a plan.

Modern intrusions hit their target immediately after breaking in. These attacks are prevalent since up to 80% of data center traffic moves east-west, server to server, out of sight of a perimeter firewall. They land on one low-value machine and move laterally until they reach something that matters.

The question most teams can’t answer quickly is: if one workload were compromised right now, how far could an attacker get?

The VMware vDefend Security Journey answers that question in a few clicks. It scores your real security posture based on observed traffic, then produces a report that tells you what to fix first. You don’t need agents, flow exports, or a spreadsheet.

The following is a practical walkthrough. You’ll get your first score, generate your first Security Assessment Report, learn to read it, and see how to use it to choose your next step.

Why Start with an Assessment

Most teams know they need segmentation and threat prevention. Three problems keep them from starting:

• No baseline. Without a current-state score, “are we more secure than last quarter?” is a guess.
• No prioritization. Firewall and IDS/IPS policy can go anywhere. Which workloads would create the biggest blast radius if they were compromised?
• No proof of progress. Stakeholders want to see security posture improve, not just a list of completed tickets.

The assessment gives you a baseline, a ranked list of projects, and a number you can re-measure later.

What You’ll Need

• A Security Services Platform (SSP) for vDefend instance with Security Intelligence enabled. A medium-form-factor SSP deployment with a trial license is enough to complete the full Security Journey.
• Workloads already sending traffic. The assessment analyzes observed flows, so the more history you have (in this example, 31 days), the more meaningful the results. Workloads connected via overlay and/or Distributed Virtual Port Groups (DVPGs) are supported.
• About 15 minutes of hands-on time, plus wait time while the score and report are calculated.

Step 1: Open the Security Journey

Log in to SSP and open the Security Journey from the main menu. The home page is your starting point for everything that follows.

The Security Journey is available from the main SSP navigation.

Step 2: Start at Stage 1, Assess Your Security Posture

The Security Journey is organized into stages. Stage 1 is the assessment, and it’s where every journey starts. This page shows your current Segmentation Score and Advanced Threat Prevention (ATP) Score, and it’s where you launch a new calculation.

Stage 1 is the assessment. Calculate your scores here, then generate a report.

Step 3: Calculate Your Scores

Select Calculate Score. A dialog asks you to choose a scoring mode.

The mode controls how strictly the assessment judges your existing policy.

Confirm, and the calculation starts. Depending on the size of your environment and the amount of flow data, this can take a few minutes.

SSP analyzes your flow data in the background. You can leave the page and come back

Step 4: Read Your Two Scores

When the calculation finishes, Stage 1 shows your results.

You will see two independent scores, each from 0 to 100:

Your first baseline. Everything from here is measured against it.

• Segmentation Score: how well the Distributed Firewall (DFW) is actually stopping unauthorized lateral traffic. It reflects DFW activation, infrastructure protection, environment protection, application workload protection, and exposure to obsolete operating systems and risky protocols.
• Advanced Threat Prevention Score: how well IDS/IPS, Network Traffic Analysis (NTA), and Network Detection and Response (NDR) cover the same workloads.

A low first score is normal. In our example, a fresh environment scored 7 for Segmentation and 25 for ATP, both rated Low. That’s a starting point, not a verdict.

Step 5: Generate the Security Assessment Report

The scores tell you where you stand. The Security Assessment Report tells you why and what to do about it. From Stage 1, open Security Assessment Reports and choose to generate a new one.

The Generate Report dialog lets you name the report and confirm the analysis period.

Give it a descriptive name, such as “Baseline – [Month Year]”, so you can recognize it when you compare reports later. Reports take a few minutes to build.

When the status shows Completed, download the PDF.

Step 6: Read the Report 

The report is long, but you don’t need to read it front to back. This is the order that gets you to answers fastest.

The cover. Check the report period

Note the Report Name, Report ID, and Report Period. Everything in the report is based on traffic seen in that window. When you compare reports later, make sure the periods are comparable.

The Executive Summary. Where the points are.

This one page is the report in miniature. It shows the environment facts (days analyzed, unique flows, VM count, software versions) and both scores, divided into weighted factors with points earned against the maximum.

Turning features on earns a few points. Applying policy earns the rest.

The lesson in our example data: activating DFW and IDS/IPS earned the easy points, but the heavily weighted factors (infrastructure, environment, and application protection) were all zero, because no policy covered those workloads yet.

The Posture Overview. How bad could it get?

This page puts numbers on risk: at-risk workloads, at-risk lateral movement chains, and blast radius, which is how many other workloads an attacker could reach from a compromised one. The accompanying chart makes the point visually. In our example, just two VDI servers had a blast radius of 101 other workloads.

Blast radius shows why a few workloads deserve attention first.

Zero campaigns and zero anomalies mean NDR hasn’t seen active attacks. The exposure is potential, not confirmed compromise.

Recommended Projects. Your to-do list.

This is the most actionable page. The report turns the gaps into ranked projects scoped to your environment, with real workload and flow counts:

1. Secure External Communications: workloads talking to the internet.
2. Secure Infrastructure Services: DNS, NTP, AD and similar services everything depends on.
3. Secure Application Workloads: critical and regular business applications.
4. Isolate VDI Servers: high-value entry points.
5. Secure Obsolete Operating Systems: unpatched legacy systems that can’t be fixed, only contained.

Each card has a Go to Security Explorer or Go to Policy Planning link, so you go straight from finding to fix.

The report ranks your next projects by risk.

Each project also has a detail page. Two examples worth a screenshot:

The Appendices. How to earn more points.

If you want to know exactly why you scored what you did, Appendix B (Segmentation) and Appendix C (ATP) break every factor into sub-checks with the exact configuration needed for full credit, such as a default Layer 3 deny rule or an IDS/IPS rule in Detect or Prevent mode. Treat them as your checklist.

The appendices turn the score from a black box into a checklist.

Step 7: Pick Your Next Move

You now have a baseline and a ranked list. The Security Journey continues from Stage 1 with guided workflows, so you don’t have to design the plan yourself:

• Segmentation path (DFW 1-2-3-4): deploy Zero Trust microsegmentation in stages, starting with the infrastructure and environments the report flagged.
• Threat prevention path (ATP 1-2-3): apply IDS/IPS coverage to vulnerable workloads, infrastructure services, and application workloads. In our testing, completing this path alone raised the ATP score from 25 (Low) to 64 (Medium) with no DFW changes.

The two layers are independent and additive, so you can start with whichever matches your team’s priorities. Use the Recommended Projects to decide: start where the blast radius is largest.

Links to each guide are in Additional Resources below.

Step 8: Re-run the Report and Show Progress

After you’ve completed a project, calculate your scores again and generate a new report. Compare it with your baseline report: same environment, same method, a higher score, and a smaller blast radius. This is the evidence your security and compliance stakeholders want.

A good rhythm is to regenerate after each completed project, or monthly.

Summary

Getting started takes three actions: calculate your scores, generate the report, and work on the top-recommended project. The Security Assessment turns “we should improve our lateral security” into a scored, prioritized, repeatable plan, and it proves progress in your next export.

Try It Yourself

Deploy a medium form factor Security Services Platform (SSP) instance with Security Intelligence enabled. The full Security Journey, including the Security Assessment Report, DFW 1-2-3-4, and ATP 1-2-3, is available with a trial license.

1. Deploy the SSP in a medium form factor, featuring an integrated 90-day evaluation mode.
2. Connect SSP to NSX Manager (4.2.x or 9.x supported)
2. Enable Security Intelligence.
3. Open Security Journey, calculate your scores, and generate your first report.
4. Work on the top-recommended project, then rerun the report.

No licensing is required for the first 90 days in built-in evaluation mode; after that, it requires a License Hub for vDefend.

Additional Resources

• VMware vDefend Security Assessment
• VMware vDefend 1-2-3-4 for Advanced Threat Prevention
• vDefend DFW 1-2-3-4: Deploy Zero Trust Microsegmentation in a Few Weeks
• VMware vDefend IDPS: Securing Private Cloud Workloads in the Age of Frontier AI
• Product documentation: Security Segmentation Report
• On-demand webinar – Segmentation Assessment
• VMware vDefend Hands-on Labs

The post Know Your Lateral Security Risk in an Afternoon: Getting Started with the vDefend Security Assessment appeared first on VMware Security Blog.

Securing the control plane that your Kubernetes strategy depends on.

As enterprise containerization accelerates on VMware Cloud Foundation (VCF), the vSphere Supervisor becomes the central focal point of both operation and platform risk. Securing tenant applications alone is insufficient – organizations must safeguard the infrastructure and control plane beneath them. VMware vDefend delivers a multi-layered, VCF private cloud-native security stack, extending zero-trust defense from control plane management interfaces down to individual virtual machines and container workloads.

Kubernetes is central to how modern enterprise applications are delivered. On VCF, the vSphere Supervisor makes this possible by serving as the management control plane that converts developer requests into running vSphere Kubernetes Service (VKS) clusters, Virtual Machines (VMs), and containers at business speed. However, that speed carries a concentration of risk. Sitting directly between core virtualization infrastructure and managed workloads, a potential compromise of the Supervisor can expose both the control plane and workloads simultaneously. As a high-value enterprise asset, it requires dedicated infrastructure-level protection.

This post outlines why Supervisor control plane protection is critical and how vDefend delivers zero-trust security across the Supervisor, native Services, vSphere Namespaces, and VKS clusters, referencing detailed architectural blueprints. Importantly, the design patterns covered in this blog are completely Container Network Interface (CNI) agnostic. 

Detailed architectural materials live in the Design Library for vDefend.

Furthermore, the complete design guide expands on this foundation by providing blueprints specifically tailored to securing containerized workloads within VKS clusters running Antrea CNI.

Why does it matter

The Supervisor is a high-value asset in the VCF private cloud

While security focus typically centers on guest applications, the Supervisor requires priority protection for four strategic reasons:

• Gateway to Infrastructure: The Supervisor Control Plane VMs connect directly to vCenter, ESX hosts, NSX Manager, and other VCF management components. An attacker who gains control of these VMs can move laterally across the VCF management plane.
• Platform-Wide Impact: vSphere namespaces, VKS clusters, VMs, and containers are provisioned and managed via the Supervisor. A breach here is a multi-tenant, platform-wide event, not a single-application incident.
• Exposed by Design: Although the Supervisor API possesses built-in authentication and authorization capabilities, it remains exposed at the network level because it accepts incoming connections by default to accommodate developers, CI/CD pipelines, automated tools, and downstream clusters.
• Intersection of Trust Boundaries: Management traffic, workload traffic, platform services, and VKS clusters API calls converge at the Supervisor. Each connection path represents a trust boundary requiring strict governance. The Supervisor requires infrastructure-level protection that application teams cannot accidentally disable or modify.

