VMware sells HyperArmor to slow its own AI-found patch flood

VMware has built a new security add-on called HyperArmor to help customers cope with the volume of patches the company is now shipping, partly because artificial intelligence keeps finding flaws in its products. The plan was described to The Register by Prashanth Shenoy, vice president of product marketing in the VMware Cloud Foundation (VCF) division of Broadcom, in an article published on 13 October 2026.

According to The Register, VMware recently moved to monthly software updates in part to handle bugs discovered by AI. Shenoy said customers had struggled to keep up with the pace of change even before that shift, because testing the impact of patches takes time, and that users need "room to breathe" — despite VCF supporting non-disruptive live patching.

HyperArmor is intended to provide that breathing space, and does three things. The first is "virtual patching", which blocks attempts to exploit a vulnerability without altering the vulnerable software itself. VMware already offers virtual patching in its vDefend network security product, and explains the idea by pointing to CVE-2024-5806, the authentication bypass bug in the MOVEit file transfer tool that made waves in 2024. The company says vDefend can spot traffic patterns associated with attempts to exploit that flaw and block them. HyperArmor will do similar work for traffic heading towards VCF deployments.

The second function is rejecting any action that changes a known good state in VCF. If a human approves a change, the tool updates its policies so the new state is allowed. That matters for automated and agentic activity inside an environment, because it means an unapproved configuration change is refused by default rather than audited after the fact.

The third function is multi-factor authentication. The Register put it to Shenoy that MFA is now table stakes, and he agreed, but said HyperArmor was designed specifically to blunt attacks that use stolen privileged credentials against VMware's ESX hypervisor. The tool requires SSH credentials plus a time-based one-time password sent to a user with a verified identity, with the aim of stopping an attacker who holds valid credentials from taking over a host.

HyperArmor is a separate product that VMware will sell as an add-on to VCF, which means the company expects customers to pay extra for that MFA layer, The Register noted. VMware did not build the tool itself. It came from Broadcom's security businesses Symantec and Carbon Black.

The approach follows a similar move with AI agents. At VMware Explore on 31 August, Broadcom launched AgentMinder, a tool meant to stop AI running inside VCF going rogue. AgentMinder originated in Broadcom's CA business, formerly Computer Associates, but was released as a product for VCF and for third-party Kubernetes stacks.

Asked at VMware Explore whether Broadcom's Infrastructure Software Group works to a single strategy or lets divisions go their own way, group president Ram Velaga said the company uses a combination of both. "There's a level of focus with individual teams that you don't have if you have one very large central team," he said. "You get the speed at which you have to innovate with individual teams." The group runs at least six teams, and when one wants to add a feature it looks for assets another internal team has already built rather than writing its own code. For a broad product such as VCF, The Register said, work from several Broadcom teams can end up in the same box.