VMware is pushing so many patches, it thinks users need new tools to manage the flood

VMware has discovered so many flaws in its products using AI that it felt the need to create a new product to help users manage them.

Prashanth Shenoy, vice president of product marketing in the VMware Cloud Foundation (VCF) division of Broadcom, told The Register that VMware recently moved to deliver monthly software updates, in part to address bugs found by AI.

He admitted, however, that users struggled to keep up with the pace of change before the move to monthly releases because it takes time to test the impact of patches – even though VCF allows non-disruptive live patching.

REG AD

Shenoy said customers therefore need "room to breathe." Enter a new tool called HyperArmor, which does three things.

REG AD

One is "virtual patching" – blocking attempts to exploit a vulnerability without changing the vulnerable software itself.

VMware already offers virtual patching in its vDefend network security product and explains how it works by referring to CVE-2024-5806, the bug in file transfer tool MOVEIt that made waves in 2024. VMware says vDefend can detect patterns associated with attempts to exploit the authentication bypass flaw and block the traffic.

HyperArmor will do similar things to block malicious traffic heading toward VCF implementations.

Another job HyperArmor takes on is rejecting any actions that alter known good states in VCF. If a human approves a change, the tool will update policies to allow the altered state.

The third job is multi-factor authentication (MFA). The Register put it to Shenoy that MFA is now table stakes for security. He agreed but explained that VMware designed HyperArmor to protect against attackers using stolen privileged credentials to access VMware's ESX hypervisor.

To (hopefully) stop attackers using those creds to take over a host, HyperArmor requires users to input SSH credentials and a secondary time-based one-time password sent to a user with a verified identity.

HyperArmor is a discrete product that VMware will sell as an add-on to VCF. That means VMware thinks its customers are going to be OK paying extra for MFA.

While VMware will sell HyperArmor, it didn't create the product. Broadcom's security businesses Symantec and Carbon Black cooked it up.

REG AD

Broadcom's CA business (formerly Computer Associates) has done similar things.

At VMware Explore on August 31, Broadcom launched AgentMinder, which aims to stop AI running inside VCF going rogue. AgentMinder came from CA but was launched as a tool for VCF (and third-party Kubernetes stacks).

At VMware Explore, The Register met Ram Velaga, president of Broadcom's Infrastructure Software Group, and asked him if the group has a single strategy, or if its divisions each do their own thing.

Velaga said Broadcom uses a combination of both approaches.

"There's a level of focus with individual teams that you don't have if you have one very large central team," he said. "You get the speed at which you have to innovate with individual teams."

Broadcom's Infrastructure Software Group therefore operates with at least six teams, and when one of those teams wants to add functions it will look for existing assets developed by another internal team rather than trying to write its own code.

For broad products like VCF, the work of several Broadcom teams could therefore be relevant.

The Register has no idea which team created the name HyperArmor, a question we pose as Cisco already offers a "Hypershield." Maybe this sort of name is what's needed to stop a HyperHoodie? ®