The Infrastructure Provisioned by the Supervisor is permissive by default 

The Supervisor provisions VPCs, vSphere Namespaces, VKS clusters, VMs, and vSphere Pods on demand. Operational teams frequently assume that structural separation implies network security – it does not:

• Logical boundaries are not security barriers: Virtual infrastructure network segmentation establishes logical boundaries, but it does not inherently block communication. Without explicit firewall enforcement, workloads in different namespaces remain fully reachable across the network.
• Intra-VPC east-west traffic goes unchecked: Traffic flowing between workloads within the same VPC is routed in a distributed manner and never traverses a VPC perimeter gateway. A single compromised workload can easily serve as a pivot point to adjacent systems, significantly expanding the blast radius of a breach.
• Network address translation (NAT) obscures source identity: VPC Gateways and Load Balancers apply source NAT (SNAT), stripping the original client IP. As a result, the source identity is lost, leaving firewall enforcement points at the destination unable to reliably verify the origin, but only L4/L7 services. Access control must be enforced at the appropriate policy layer before translation occurs.
• Unmonitored open access creates compliance blind spots: Lacking explicit zero-trust policies, the Supervisor Control Plane VMs, platform services, and provisioned workloads accept far more incoming connections than intended—with no audit log recording allowed or denied traffic.

A perimeter firewall alone cannot eliminate these internal exposures because it has zero visibility into east-west traffic moving between workloads inside the platform. Closing these gaps requires two complementary, infrastructure-native security controls operating under a strict Zero-Trust (“permit only what is required”) posture.

vDefend Security Framework for Supervisor and VKS

Supervisor Control Plane Protection

The Challenge: The Supervisor control plane links VCF management components with endpoints that users and automation entities consume to deliver applications. Without a proper security segmentation, a compromised workload could probe the control plane interfaces and pivot into underlying infrastructure management components.

The Solution: vDefend distributed firewall (DFW) can segment and secure the Supervisor’s two primary networks independently:

• Management Network: Restricts traffic communicating with vCenter, ESX hosts, NSX Manager, and VCF management services to explicitly documented paths.
• Workload Network: Governs access to the Supervisor API and supporting infrastructure for vSphere Namespaces, VKS clusters, and VMs. Unapproved traffic is blocked and logged.

Key Outcomes:

• Reduced Attack Surface: Restricts network access strictly to required operational connections.
• Proactive Threat Detection: Denied connection logs provide immediate audit telemetry to detect and investigate potential threats.
• Scalable Policy Enforcement: Firewall rules automatically track control plane components during scaling-out or vMotion activities.

Design Blueprint: Secure the Supervisor Control Plane | Supervisor Management Network | Supervisor Workload Network | Secure VKS cluster control plane

Supervisor Services Security

The Challenge: System services inside the Supervisor automate platform lifecycle management, resource provisioning, keep configuration consistent, collect operational metrics, and more. They enable self-service and often hold broad privileges. A possibly compromised service creates a high-impact vector.

The Solution: Least-privilege Distributed Firewall (DFW) rules are applied to each Supervisor Service. Only authorized components requiring access can communicate with a specific service—and vice versa—while all other inbound and outbound traffic is blocked and logged. The design pattern directly accounts for VPC load balancing and NAT transformations to ensure security policies are enforced exactly as intended.

Key Outcomes:

• Supervisor Services Containment: Prevents initial compromise of one service from escalating into lateral movement across others.
• Operational Transparency: Provides clear visibility into expected vs. anomalous services communication.

Design Blueprint: Secure Supervisor Services

Supervisor API Access Protection

The Challenge: By default, the Supervisor and VKS Clusters API are reachable from any source by platform administrators, developers, and automation tools. These Kubernetes API server communications are just as critical, and they must remain protected against external probing or accidental disruption during administrative operations.

The Solution: API access is restricted to authorized sources – such as administrative jump hosts and trusted management systems – and enforced upstream using Transit Gateway or VPC Gateway firewall policies. Enforcing policies before traffic reaches the Load Balancer Virtual Service ensures inspection occurs before SNAT to obscure the original client identity. Where possible, this is implemented centrally at the Transit Gateway to provide a single, auditable point of governance. Clusters retain their required operational access, while all unauthorized traffic is blocked and logged.

Key Outcomes:

• Prevention at the front door: Unauthorized API requests are blocked before reaching platform endpoints.
• Centralized governance: One policy point is simpler to audit and operate than many.
• Security that preserves agility: Critical control plane paths stay reliable, and application teams keep their pace.
• Accountability: Logged denials record who attempted to reach the Supervisor API, and when.

Design Blueprint: Protect Supervisor API

vSphere Namespaces Isolation

The Challenge: vSphere Namespaces separate customer applications, projects, tenants, departments, or environments. Network subnets segmentation and standard IP routing do not provide security isolation on their own; workloads in different namespaces can communicate unless blocked by firewall policy. 

The Solution: Dedicated DFW policies are applied to each vSphere Namespace. Intra-namespace traffic flows unrestricted, while inter-namespace communication is blocked by default unless a service is explicitly published. This design pattern operates seamlessly whether namespaces share a single VPC or are deployed in distinct VPCs, accounting for private subnet SNAT behavior and ensuring authorized services remain reachable without compromising isolation.

Key Outcomes:

• Blast Radius Containment: A breach in a development namespace cannot pivot into production.
• Verifiable Multi-Tenancy: Separation between business units or environments is enforced via strict firewall segmentation, not just by convention.
• Intended access preserved: Isolation does not interrupt applications that are meant to be exposed.

Design Blueprint: vSphere Namespace Isolation

VKS Clusters Isolations

The Challenge: A single vSphere namespace can host multiple VKS clusters, VMs, containers, and data services. Traffic inside a VPC flows unrestricted by default: workloads attached across different VPC subnets (such as Private-VPC, Private-TGW, or Public) can communicate freely without traversing or being inspected by the VPC Gateway firewall. A misconfiguration, privilege escalation, or malicious workload can become a foothold, allowing lateral movement between adjacent workloads.

The Solution: DFW segmentation is enforced at the cluster boundary to individual VKS Nodes (VMs). The policies are built on the vDefend platform’s tagging and grouping model, so provider and tenant administrators can manage them with familiar tools. External ingress passes strictly through load balancers on approved ports.

Key Outcomes:

• Zero-Trust: Prevents lateral movement between adjacent VKS clusters
• Unified Operations: A single policy pane governs VKS clusters, VMs and containers, using a familiar toolset.
• Security Posture Governance: Infrastructure-level enforcement complements Kubernetes-native controls and can’t be switched off by an application team by accident.

Design Blueprint: Secure resources within a vSphere Namespace

Conclusion

The vSphere Supervisor and vSphere Kubernetes Service are now core of the VCF private cloud infrastructure. Securing the applications running on top while leaving the control plane exposed is a risk modern platforms cannot afford.

Delivered natively within VMware Cloud Foundation, vDefend integrates both DFW and GFW solutions to protect the Supervisor control plane and its dynamically provisioned workloads.

Your teams don’t need to design this from scratch. The vDefend Design Library provides the groups, rules, and rationale for each layer, so you can start with the area of greatest concern and build outward.

Additional Resources:

• VMware vDefend: Zero Trust Lateral Security for Kubernetes Workloads on VCF
• Mastering Cybersecurity with VMware vDefend and Avi via Hands-on Labs
• Leveraging GenAI for Simplifying Zero Trust and Accelerating Threat Defense in VMware vDefend

The post Protecting the vSphere Kubernetes Control Plane: Architecting Zero Trust for Supervisor and VKS with vDefend appeared first on VMware Security Blog.

The global threat landscape shifted dramatically today following the disclosure of PHP2Shell, a pair of critical Remote Code Execution (RCE) vulnerabilities tracked as CVE-2026-109618 (OOM memory corruption) and CVE-2026-109619 (stale global state). Both carry a CVSS score of 9.2 and affect core memory handling across decades of PHP releases.

NOTE: VMware vDefend, VMware vDefend Security Services Platform (SSP) and VMware Avi Load Balancer are not impacted by these vulnerabilities. For more information, see the KB articles below: vDefend | Avi

This blog covers how you can leverage vDefend and Avi to protect against PHP2Shell vulnerability exploits.

Because PHP powers a vast portion of the modern web, from major enterprise portals to modern microservices running in containerized environments, the fallout was immediate. Across Europe and beyond, government agencies, cybersecurity organizations, and enterprise IT teams took the unprecedented step of taking critical web applications and public portals completely offline as a precautionary measure while scrambling to apply emergency updates. Pulling systems offline buys time in a crisis, but a long-term defense strategy requires controls that keep applications protected without forcing unnecessary downtime.

In this post, we highlight how: 

• VMware vDefend Gateway Firewall can block the PHP vulnerability via virtual patching
• VMware Avi Load Balancer (Avi WAF) can block the PHP vulnerability via virtual patching

Additionally, vDefend DFW micro-segmentation along with ATP across internal workloads can deliver live network-level visibility stopping PHP2Shell exploits without requiring application downtime or immediate code modifications.

NOTE: Virtual Patching is the ability to apply a network-based mitigating control to vulnerable workloads, without needing to take those workloads offline, enabling immediate protection while the software patch can be applied safely during a maintenance window.

The Anatomy of the PHP2Shell Crisis

The PHP2Shell vulnerability duo breaks basic assumptions about how web servers manage request memory during unexpected failures:

1. CVE-2026-109618 (Out-of-Memory Corruption): Triggered when a request crosses PHP’s memory_limit during operations like multipart file uploads. The memory abort mechanism (longjmp()) leaves internal request data partially initialized. Cleanup routines subsequently parse uninitialized heap memory controlled by the attacker, allowing unauthenticated execution before any application logic ever executes.
2. CVE-2026-109619 (Stale Global State Execution): Caused when fatal errors leave module-level global pointers pointing to per-request heap space that was already freed. Subsequent requests handled by the same worker process execute against that stale memory space.

Because an unauthenticated request can trigger memory corruption before application code even executes, traditional web application input sanitization is insufficient.

The PHP Visibility Problem: You Can’t Patch What You Don’t Know Exists

The primary reason organizations resorted to taking their websites offline today stems from a fundamental visibility gap.

Over the years of software development, PHP has been embedded into legacy enterprise portals, third-party vendor appliances, custom utility microservices, and containerized internal dashboards. Traditional static asset inventories miss many of these instances, leaving security teams facing critical questions during a crisis:

• Where across our multi-cloud fabric are vulnerable PHP instances actively running?
• Which services are directly exposed to north-south internet traffic vs. east-west internal networks?
• How do we prioritize patching without breaking business continuity?

Relying on scheduled patch deployments forces teams into a binary choice: leave vulnerable instances exposed to automated AI-driven scanning or shut down public operations entirely.

VMware vDefend Gateway Firewall (GFW) with TLS Decryption

Because PHP2Shell attack payloads arrive over encrypted HTTPS channels, deep threat inspection requires decrypting the payload at a control boundary. VMware vDefend Gateway Firewall (GFW) equipped with TLS Inspection (Decryption) serves as the critical enforcement point to inspect, unmask, and virtually patch encrypted traffic.

Protecting Inter-Segment Traffic

Threats like PHP2Shell are rarely confined to initial north-south ingress. Attackers use compromised internal jump-boxes or unmanaged web microservices to pivot laterally across network subnets. vDefend GFW acts as an inter-segment gateway firewall. By placing GFW with TLS Decryption at Tier-0 and Tier-1 gateway boundaries between internal application zones, organizations ensure that encrypted east-west traffic moving across network segments undergoes full payload inspection.

Instant Activation for Existing NSX Customers

For organizations already utilizing NSX networking, the operational friction to enable this level of protection is virtually zero. Because NSX Edge Nodes are already deployed in your environment to handle gateway routing, enabling vDefend GFW with TLS Decryption requires no architecture changes, extra appliance provisioning, or network re-plumbing. Administrators simply enable TLS Inspection policies directly on the existing Tier-0/Tier-1 Gateway Firewalls to start decrypting and inspecting inbound and inter-zone encrypted traffic.

Dedicated IDPS Signatures for PHP2Shell Virtual Patching

Once traffic is decrypted at the Gateway Firewall, vDefend’s integrated IDPS engine inspects the unencrypted HTTP payload stream. To address the PHP2Shell threat immediately, VMware Threat Analysis Unit has officially released a number of IDPS signatures for real-time virtual patching:

• Exploitation Prevention for CVE-2026-109618 (OOM Memory Corruption):
  To block unauthenticated exploit attempts targeting the memory-allocation abort flaw during large or malformed HTTP requests, vDefend enforces signature IDs 1156209, 1156228, 1156229, 1156230, and 1156231.
• Exploitation Prevention for CVE-2026-109619 (Stale Global State Execution):
  To detect and intercept malicious payloads attempting to leverage dangling global module pointers across PHP worker process lifecycles, vDefend enforces signature IDs 1156232 and 1156235.
• INFO-Mode Behavioral Detectors for Threat Analysts:
  In addition to active blocking signatures, vDefend provides specialized INFO-mode (behavioral) detectors to grant security operations center (SOC) analysts deep visibility into anomalous PHP request patterns and early-stage reconnaissance across the network fabric:
  – Signature #1156210: Suspicious PHP SessionUploadProgress Request
  – Signature #1156233: Suspicious HTTP Request to a PHP Server
  – Signature #1156241: Suspicious HTTP Request to a PHP Server

By deploying GFW with TLS Decryption across network boundaries and enabling this full spectrum of active blocking rules (#1156209, #1156228–1156232, #1156235) alongside INFO-mode detectors (#1156210, #1156233, #1156241), security teams achieve instant virtual patching against CVE-2026-109618 and CVE-2026-109619 while arming threat hunters with real-time detection telemetry, all without taking web applications offline or making emergency source code modifications.

For more information, refer to the vDefend Threat Intelligence portal and the Broadcom KB article.

Stopping Web Exploits with Avi WAF

 VMware Avi Load Balancer (Avi WAF) acts as an intelligent barrier for your public as well as internal web applications.

1. Real-Time Version Discovery

Avi WAF continuously parses live HTTP/S traffic streams. By analyzing header signatures (Server, X-Powered-By), Avi can help identify vulnerable versions of your PHP-based application. 

2. Virtual Patching

Instead of waiting weeks for software regression testing, administrators can push targeted virtual patches at the load balancer layer within minutes. Avi WAF inspects incoming HTTP payload structures, multipart headers, and field lengths to drop exploit payloads before they touch backend application workers.

3. Payload De-obfuscation & Request Normalization

Attackers routinely obfuscate PHP RCE requests using double URL-encoding, base64 wrappers, or nested string concatenations. Avi WAF normalizes and decodes HTTP request bodies, headers, and query strings in real time, exposing malicious memory-manipulation attempts.

Avi WAF can provide protection against PHP vulnerabilities with the following controls:

1. 1. CRS Rules enforcement as part of Avi WAF Policy:
      
      • Rules 920170 & 920180 (Multipart Request Anomalies): Inspects multipart payloads and headers to mitigate exploit attempts.
      • Rules 920370 & 920380 (Header and Argument Thresholds): Limits headers and parameters to prevent out-of-memory denial of service.
      • Rules 932100–932200 (Remote Command Execution): Detects OS shell injection patterns like /bin/sh invocation.
      • Rules 933100–933190 (PHP Application Attacks): Evaluates request streams to block rogue PHP code execution.
        
   2. Also enable Avi Virtual Patch via CVE-specific rules in Enforcement mode. The rules are available at https://knowledge.broadcom.com/external/article/460068.
   3. As a best practice, enable Avi IP Reputation to block traffic from malicious IP addresses.

Zero Trust Micro-Segmentation & Containment: VMware vDefend DFW & ATP

Virtual patching blocks known exploit vectors, but modern resilience requires containing post-exploitation activity if an unmanaged or internal asset is breached. VMware vDefend Distributed Firewall (DFW) and Advanced Threat Prevention (ATP) provide the necessary containment and behavioral defense.

Distributed Firewall (DFW): Micro-segmentation & Zero Trust Isolation

Operating directly inside the hypervisor kernel at every workload’s virtual NIC, vDefend DFW enforces strict least-privilege micro-segmentation:

• Blast Radius Reduction: Web applications running PHP are strictly isolated. Even if a local web shell is dropped on a PHP host via an unmanaged vector, DFW blocks the workload from scanning, probing, or communicating with database tiers, internal APIs, or domain controllers.
• Strict Egress Rules: Prevents compromised workloads from initiating outbound connection attempts to unauthorized internal subnets. 

Advanced Threat Prevention (ATP): Post-Exploitation & C2 Defense

For novel exploit variants or evasive execution paths, vDefend ATP delivers multi-layered behavioral analysis:

• Automated Sandboxing: Suspicious file uploads or dynamic payloads executed by web processes are mirrored to the vDefend Sandbox for on-premises dynamic detonation and behavioral analysis.
• C2 & Reverse Shell Blocking: Network Detection and Response (NDR) continuously monitors traffic for anomalous outbound callbacks. If an exploited PHP process attempts a command-and-control (C2) callback or reverse shell, ATP blocks the connection and isolates the workload instantly.

Summary 

The table below summarizes virtual patching and additional protection delivered through VMware vDefend and Avi WAF.

Related Resources & Signature Links

• Broadcom KBs on PHP issues Impact Evaluation: vDefend | Avi
• VMware vDefend IDPS Signatures | Virtual Patching Blog | Virtual Patching Demo 
• Virtual Patching: Guarding Against a Tsunami of AI-discovered Exploits with vDefend and Avi
• NIST CVE Dictionary: CVE-2026-109818 | CVE-2026-109819

The post Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAF appeared first on VMware Security Blog.

While organizations continue to advance their zero trust lateral security initiatives, routine firewall operational and troubleshooting tasks frequently tie up limited IT resources – consuming time, introducing risk and hindering business agility. Additionally, modern security operations face significant challenges in analyzing and correlating complex security alerts, which often lead to visibility gaps, high false-positive rates, and delayed incident responses.

To accelerate lateral security operations and reduce operational downtime, VMware introduced an AI Assistant for VMware vDefend, a GenAI-powered assistant embedded directly into the platform. This simplifies security operations, expedites firewall troubleshooting, and streamlines threat analysis through natural language interactions. 

The Three Pillars of Intelligence

Figure 1: AI Assistant for vDefend

The solution structures its core capabilities into three primary insight engines:

1. Knowledge Insights

Delivers version-specific, authoritative guidance for firewall planning, configuration best practices, design scale limits, and root-cause alerts based on official VMware documentation, reference architectures, and knowledge base articles. It helps answer questions. It helps answer questions regarding how to create firewall configurations according to best practices, such as Firewall Group and Tag creation, ApplyTo field usage, and CLI host troubleshooting commands.

2. Operational Insights

Provides AI-generated insights based on live firewall configurations, real-time policy violations, and firewall alerts, making it easy to detect shadowed rules and traffic bottlenecks.

3. API Insights

Translates UI screens and administrative intent into REST API calls for vDefend and SSP, offering full UI contextual awareness and powering seamless API Insights to facilitate the automation of firewall tasks.

Activating AI Assistant for vDefend

Operating natively within Security Services Platform for vDefend (SSP 5.2), the AI Assistant for vDefend provides an embedded chat interface accessible directly from any operational screen without requiring a browser plugin. AI Assistant for vDefend requires internet connectivity for two purposes:

1. AI Assistant for vDefend leverages a Large Language Model (LLM), including Google Gemini and Microsoft Azure OpenAI, which understands, summarizes, and generates content in response to user prompts. The system enforces strict data privacy boundaries:

Data is sent to the cloud only after your explicit consent. Any transmitted data is used strictly to answer your specific prompts.

Your data is never used to train or retrain the underlying LLM, and the LLM does not persist your data.

2. AI Assistant for vDefend can periodically download new AI Assistant bundles from vDefend Threat Intelligence Service (VTIS). These bundles contain updates to vDefend technical documentation, knowledge base articles, and APIs for operational insights.

Figure 2: AI Assistant for vDefend High-Level Architecture

Using AI Assistant for vDefend for Firewall Monitoring and Troubleshooting

To streamline firewall operations, AI Assistant for vDefend provides version-aware design guidance and offers real-time API and configuration insights to improve security operations efficiency.

Before introducing new security policies across production hosts, the infrastructure team can utilize the AI Assistant to validate system limits, assess the operational health of the firewall components, and run host capacity checks prior to enabling IDPS Turbo Mode.

• Prompt: “Run a DFW health check.”

The AI Assistant runs pre-checks, inspects host CPU/memory allocations, kernel states, and software builds, surfacing open alarms and rule anomalies, and providing operational clearance or clear failure details before enabling IDPS Turbo Mode. Admins can also query about scale enhancements between vDefend versions or request guidance on group cleanup.

When faced with a ticket inquiring why a particular virtual machine cannot talk to another, the security administrator can utilize the AI Assistant to investigate lateral communication paths and verify that the Firewall is not contributing to the problem. Instead of filtering through raw IPFIX flow tables or logs, the security administrator simply prompts:

• Prompt: “Can you show me a flow graph of what LON.PROD.IT.VDI.14 has been talking to over the last 30 days?”

The AI Assistant renders a dynamic flow visualizer mapping active connections from LON.PROD.IT.VDI.14 and evaluates effective DFW rules to confirm exact drop/allow reasons. 

Security administrators can also use AI Assistant for reviewing and optimizing their firewall rules. For example, they can generate reports on rule-hit count trends over a 30-day timeline to highlight stale or shadow rules.

• Prompt: “Show me the hit count trend for DFW rules over the last 30 days.”

For organizations planning to use vDefend APIs to build automation scripts for firewall configuration tasks, or to create their own custom monitoring dashboards for firewall operational health, the AI Assistant for vDefend can speed up the process of finding the right APIs for the task based on the specified automation goals. 

As an example, a developer who wants to build a custom dashboard can prompt the AI Assistant directly from the active UI dashboard:

• Prompt: “I want to build a similar dashboard as top 5 hit rules, what APIs were used on this page?”

The AI Assistant inspects the active UI context and outputs exact REST API endpoints, request paths, parameters, and JSON response bodies for vDefend and SSP APIs, ready to paste into Ansible or Python automation playbooks.

Using AI Assistant for vDefend for Threat Defense

In addition to firewall operations and troubleshooting, AI Assistant for vDefend can also enable Security Operations Center (SOC) analysts to correlate complex detection signals and investigate multi-context threat campaigns through a unified, GenAI-assisted interface.

By transforming technical detection data—such as Data Exfiltration or ransomware signatures—into plain-English explanations, the assistant allows virtualization, network security, and SOC teams to rapidly grasp the scope, attack chain, and impact of active threats across workloads. 

• Prompt: “Explain this campaign to me.”

Beyond plain-language explainability, AI Assistant for vDefend – Threat Defense streamlines incident response through automated remediation workflows and a collaborative user experience. When security events are confirmed as true positives, the AI Assistant recommends tailored mitigation strategies—ranging from targeted interventions to comprehensive network isolation—while ensuring security experts retain final oversight before policies are enforced. With features such as chat exports, prompt recommendations, and multi-user workflow management, the assistant democratizes threat hunting and accelerates defense posture without requiring complex point-product integrations.

Conclusion

AI Assistant for vDefend empowers security teams with Generative AI assistance to optimize lateral security operations. Get started with AI Assistant for vDefend to realize the following benefits for simplifying zero trust security and accelerating threat defense:

• Improves user experience – interact in simple natural language for firewall troubleshooting
• Enhances operational visibility – instant access to detailed operational insights
• Reduces incident response time – threat explainability and proactive identification of threat remediation actions

By integrating intelligent capability natively within the platform, it streamlines day-to-day firewall troubleshooting and accelerates threat investigations and remediations. 

Learn More

• Video: AI Assistant for VMware vDefend – Firewall Demo
• GenAI HOL: Hands-on Lab HOL-2770-05 – AI Assistant for vDefend
• All HOL: vDefend and Avi Update Labs
• Blog: VMware vDefend Advances Multi-Layer Lateral Security, Deployment Automation and Performance for the Frontier AI Era
• Techdoc: Broadcom Technical Documentation: AI Assistant for VMware vDefend

Special thanks to Stijn Vanveerdeghem for his support and contribution.

The post Leveraging GenAI for Simplifying Zero Trust and Accelerating Threat Defense in VMware vDefend appeared first on VMware Security Blog.

Cybersecurity Awareness Month is underway, and the rapid growth of generative AI makes robust defense strategies more critical than ever. Organizations must move beyond basic awareness to build practical, active defenses that protect their VMware Cloud Foundation (VCF) private clouds from increasingly sophisticated, AI-driven threats.

To help you strengthen your security posture, VMware is excited to introduce an updated series of VMware vDefend and Avi Cybersecurity Hands-on Labs. These interactive labs offer actionable frameworks and practical walk-throughs designed to give you direct experience safeguarding your VCF environments against modern cyber risks.

Connecting Theory to Hands-on Learning

Have you ever found it challenging to translate network security theory and concepts into practical, hands-on experience as a Network Security Engineer, SOC Analyst, or Platform Administrator? 

This challenge is the reason why VMware developed the vDefend and Avi Security Hands-On Labs (HOL). Across these labs, you will learn to secure VMware Cloud Foundation with VMware solutions:

• Micro-Segmentation & Zero Trust: Gain granular visibility into lateral traffic flows and enforce zero-trust security policies down to the individual workload level.
• Advanced Threat Prevention: Detect and analyze active threats using integrated intrusion prevention (IDS/IPS), Network Traffic Analysis (NTA), and behavioral analysis.
• Modern Load Balancing & Network Modernization: Transition seamlessly to software-defined load balancing to optimize application performance, availability, and traffic management.

Learn at Your Own Pace with Hands-on Labs 

You’re in the driver’s seat! Tackle targeted scenarios to solve immediate technical challenges, or follow a structured, step-by-step track to build total operational mastery. 

Figure 1: The recommended vDefend HOL Learning Path

Starting with foundational firewall protection with DFW 1-2-3-4 and progressing to Advanced Threat Prevention ATP 1-2-3 with Virtual Patching to secure your VCF Infrastructure and Workloads, this progressive path lets you pick your own adventure.

• HOL-2770-01: Firewall Security Journey with DFW 1234, ATP 123 
  Estimated Time: ~1.5 Hours
  What you will learn: Master Zero Trust across the greenfield or brownfield of your VCF private clouds! Walk through the vDefend Distributed Firewall (DFW) 1-2-3-4 workflow to progress from core infrastructure protection to full application micro-segmentation. Next, learn ATP 1-2-3, new guided workflow that accelerates the deployment of Advanced Threat Prevention (IDPS, NTA, NDR) from months down to weeks. Lastly, learn how to leverage AI Assistant for vDefend – Firewall (click here for this AI Assistant lab) to accelerate troubleshooting workflows and streamline day-to-day firewall administration.
• HOL-2770-02: Firewall with Advanced Threat Prevention and Virtual Patching
  Estimated Time: ~1.25 Hours
  What you will learn: Stop exploit attempts in their tracks. Discover how VMware vDefend’s virtual patching instantly shields vulnerable workloads at the network edge—protecting them long before traditional patches can be applied. You will also learn how leveraging correlated threat detection and campaign across IDPS, NTA, and NDR shortens incident response times.
• HOL-2770-03: Secure VCF Infrastructure with vDefend Firewall
  Estimated Time: ~0.5 Hours
  What you will learn: Your VCF environment is only as secure as the infrastructure underneath it, so this lab starts there. You will follow best practices for securing VCF with vDefend, enable the predefined security policies, and see exactly how those policies protect your environment. It is the short lab in the series and a great first win to help you finish with a hardened VCF foundation of how vDefend policy protects it.
• HOL-2740-01: Security & Advanced Ingress Capabilities with vDefend & Avi for VKS
  Estimated Time: ~1.25 Hours
  What you will learn: Containers move fast. Your security has to keep up. In this lab, you will learn how to integrate VMware Avi Load Balancer and VMware vDefend with VMware Cloud Foundation (VCF 9.1) Kubernetes Services (VKS). Understand how full defense-in-depth is implemented for VKS clusters with east-west lateral security covering namespace isolation, service isolation, and cross-workload (K8s to VM) egress security with VMware vDefend.

Figure 2: The recommended Avi HOL Learning Path

Avi Load Balancer with Security at Scale for your VCF Infrastructure (see below) 
Estimated Time: ~2.0 Hours

What you will learn: Take VMware Avi Load Balancer for a spin across VCF. Four hands-on labs take you from first install to global scale and migration, with time in Controllers, Service Engines, and NSX/vCenter integrations, covering load balancing, application acceleration, and application-aware security (WAF). You can also see how Avi works with VCF Automation to load balance container-based apps.

• HOL-2740-02: Getting started with Avi and VCF: Learn how Avi integrates with VMware Cloud Foundation.
  
• HOL-2740-03: Getting started with application load balancing: Deliver core load balancing for your applications in VCF, with application acceleration and application-aware security.
  
• HOL-2740-04: Application resiliency with Avi GSLB: Use global server load balancing (GSLB) to keep distributed applications resilient across sites.
• HOL-2740-05: Migrate with the Avi Conversion Tool: Move from your existing load balancer to Avi using automated conversion tooling.

Conclusion

Throughout these labs, you will learn to secure VMware Cloud Foundation with our solutions:

• Build a repeatable, measurable path to Zero Trust.
• Learn about Distributed Firewall, Gateway Firewall, IDS/IPS, NTA, and NDR.
• Shield vulnerable workloads quickly with Distributed Virtual Patching
• Secure your VCF Infrastructure 
• Automate Application Delivery and Analytics, Security with Load Balancer

vDefend and Avi Session Highlights from VMware Explore 2026

These HOL Labs are represented in vDefend and Avi sessions showcased at VMware Explore 2026 in Las Vegas. If you missed this event, you can view the sessions on demand.

• vDefend 1-2-3-4 for Distributed Firewall: Unified workflows for auto-tagging, continuous DFW monitoring, and enforcement alerting.   
• Advanced Threat Prevention (ATP) and Virtual Patching: Proactive AI-driven threat defense and virtual patching for newly detected exploits.
• VMware vSphere Kubernetes Service (VKS) with vDefend: How Avi, AKO, and vDefend eliminate manual networking friction for K8s.
• Web Application Security with Avi Load Balancer: Unify web and API protection with a 360-degree integrated security stack.   

Additional resources:

• VMware vDefend announcement: VMware vDefend Advances Multi-Layer Lateral Security, Deployment Automation and Performance for the Frontier AI Era
• VMware Avi announcement: Avi Strengthens Web Application Security, Boosts Performance and Improves Operational Efficiency
• HOL Blog: The Next Gen of VMware Hands-on Labs Blog
• HOL Main Portal: Explore All VMware Hands-on Labs

Special thanks to Stijn Vanveerdeghem, Frank Snyder, and Nick Robbins for their hard work and support with Hands-on Labs and assistance with this blog.

The post Mastering Cybersecurity with VMware vDefend and Avi via Hands-on Labs appeared first on VMware Security Blog.

The enterprise technology landscape is undergoing a radical transformation, and at its core is the modern data center. Virtual machines (VMs) and agile Kubernetes-based environments have long served as the foundation of this infrastructure. However, as companies deploy artificial intelligence in daily business operations, they must aggressively expand their AI ecosystems to handle highly resource-intensive AI workloads. Ultimately, this shift is redefining what is possible in IT infrastructure and driving unprecedented growth across the enterprise.

This rapid expansion comes with a dark side: the same frontier AI that is accelerating business operations is being weaponized by adversaries. Attackers are increasingly deploying these models to intelligently find vulnerabilities, generate exploit code, correlate across targets, and execute chained attack paths at machine speed. The impact is staggering. As documented in recent M-Trends reporting, AI-discovered vulnerabilities have collapsed the median time to exploit (TTE) from 771 days in 2018 to sub-hourly windows today.

This explosive growth creates a sprawling attack surface that is notoriously difficult to secure consistently and efficiently. Furthermore, when facing threats that move at sub-hourly speeds, defenders can no longer rely on traditional playbooks. They must operate continuously, cost-effectively, and at that exact same machine speed. To effectively defend this modern ecosystem, organizations need robust lateral security that scales with the immense demands of high-performance workloads while enforcing consistent protection across highly distributed VM and Kubernetes clusters.

Purpose-built to address these challenges for the VMware Cloud Foundation (VCF) private cloud, VMware vDefend offers a multi-layered defense approach to protect east-west traffic against ransomware and advanced threats. vDefend includes an Intrusion Detection and Prevention System (IDPS), which inspects all traffic entering or leaving the network, detecting and preventing known threats from gaining access to the network, critical systems, and data. 

Let’s look at how vDefend IDPS addresses these critical needs.

The vDefend IDPS Advantage

To protect modern, distributed workloads without sacrificing speed, security must be built-in, not bolted on. By leveraging a hypervisor-native architecture, vDefend distributed IDPS provides seamless, plug-and-play zero-trust lateral protection.  Furthermore, because policies are distributed and automated, protection scales effortlessly, applying instantly as workloads are created or migrated across your environment.

High-Performance Lateral Threat Prevention with Turbo IDPS

vDefend introduces High-Performance Lateral Threat Prevention via an optimized Turbo IDPS architecture. By boosting throughput from 9 Gbps to 17 Gbps per host (17 Tbps per VCF instance), an 88% increase, Turbo IDPS ensures that every internal flow is inspected for malicious activity at line-rate speeds. Now you can seamlessly protect your East-West traffic while meeting the immense demands of high-performance AI workloads.

Optimizing Inspection with Maximum Performance

In a Zero Trust architecture, deep packet inspection is vital, but applying it blindly to all traffic is computationally inefficient. While vDefend distributed IDPS offers a robust 17 Gbps of throughput per host, securing high-capacity workloads optimally requires intelligent bypassing.

The “EXEMPT” rule action enables this strategy by allowing security operators to easily identify specific trusted flows (data backups, database replications, etc.) and exclude them from the IDPS scanning engine.

Key benefits for vDefend customers:

• Optimize resources: Exempting high-volume trusted flows preserves valuable compute resources. It frees up CPU cycles to apply IDPS rules exactly where needed—such as virtual patching—while explicitly bypassing them where unnecessary. 
• Reduce Alert Fatigue: Frees up time for SOC operators to focus on actual threats by eliminating the false positives typically caused by generic signature alerts.

Simplifying Zero Trust and IDPS Deployment with vDefend ATP Journey

vDefend ATP Journey (ATP 1-2-3) streamlines comprehensive IDPS deployment by transforming the complex path to Zero Trust into an intuitive, data-driven Security Journey. This methodology assesses an organization’s current security posture. It provides a structured workflow that smoothly guides users through sequential segmentation stages—from securing critical infrastructure services to fully locking down inter-environment traffic.

Key User Benefits:

• Easy Enablement: Accelerates configuration deployment through automated workflows and applies prescriptive IDPS policies in accordance with security best practices.
• Operational Efficiency: Provides real-time updates on security gaps through the Security Segmentation Report and recommends specific rules to address and improve overall posture.

Advanced Threat Prevention with vDefend IDPS

Defending against AI-Driven Threats: Distributed Virtual Patching

Frontier AI models have armed attackers with the ability to find previously unknown zero-day vulnerabilities across software and at machine speed. Attacks can now propagate in hours. Given the speed of AI-driven threats, it’s imperative to have a solution that can proactively address them and effectively maintain a defensive posture.

vDefend IDPS acts as a shield, proactively blocking potential exploits for newly detected vulnerabilities until official patches can be applied. It uses frequently updated signatures to protect against the latest global threats and supports custom signatures—imported or developed in-house—allowing customers to quickly and virtually patch their applications.

This video, vDefend Virtual Patching, demonstrates how distributed IDPS can be applied to protect against these threats.

Learn more about vDefend Virtual Patching here.

Threat Visibility

Deploying vDefend IDPS in a detect-only mode transforms network monitoring into a high-visibility threat intelligence tool. By generating high-fidelity alerts mapped directly to the MITRE ATT&CK framework, the system illuminates exactly how an attacker breaches the network and moves laterally. This detailed mapping of the attack kill chain provides SOC teams with the essential, deep context required to quickly investigate, understand, and respond to complex security events before they escalate.

vDefend IDPS provides:

• Early Detection: Empowers incident response teams to take early action and minimize damage.
• NDR Context: Integrates seamlessly with Network Detection and Response (NDR), a threat correlation engine, to create a comprehensive, multi-layered security posture.

Learn more about the vDefend ATP solution here. 

Streamlined Regulatory Compliance

Achieving compliance with stringent frameworks doesn’t have to be a resource-intensive challenge. vDefend IDPS transforms complex regulatory mandates into a streamlined, automated process.

Core Benefits

• Embedded, Frictionless Compliance: Simplifies alignment with PCI-DSS, HIPAA, and NIST Zero Trust by building security directly into the infrastructure layer rather than bolting it on.
• Virtual Patching: Protects unpatched workloads against known and zero-day vulnerabilities.
• Audit Control and Reporting: Automatically logs and captures network packet data to easily generate comprehensive audit trails and enforcement reports.

Inspection for All Workloads – VMs, Kubernetes and Bare-metal

In addition to protecting VM workloads, vDefend IDPS extends deep packet inspection directly to container nodes and bare-metal servers. Analyzing this highly dynamic container traffic provides granular visibility into lateral East-West traffic. This allows organizations to scale cloud-native architectures without compromising their underlying security posture.

Key benefits for vDefend customers:

• Consistent Policy: Enforce consistent label-based policies that span across VMs and Kubernetes clusters.  
• Unified Management Console: Manage all workloads from a single console.
• Lateral Movement Prevention: Prevent lateral movement by applying policies directly at the source—at the Container Network Interface (CNI) for pods and vNICs for VMs.

vDefend distributed IDPS protects a diverse range of modern workloads—from VMs and containers. By leveraging Advanced Threat prevention on the gateway firewall, these detection capabilities extend directly to bare-metal servers. Additionally, full support for air-gapped environments ensures your infrastructure meets all regulatory compliance requirements.

Conclusion

The rapid expansion of AI workloads is radically reshaping the modern enterprise data center. Simultaneously, adversaries are weaponizing frontier AI models to launch high-speed, sophisticated cyberattacks. To navigate this, organizations must make vDefend IDPS an integral, foundational part of their security journey. By embedding security into the hypervisor, vDefend seamlessly delivers true zero-trust protection. The platform addresses a vast breadth of critical use cases, from virtual patching to securing modern containers. Furthermore, with recent high-performance architectural enhancements such as Turbo IDPS, vDefend powers advanced threat prevention without introducing network bottlenecks. Ultimately, vDefend IDPS ensures your infrastructure remains agile, scalable, and decisively protected against AI-driven threats. 

Learn more:

• Multi-Layer Defense in the AI Era | Video
• VMware Advanced Threat Prevention Datasheet
• VMware vDefend Datasheet

The post VMware vDefend IDPS: Securing Private Cloud Workloads in the Age of Frontier AI appeared first on VMware Security Blog.

New enhancements include a prescriptive workflow to accelerate Advanced Threat Prevention (ATP) deployment, an on-premises Malware Prevention System, comprehensive air-gapped support, an AI Assistant for firewall operations, major performance gains for the Distributed Firewall and Intrusion Detection and Prevention Service (IDPS), and automated migration tooling.

Earlier in May, VMware vDefend delivered Self-Service Lateral Security for VMware Cloud Foundation (VCF) 9.1, featuring support for unified lateral threat prevention for VMs and VKS workloads, high-performance threat prevention with IDPS Turbo Mode, and enhanced distributed firewall capabilities. 

As Frontier AI continues to reshape the threat landscape, enterprises face new challenges in securing, operating, and scaling their private clouds. Attackers are using Frontier AI to exploit software vulnerabilities at machine speed, and the rapid adoption of agentic AI is drastically expanding the attack surface. At the same time, fragmented tools and manual processes are slowing down security teams, while rising hardware costs make it difficult for organizations to scale efficiently. 

VMware vDefend addresses these challenges with new innovations focused on three pillars: enhanced security, simplified operations, and optimized performance and resources.

The detailed innovations under these three pillars are as follows: 

1. Enhanced Security

• Accelerated Advanced Threat Prevention with vDefend 1-2-3: Introduces a streamlined, three-step deployment workflow that accelerates time-to-value for ATP, enabling overextended IT teams to rapidly deploy defenses in just a few weeks instead of many months. 
• On-Premises Malware Prevention System: Brings malware sandboxing on-prem, analyzing static and dynamic artifacts entirely within the local network. All vDefend capabilities are now fully supported on-prem.
• Comprehensive Air-Gapped Support: All vDefend capabilities are now fully supported in air-gapped environments. This deployment model enables secure, offline threat intelligence updates, allowing highly sensitive environments to stay up to date on the latest threat signatures without connecting to the cloud. 

2. Simplified Operations

• AI Assistant: vDefend now includes AI Assistant to streamline lateral security operations. It embeds AI-powered automation directly into the platform to simplify firewall operations and troubleshooting.
• Automated Migration to vDefend Distributed Firewall: This vACT enhancement simplifies and automates the migration of legacy, agent-based firewall solutions to DFW, significantly reducing migration costs and accelerating security posture.

3. Optimized Performance and Resources

• Distributed Firewall Performance Improvements: To secure data-heavy AI workloads, vDefend significantly enhances Distributed Firewall (DFW) throughput to 22 Gbps on 25G NIC servers (a 129% increase) and 75 Gbps on 100G NIC servers (an additional 241% increase), achieving up to 75 Tbps scale-out performance per VCF instance.
• Distributed Intrusion Detection and Prevention System Performance: vDefend can now boost Intrusion Detection and Prevention System (IDPS) performance to 17Gbps per server (an 89% increase), delivering up to 17 Tbps of scale-out performance for distributed virtual patching per VCF instance.
• Leaner Security Services Platform Deployment Model: vDefend introduces a leaner Security Services Platform (SSP) deployment model that reduces the physical hardware required to run the platform, lowering infrastructure costs.

The sections below describe each vDefend innovation in detail and highlight customer benefits. 

vDefend 1-2-3 for ATP: Deployment Automation Workflows

Infiltration occurs when network traffic goes uninspected; therefore, implementing IDPS across all workloads, not just mission-critical ones, is essential. Additionally, robust network security requires zero-day threat detection and mitigation capabilities.  

vDefend 1-2-3 for ATP is a new guided workflow that accelerates the deployment of Advanced Threat Prevention across private cloud environments. Designed similarly to the vDefend 1-2-3-4 for DFW workflow for lateral (macro and micro) segmentation, ATP workflow streamlines the implementation of IDPS, Network Traffic Analysis (NTA), and Network Detection and Response (NDR), reducing deployment times from months to weeks.

The workflow consists of three stages:

• Stage 1: Conducts a threat posture assessment focused on IDPS, NTA, and NDR to evaluate current risks and provide recommendations.
• Stage 2: Applies recommended IDPS policies to protect shared services infrastructure, such as Active Directory, DNS, and NTP.
• Stage 3: Expands IDPS policies across zones (environments) such as DMZ, Dev, and Production.

By using this guided workflow, IT teams can rapidly deploy Advanced Threat Prevention, including virtual patching and zero-day threat mitigation, to strengthen security posture and compliance.

On-Premises Malware Prevention System

Highly regulated industries face strict data sovereignty requirements and compliance standards such as HIPAA and GDPR, which make it essential to keep sensitive data and files inside local data centers. vDefend now offers an on-premises Malware Prevention System (MPS) that meets these requirements without compromising threat detection. This architecture brings malware sandboxing directly into the local data center, eliminating the need to upload files to an external public cloud. By keeping all sensitive data, files, and metadata strictly inside local boundaries, enterprises remove external attack surfaces while maintaining full control over their sensitive data.

Comprehensive Air-Gapped Support

For infrastructure requiring absolute operational isolation and strict data privacy, defending against modern threats without exposing internal systems to the internet is critical. 

vDefend now offers a comprehensive, air-gapped deployment model to keep all network traffic, files, and data strictly inside the local data center. It eliminates external dependencies and public cloud connectivity. Security teams can safely download offline threat intelligence updates and manually upload them to vDefend. This maintains up-to-date signatures against new threats without connecting to external cloud services.

AI Assistant for vDefend

Complex workflows and troubleshooting slow down infrastructure and security teams, consuming time, introducing risk, and holding back business agility. To reduce this complexity, VMware is introducing an AI Assistant for vDefend. By embedding intelligence directly into the platform, the tool accelerates troubleshooting, provides version-aware design guidance, and automates rule analysis to identify duplicate and redundant rules for policy cleanup. It also offers real-time visibility into live configurations, performance metrics, security events, and API assistance for automation. This operational intelligence allows security teams to streamline day-to-day operations and improve overall efficiency.

Leaner Security Services Platform (SSP) for Lower-Footprint Entry Point

Enterprise IT teams need deep traffic visibility and security posture assessments to manage security risks effectively. The Security Services Platform (SSP) serves as a scale-out data lake that ingests network flow records and telemetry, providing granular flow visibility, security assessment scores, policy recommendations, and guided workflows. With rising server costs, vDefend now offers a leaner SSP deployment model with a lower-footprint entry point starting at 32 CPU cores. This new deployment model reduces physical server requirements by up to 33%, allowing organizations to lower infrastructure costs. The scale-out architecture of the SSP platform allows it to expand as needs grow.

Enhanced Distributed Firewall and IDPS Performance

vDefend delivers major performance improvements across both the Distributed Firewall (DFW) and IDPS engines. 

• Distributed Firewall: DFW can now scale up to 22 Tbps (129% increase) and 75 Tbps (further 241% increase) per VCF instance using 25G and 100G NIC servers, respectively. With server costs on the rise, these enhancements allow enterprises to scale performance-intensive workloads using their existing server hardware via a software upgrade.
• Distributed IDPS: IDPS now delivers up to 17 Gbps per host, providing up to 17 Tbps (89% increase) scale-out capacity per VCF instance. These enhancements allow organizations to run hypervisor-native distributed virtual patching and secure performance-intensive AI traffic at scale, all delivered via a software upgrade.
  

Automated Migration to vDefend Distributed Firewall

Migrating from legacy, agent-based firewall solutions is often slow and resource-intensive due to the manual effort required to translate complex rule sets. To eliminate this deployment friction, VMware offers the vDefend and Avi Conversion Tool (vACT) to automate security policy migrations. The tool automatically converts existing firewall rules and configurations directly into native vDefend policies. By accelerating transition and minimizing manual errors, vACT enables organizations to reduce overall migration costs and improve lateral security posture more quickly.

The new enhancements are delivered in vDefend Security Services Platform 5.2, vDefend 9.1.1, and vDefend and Avi Conversion Tool (vACT) 3.0 releases, all of which are compatible with the VCF private cloud 9.1 release.

Lateral Defense for Agentic AI workloads

As enterprises deploy agentic AI in their private cloud, Zero Trust lateral security will be necessary day one. Additionally, security technologies must recognize new agentic AI constructs, such as LLMs, agents, tools and AI protocols. One example is the Model Context Protocol (MCP), which enables agents to interact with various enterprise tools, data, and services. In addition to securing MCP traffic, it is important to harden the MCP itself in line with established enterprise-ready protocols like HTTP, SIP, SSH, and TLS. vDefend engineers took a leading role by championing a proposal to harden stateless MCP interactions, which is now reflected in Agentic AI Foundation’s updated MCP specification released in July 2026 (see coverage in the Ars Technica article). Such collaborations are critical for achieving the visibility and policy enforcement required to secure agentic AI workloads.

Conclusion

Modern enterprises require a multi-layer private cloud lateral defense that is distributed, automated, and high-performance to protect workloads against evolving, AI-driven threats. The latest vDefend enhancements further strengthen the solution through streamlined Advanced Threat Prevention workflows, flexible deployment models for highly sensitive environments, AI-assisted firewall operations, and significantly improved distributed firewall and IDPS performance. Together, these innovations enable security teams to stay ahead of threats and ensure the robust, multi-layer security required for modern private clouds.

To learn more about vDefend, see the links below.

Resources

• Dark Reading: Why Virtual Patching and Multi-Layer Defense are Critical in the Age of Frontier AI
• Multi-layer Defense in the AI Era
• VMware vDefend for VCF 9.1: Zero Trust Lateral Security for the AI Era
• vDefend DFW 1-2-3-4: Deploy Zero Trust Microsegmentation
• Zero Trust Lateral Security for Kubernetes Workloads on VCF
• Advancing Zero Trust Private Cloud with vDefend Lateral Security
• Enhance Lateral Security and Ingress Load Balancing for Kubernetes Workloads
• Broadcom Unveils AI-Ready Lateral Security and App Delivery Innovations
• vDefend Webinar Series
• Customer Case Studies:  St. John’s Health | United States Senate Federal Credit Union | GCI

The post VMware vDefend Advances Multi-Layer Lateral Security, Deployment Automation and Performance for the Frontier AI Era appeared first on VMware Security Blog.

Ready to learn how to secure your private cloud workloads against a new wave of AI-driven threats while accelerating your Private Cloud and App modernization journey? VMware Explore returns to the Venetian Convention and Expo Center in Las Vegas from August 31 – Sep. 03, 2026. Step into the next generation of enterprise infrastructure and see firsthand how VMware vDefend delivers comprehensive lateral security for VMware Cloud Foundation workloads in the Agentic AI era.

Gain expertise and a competitive edge by learning what vDefend offers in today’s rapidly changing threat landscape. Catch the sessions below at VMware Explore 2026 to chart your organization’s future and protect your private cloud.

Executive Highlight Session

Umesh Mahajan at VMware Explore 2025

Operationalizing Cyber Defense and App Resilience for the Agentic AI Era [SECB1789LV]
Tuesday, Sep 1  2:00 PM – 2:45 PM PDT

Digital IT is adopting agentic AI to help businesses further differentiate and boost productivity. AI is also the cause of attack surface explosion, as bad actors armed with the same AI models autonomously infiltrate enterprises. Infrastructure operators need new innovations that accelerate their AI journey, while ensuring app resilience and complete cyber lockdown of large language models (LLMs), agents, data stores, and MCP services. Join Umesh Mahajan, GM of Application Networking and Security (ANS), Broadcom, to learn how IT is consuming lateral security and app delivery for AI and non-AI workloads. The session will cover operational best practices to implement Zero Trust and app resilience Day 1 for VMware Cloud Foundation® (VCF) 9.1 and private AI, leveraging new innovations in VMware® vDefend and VMware® Avi Load Balancer. The deployment journey will focus on rapid rollout to buy-down risk while ensuring app availability, investment protection, and consistent operations of VMs, VMware vSphere® Kubernetes Service, and agentic AI workloads.

Umesh Mahajan, VP & GM, Application Networking and Security, Broadcom
Prashant Gandhi, Head of Products, Application Networking and Security, Broadcom

People’s Choice Award Winner – Breakout Session

Enforcing Zero Trust for Apps Across Multi-Cluster VMware vSphere Kubernetes Service [SECB1079LV]
Tuesday, Sep 1  10:15 AM – 11:00 AM PDT

As VMware vSphere® Kubernetes Service (VMware VKS) becomes the go-to runtime for running modern applications and especially AI applications on VMware Cloud Foundation® (VCF), how do you enforce strict Zero Trust for workloads across multiple Kubernetes clusters and VMs? In this session, we will show how SecOps can define a central “security taxonomy” via labels, and how developers deploy apps that automatically consume those policies. We will look at how VMware® vDefend and Antrea CNI work together to enforce microsegmentation across VKS clusters from a single control plane. We will cover: • Building a label-based taxonomy for Kubernetes apps • Enforcing Zero Trust with vDefend and Antrea across L4 • Protecting L7 with end-to-end mTLS and WAF using Istio and VMware® Avi • Ensuring bad actors cannot bypass global security • Automating policy rollouts via Terraform. Finally, we will wrap up with a demo showing this entire automated workflow in action.

Chris McCain, Field CTO, Broadcom
Niran Evenchen, Principal Solution Architect, Broadcom

Breakout Sessions

Lateral Security Simplified: The VMware vDefend Distributed Firewall 1-2-3-4 Security Journey [SECB1247LV]
Monday, Aug 31  9:00 AM – 9:45 AM PDT

Stopping lateral movement within the data center is critical, yet many organizations struggle with the complexity of mapping and securing east-west traffic. The VMware vDefend Security Journey provides a prescriptive, data-driven workflow designed to simplify lateral security for VMware Cloud Foundation®. In this session, we break down the “1-2-3-4” deployment framework to help you move from zero visibility to a fully hardened environment. We will walk through the four essential stages: protecting critical shared services, segmenting broad environments, securing specific application tiers, and achieving final lockdown. Whether you are starting from scratch or refining your firewall, you will leave with a practical roadmap to eliminate lateral threats.

Catherine Fan, Technology Product Manager, Broadcom
Andrew Hrycaj, Technical Product Manager, Broadcom

Demystifying vDefend Distributed Security within VMware Cloud Foundation [SECB1358LV]
Monday, Aug 31  10:15 AM – 11:00 AM PDT

VMware® vDefend Distributed Firewall and VMware® vDefend Distributed Intrusion Detection and Prevention System (IDS/IPS) provide security services in the kernel through processing of rules and signatures intrinsically within the virtual networking infrastructure. We will show the inner workings of the distributed services from an architectural standpoint and, more importantly, the best implementation techniques, as well as troubleshooting tools for examining the effectiveness of the strategy deployed. We will show the use of AI to simplify the configuration of the centrally managed protection mechanisms and greatly reduce the time and effort needed to put a tight security policy in place.

Chris McCain, Field CTO, Broadcom
Tim (vGandalf) Burkard, Principal Technical Learning Engineer, Broadcom

Self-Service Security for VMware Cloud Foundation Automation with VMware vDefend Distributed Firewall [SECB1119LV]
Tuesday, Sep 1  9:00 AM – 9:45 AM PDT

The core of delivering a VMware Cloud Foundation (VCF) private cloud experience to enterprise customers and cloud service providers is empowering their project and tenant admins with delegated, self-service security controls. This session will explore how VMware® vDefend Distributed Firewall delivers these self-service capabilities directly to customers consuming the VCF private cloud via VCF Automation. We will specifically discuss delegating vDefend Distributed Firewall controls and how enterprise admins, providers, and tenant admins can leverage it to ensure the highest levels of security.

Geoff Wilmington, Technology Product Management, Broadcom

Prescriptive Ransomware Defense for VMware Cloud Foundation Workloads with VMware vDefend Advanced Threat Prevention [SECB1466LV]
Tuesday, Sep 1   3:15 PM – 4:00 PM PDT

Ransomware is pervasive; your defense must be proactive. For VMware Cloud Foundation® (VCF) users, the optional phase of security is over. Join us to discover how to leverage VMware® vDefend Advanced Threat Prevention, including IDS/IPS, NTA, and NDR to stay ahead of threat actors. Whether you are just getting started or looking to optimize your existing stack, you will learn about a new prescriptive, built-in guided workflow with assessments and tailored security policies that will significantly improve your security posture.

Bopaiah Puliyanda, Senior Manager, Product Management, Broadcom

Security Reference Design for VMware Cloud Foundation [SECB1630LV]
Wednesday, Sep 2  11:30 AM – 12:15 PM PDT

In the era of decentralized data and AI-driven threats, security can no longer be a bolt-on feature—it must be the foundation. As organizations consolidate on VMware Cloud Foundation® (VCF), the challenge shifts from managing disparate security tools to implementing a unified, Zero Trust architecture that protects workloads from the silicon up to the cloud. Join us as we break down the blueprint for a hardened VCF and learn how to design security for VCF management and workload domains. We will move beyond basic configuration to explore a holistic architectural approach that integrates VMware® vDefend lateral security solutions. We will walk through the framework for building a resilient VCF private cloud: infrastructure protection, application ring fencing and microsegmentation, threat visibility, and ransomware prevention.

Pooja Patel, Director, Broadcom

Secure the Front Door: Hardened VMware vSphere Kubernetes Service with VMware Avi
and VMware vDefend [SECB1462LV]
Wednesday, Sep 2  12:45 PM – 1:30 PM PDT

Kubernetes (K8s) introduces a dramatically more agile model for modern applications. VMware® Avi and VMware® vDefend deliver critical security and load balancing for K8s workloads. VMware Avi and Avi Kubernetes Operator (AKO) redefine Kubernetes ingress by eliminating manual networking “plumbing.” Within VMware vSphere® Kubernetes Service (VMware VKS), installation is plug-and-play: AKO automatically provisions enterprise load balancing the moment your cluster is live. We are future-proofing this stack via the K8s Gateway API—the industry standard for modern AI Gateways. This role-oriented model simplifies life for developers and admins, providing the “front door” required for next-gen apps. Security remains a core pillar through Istio integration, where VMware Avi delivers high-performance mTLS, WAF, and deep observability. The session also highlights a top U.S. financial institution’s design and architecture for AKO. This unified approach ensures your VMware VKS environment is secure, modern, and simple to operate at scale.

Chris Grice, Technical Product Manager, Broadcom
Madhu Krishnarao, Sr. Product Manager, Broadcom

The Patching Dilemma: Do You Need Help with the Deluge of Vulnerabilities? [SECB1279LV]
Wednesday, Sep 2  2:00 PM – 2:45 PM PDT

The gap between vulnerability discovery and exploitation is shrinking at an unprecedented rate. As AI-driven tools automate the identification of zero-day flaws, traditional patch-all strategies have become mathematically impossible for modern enterprises. How do we keep up when the deluge never ends? This session explores a shift from reactive patching to risk-based orchestration. We will dive into the critical role of compensating controls, specifically focusing on how Virtual Patching via IDPS (Intrusion Detection and Prevention Systems) and Avi Web Application Firewall (WAF) provides the breathing room teams desperately need. Attendees will learn how to buy back time for testing and deployment without leaving their environment exposed to the next major exploit.

Geoff Shukin, Senior Product Manager, Broadcom
Stijn Vanveerdeghem, Senior Manager, Technology Product Management, Broadcom

Secure by Design: Eliminating Ransomware Blind Spots with VMware vDefend [SECB1311LV]
Wednesday, Sep 2  3:15 PM – 4:00 PM PDT

In a landscape where lateral movement defines modern attacks, infrastructure can no longer be a passive bystander. This session explores a security-first approach that embeds defense directly into the hypervisor to neutralize threats at the source. We provide a deep dive into the unique architectural advantage of VMware® vDefend and VMware Cloud Foundation® (VCF), demonstrating a methodology to “buy down” risk across your entire environment. Through technical insights and an end-to-end demo, you will discover how to achieve immediate “quick wins” such as virtual patching and distributed threat prevention to stop attackers before they gain a foothold.

Stijn Vanveerdeghem, Senior Manager, Technology Product Management, Broadcom

Innovation Track

Governance of Micro-Segmentation Policies [INVB1744LV]
Wednesday, Sep 2  3:15 PM – 4:00 PM PDT

This session explores the critical pillars of microsegmentation governance, moving beyond the initial visibility phase into sustainable, long-term policy management. We will dissect the lifecycle of a policy—from discovery and authoring to automated enforcement and continuous auditing.

Kausum Kumar, Senior Manager, Technical Product Management, Broadcom

Theater presentation at VMware Explore 2025

A Step-by-Step Tutorial for Stopping Brickstorm-Like Attacks Using VMware vDefend [SECT1642LV]
Monday, Aug 31  11:30 AM – 1:00 PM PDT

This session provides step-by-step guidance about how VMware® vDefend provides a robust architectural shield against such catastrophic events. We will dive into the deployment mechanics of VMware® vDefend Distributed Firewall and Distributed Intrusion Detection/Prevention (IDS/IPS) to demonstrate how micro-segmentation can effectively stop attacks in their infancy.

Andrew Hrycaj, Technical Product Manager, Broadcom
Geoff Shukin, Senior Product Manager, Broadcom

Quick Talk

The Top 10 Agentic AI Security Risks and Threats Every IT Admin Should Know [CMTYQT1710LV]
Monday Aug 31 11:00 AM – 11:20 AM PDT

Learn about the top 10 security risks and vulnerabilities facing agentic AI applications, large language (LLMs), and MCP servers. In this session, we will provide an introductory overview of agentic AI components, real-world examples of AI security threats, and how you can prepare to mitigate those risks with VMware software solutions.

Meet the Expert Roundtables

Best Practices for Tagging and Groups for VMware vDefend Distributed Firewall [SECM1748LV]
Monday, Aug 31 2:00 PM – 2:30 PM PDT

In this interactive whiteboard session, we move past the high-level marketing slides to focus on the technical “blocking and tackling” required to secure your private cloud using VMware® vDefend. Among other topics, participants will gain technical insights into virtual patching, using Distributed IDS/IPS to shield vulnerable workloads from known exploits without the immediate need for disruptive guest-level patching, leveraging network detection and response (NDR) and sandboxing to identify behavioral signals of ransomware actors, and a lot more. Bring your questions and leave with a practical blueprint for making your infrastructure immune from ransomware.

Bopaiah Puliyanda, Senior Manager, Product Management, Broadcom

Code-Driven Security: Automating VMware vDefend Policy with Infrastructure as Code [SECM1509LV]
Tuesday, Sep 1  2:00 PM – 2:30 PM PDT

Stop managing security policies manually. This session moves beyond basic configuration to focus on operationalizing automation within your private cloud defense using infrastructure as code (IaC). We will demonstrate how to leverage code to automatically generate, deploy, and manage your VMware® vDefend Policy, making security policy a function of code that protects your environment from the ground up. We will dive deep into practical methods for codifying network segmentation using vDefend with virtual private clouds (VPCs), defining granular role-based access, and standardizing critical defenses like Layer 4/7 Firewall and Gateway Firewall configurations. By operationalizing this IaC approach, you will ensure consistent, scalable, and secure resource provisioning across all your projects, leading to streamlined and reliable deployment strategies.

Andrew Hrycaj, Technical Product Manager, Broadcom

Registration is now open! Check out the content catalog and scheduling tool, using the vDefend,  Avi, and overall ANS Targeted Agendas to build your personalized VMware Explore schedule. Looking forward to seeing you in Las Vegas!

The post VMware vDefend Sessions at VMware Explore 2026 appeared first on VMware Security Blog.

VMware vDefend directly conforms to NIST CSF, HIPAA, and PCI DSS requirements, providing organizations with the critical controls needed to satisfy regulatory mandates and mitigate modern threats.

Regulatory compliance has become a strategic imperative across all industry sectors due to a growing global focus on data privacy, supply chain transparency, and operational resilience. This urgency is further amplified by the rapid adoption of AI and the rise of AI-accelerated cyberattacks. These advanced threats often target software vulnerabilities and spread laterally through east-west traffic to access high-value targets such as electronic protected health information (ePHI) or Cardholder Data Environment (CDE). As a result, security and compliance teams must deploy comprehensive controls to provide visibility and enforcement, restrict lateral movement, detect threats, and enable mitigation before damage can occur.

To effectively address these challenges and ensure compliance, organizations must align their security architecture with the necessary control points. This alignment is typically achieved through a layered approach, using regulatory frameworks tailored to their industry, data type, and security maturity:

• The Strategic Baseline (NIST CSF 2.0): A highly flexible, risk-based set of guidelines (Identify, Protect, Detect, Respond, Recover). It is often used as a baseline for overall cybersecurity maturity or mapped to fulfill other requirements.
• The Prescriptive Mandates (PCI DSS 4.0.1 & HIPAA): These granular, rules-driven standards are designed to safeguard specialized assets such as cardholder data and ePHI, requiring robust technical boundaries, workload isolation, and deep traffic surveillance.

To provide an objective, professional evaluation of vDefend’s alignment with these mandates, VMware partnered with Coalfire, a leading independent cybersecurity advisory firm. This partnership resulted in the publication of authoritative Product Applicability Guides (PAGs), which provide a detailed assessment of VMware vDefend’s capabilities against established regulatory requirements.

VMware vDefend is a comprehensive Zero Trust lateral security solution designed to protect against cyber threats. This hypervisor-native, software-defined solution provides deep visibility into both network and application activities, effectively eliminating security blind spots. It enforces a multi-layered defense and mitigation strategy against ransomware and advanced persistent threats. 

VMware vDefend is a comprehensive lateral security solution that includes multiple capabilities: distributed and gateway firewalls (DFW, GFW), distributed Intrusion Detection and Prevention Service (IDS/IPS), Malware Prevention Service (MPS), Network Detection and Response (NDR) with an NDR Sensor, and Network Traffic Analysis (NTA). This solution offers deep traffic visibility and creates a closed-loop security system for VCF private cloud, ensuring visibility, prevention, detection, and mitigation of cyber threats.

The following sections explore how VMware vDefend aligns with the essential lifecycle mandates of these critical compliance frameworks.

The Strategic Baseline: NIST CSF 2.0

The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0 serves as a foundation for modern security design. Rather than offering a simple checklist, it presents a systematic approach organized around five key technical functions: Identify, Protect, Detect, Respond, and Recover.

The following sections detail how vDefend’s comprehensive security capabilities align with the objectives of each NIST framework function.

Identify

Proper identification and mapping of various critical IT assets form the foundation of a comprehensive defense strategy. With vDefend, enterprises can organize workloads statically or dynamically using a tag-based labeling system to trigger specific security policies. Static policies apply to a fixed set of tagged workloads, while dynamic policies automatically adjust and apply based on ‌specific tags. This dynamic enforcement ensures that the corresponding level of compliance, be it regulatory (e.g., HIPAA, PCI DSS) or internal security posture requirements, is met instantly and consistently as new workloads are spun up or existing ones change.

VMware vDefend’s Security Intelligence provides real-time, distributed visibility across the entire data center and cloud infrastructure by continuously monitoring and analyzing all identified traffic flows between workloads. By observing these communication patterns, the Security Intelligence platform can automatically detect and map the “desired” or “baseline” behavior of applications. Based on this traffic flow analysis, the platform provides highly calibrated, actionable policy recommendations that can significantly reduce the attack surface and enhance the overall security posture.

With a clearly identified asset inventory and defined policy baselines, the focus then shifts to proactive enforcement.

Protect

Protecting enterprise workloads from known and previously unseen (zero-day) threats is a core capability of the vDefend solution.

While vDefend Gateway Firewall (GFW) provides conventional NGFW edge controls, albeit with a modern software-defined architecture, the vDefend Distributed Firewall (DFW) employs a distributed (and scale-out) ‘security-per-workload’ model, ‌securing each workload at the virtual NIC layer. Lateral movement, the technique in which attackers pivot from a compromised system to high-value targets, is the primary mechanism by which modern threats, such as sophisticated ransomware and advanced persistent threats, spread internally. By enforcing security policies for every workload, vDefend DFW effectively stops unauthorized lateral movement and restricts breaches from spreading. This critical defense-in-depth mechanism dramatically shrinks the attack surface to an individual workload.

While the Distributed Firewall restricts spread, continuous detection is required to flag anomalies and sophisticated threats that bypass conventional defenses.

Detect

The Detect function focuses on identifying a cybersecurity event in real time, not just after the fact, enabling rapid response and containment. In today’s dynamic threat landscape, this function has undergone a significant transformation. vDefend Advanced Threat Prevention (ATP) has evolved the detection capability by leveraging a multi-layered approach to threat detection, ensuring that security gaps are minimized and evasive threats are captured:

• Distributed Intrusion Detection/Prevention System (IDS/IPS): The vDefend distributed IDS/IPS inspects network traffic and actively matches traffic patterns against an extensive, continuously updated library of over 10,000 known threat and vulnerability signatures. This distributed deep inspection – applied on a per-workload basis – is crucial for detecting both external attacks and east-west traffic anomalies, and for identifying potential vulnerabilities before they can be exploited.
• Network Traffic Analysis (NTA): NTA detects highly sophisticated attacks that bypass perimeter defenses by using behavioral analytics and machine learning on network metadata and flow information. NTA excels at immediately flagging subtle signs of an ongoing internal breach, particularly lateral movement, a key indicator of a successful intrusion.
• Sandboxing for Malware Analysis: vDefend provides an advanced sandboxing feature to neutralize the threat of zero-day exploits and polymorphic malware. This technology isolates suspicious files and URLs in a secure, virtualized environment (the “sandbox”), where the file is “detonated” or executed within a limited blast radius to observe the true behavior. If the file exhibits malicious characteristics, it is blocked, and the signature information is updated to prevent future occurrences.
• Network Detection and Response (NDR): vDefend NDR correlates multiple disparate data points from various sources into visually intuitive attack maps. These detailed, chronological, and graphical representations of an attack campaign result in highly relevant, actionable security intelligence for security teams. 

Taken together, these capabilities give organizations a holistic, real-time picture of threats across their environment. The comprehensive, correlated data and visual attack maps also serve as verifiable evidence of due diligence during audits.

Respond

The response involves a rapid, coordinated incident management effort to contain threats and minimize damage. 

When a threat is detected, vDefend can automatically trigger a Quarantine Policy, moving the infected VM into an isolated “Security Group” with access limited to forensics tools. When coupled with correlated intrusion campaign data from NDR, the incident management team can visualize the entire attack chain on a map. Furthermore, vDefend’s advanced troubleshooting tools—such as traceflow, packet capture, and detailed firewall logs—provide the forensic data needed to demonstrate compliance during an audit.

Once the immediate threat is contained and the attack chain is documented, the final step is ensuring full operational recovery.

Recover

The Recover function focuses on the rapid and complete restoration of services to the pre-incident operational state, ensuring the integrity of all reinstated data. VMware vDefend offers robust capabilities for incremental and full configuration backups. Furthermore, integrating VMware Live Recovery with vDefend significantly enhances the overall resilience strategy, covering both incident response and subsequent recovery.

In summary, the VMware vDefend solution enables foundational security controls that not only provide enterprise-grade protection but also streamlines the complex process of achieving and maintaining continuous compliance across diverse regulatory landscapes. Coalfire’s evaluation recognizes vDefend for its excellent structural coverage throughout the entire NIST lifecycle.

Coalfire assessed vDefend against all 106 subcategories in NIST CSF 2.0, and the results demonstrate the breadth and depth of vDefend’s compliance coverage. vDefend achieves full or strong coverage across the vast majority of applicable subcategories. The ability to monitor, inspect, and enforce policy on east-west traffic within a VCF environment is the architectural advantage that drives this coverage, translating directly into measurable, assessor-validated outcomes across Identify, Protect, Detect, and Respond.

It is worth noting that NIST CSF 2.0 is intentionally broad — many of its subcategories address organizational and business processes that extend beyond any single technology platform. vDefend delivers deep, validated coverage of the technical control layer, and when combined with the organizational security program built around it, organizations are strongly positioned to demonstrate comprehensive CSF 2.0 alignment.

The detailed NIST CSF 2.0 Product Applicability Guide is available here. 

The Prescriptive Mandates: PCI DSS 4.0.1 & HIPAA

In contrast to the broad NIST framework, data-specific regulations such as PCI DSS and HIPAA involve highly prescriptive technical requirements. Whether securing credit card data or electronic health records, vDefend serves as an essential, independently validated technical control point for both standards. The sections below explain these in detail.

PCI DSS 4.0.1 Alignment

The Payment Card Industry Data Security Standard places a strong emphasis on isolating the Cardholder Data Environment (CDE) and restricting access to it. In a virtualized environment, this means enforcing precise east-west traffic controls—the core architecture vDefend is built around. Coalfire’s Product Applicability Guide highlights vDefend’s coverage across all 12 major PCI DSS requirements:

Note: Requirements 3 and 9 are marked N/A as they address stored account data and physical access controls, respectively — areas outside the scope of a network security platform.

The detailed PCI DSS 4.0.1 Applicability Guide is available here. 

HIPAA Technical Safeguards Mapping

In healthcare environments, the stakes of inadequate security controls are particularly high. East-west traffic between clinical applications, databases, and administrative systems creates a wide attack surface for ePHI exposure. vDefend directly addresses this risk through its distributed enforcement model.

Under the HIPAA Security Rule, healthcare covered entities must deploy specific technical safeguards to ensure the confidentiality, integrity, and availability of ePHI. Coalfire’s validation confirms that vDefend aligns directly with these rigorous provisions: 

The Administrative Safeguards (requirements 1–5) address process and access governance; the Technical Safeguards (requirements 6–9) enforce those controls at the system level. vDefend is independently validated across all nine, providing covered entities with a strong, documentable compliance foundation.

The detailed HIPAA Applicability Guide can be found here. 

VMware vDefend provides essential technical control points for data-specific regulations. Coalfire’s validation confirms its direct alignment with both the PCI DSS 4.0.1 requirements for isolating the Cardholder Data Environment (CDE) and the HIPAA Security Rule’s rigorous provisions for safeguarding the confidentiality, integrity, and availability of ePHI.

Conclusion

VMware vDefend delivers a comprehensive set of control points for both broad frameworks, such as NIST CSF, and data-specific compliance mandates, such as PCI DSS and HIPAA. Adopting VMware vDefend allows organizations to implement a robust security strategy while gaining the necessary control points for compliance. By integrating visibility, prevention, detection, and mitigation directly into a closed-loop security system, vDefend significantly accelerates an organization’s journey toward a Zero Trust posture and continuous compliance. 

To learn more about the benefits of vDefend, see the links below.

• vDefend Product Applicability Guide for PCI-DSS
• vDefend Product Applicability Guide for HIPAA
• vDefend Product Applicability Guide for NIST CSF 2.0
• VMware vDefend Distributed Firewall
• VMware vDefend Advanced Threat Prevention
• VMware vDefend Datasheet
• vDefend DFW 1-2-3-4: A Prescriptive Path to Zero Trust Microsegmentation
• VMware vDefend How to Videos on YouTube

The post Validated Compliance: VMware vDefend Conforms with NIST CSF, HIPAA and PCI DSS appeared first on VMware Security Blog.

In the past, data center security mostly relied on perimeter protection—”building walls” to keep bad actors out. Today, safeguarding the data center’s “east-west” or lateral traffic traversing within applications and data is just as critical. Threat actors are leveraging “Frontier AI” security models to automate and accelerate attacks against private cloud workloads. 

To help enterprises achieve best-of-breed protection with significantly reduced complexity, we are excited to announce new VMware vDefend blueprints to speed up lateral security roll-out across VCF private cloud workloads and help organizations quickly buy down risk. The “Lateral Security for VMware Cloud Foundation with VMware vDefend” VVS is now integrated into core VCF 9.1 design documentation as “Lateral Security with vDefend” Blueprints. The blueprints for Securing the Management and Workload domains are now included with the core VCF 9.1 design documentation.

Here is a closer look at what this change means, what these blueprints cover, and how you can start using them to modernize your private cloud security and protect against both conventional and AI attacks.

What are the Design Blueprints for VMware Cloud Foundation?

A blueprint is a prescriptive, end-to-end architecture designed to accelerate your time-to-value when building and operating a VMware Cloud Foundation (VCF) private cloud platform. It provides predefined deployment models that conform to specific profiles. A blueprint also includes a set of planning, implementation, and design elements (requirements and recommendations) tailored to the selected deployment model. You can streamline your VCF private cloud provisioning by using them as a template, swapping out models to match your unique infrastructure layout.

What does Lateral Security with vDefend Blueprints cover?

The Lateral Security with vDefend Blueprints describes the architectural components and design selections required to provide unified, enterprise-grade security services for a VMware Cloud Foundation platform using VMware vDefend security solutions.

The design consists of three individual blueprints that cover pre-defined models to address network and application security corners of your platform:

• Security Services Platform for VCF: Outlines the design details, planning and preparation, and implementation steps for deploying the vDefend Security Services Platform on VCF.
• Management Domain Security: Tailored guidelines to protect the critical management components powering the VCF and establish a foundational, security-robust private cloud environment.
• Workload Domain Security: Dedicated blueprint aimed at utilizing the vDefend DFW-1-2-3-4 staged prescriptive workflow to meet the Zero Trust lateral security model for applications within a VCF workload domain.

Getting Started

Ready to eliminate blind spots and lock down your east-west traffic? Check out the new Lateral Security with vDefend design blueprints today and take your private cloud security to the next level.

Summary

By integrating VMware Validated Solutions into the core VCF 9.1 design documents, Broadcom aims to streamline documentation and provide straightforward guidance for building a robust, secure private cloud.

The Lateral Security with vDefend Blueprints equips you with verified configurations and guidelines to streamline setup, reduce guesswork, and accelerate the path to a cyber-resilient private cloud. Whether you’re new to security or an experienced professional, these blueprints make it easier than ever to transform your security plans into a practical security strategy.

Deployment and Design Resources:

Design Library for vDefend

Securing vSphere Supervisor and VKS

DFW 1-2-3-4: Security Journey Self-Deployment Guide

The post Introducing VMware vDefend Lateral Security Design Blueprints for VCF 9.1 appeared first on VMware Security Blog.