Are you wondering if this is another security feature? I would like to clarify that it absolutely is!
On October 13th, Broadcom announced VMware HyperArmor, a security add-on for the ESX host. Announced, not shipped yet.
What Is It?
Broadcom describes three pieces, all on the host, with no agents inside guest VMs:
- Virtual patching: blocks exploit attempts before the real patch lands, with no reboot or upgrade
- Positive Host Security Guardrails: basically an allow list. Existing scripts get inventoried and allowed, anything unauthorized is automatically blocked
- MFA for SSH: a TOTP challenge after normal SSH credentials
Think of it as: a bouncer at the host door, plus a guest list for every process.
Why it matters: Broadcom says stolen root credentials and unpatched vulnerabilities drive most hypervisor attacks.
Live patching definitely helps, but a patch still has to be released and applied to the hosts before it can be effective.
Licensing and Availability
- Packaging: optional paid add-on, sold per core
- Editions: VCF and VVF
- Versions: ESX 8.x and later
- Price: discuss with your VMware partner
- GA: expected in Broadcom’s fiscal Q1 2027 (starts November)
Key Limitations
Still patch: virtual patching buys time. It isn’t the fix.
Overlap: ESX 8 already has execInstalledOnly with TPM enforcement for binaries. Turn that on first.
Unknowns: how virtual patch rules get delivered, performance overhead, and how VIB installs get approved.
Scope: host only. VM guests, vCenter and the network (vDefend) are separate.
Bottom Line
HyperArmor targets a real gap on hosts running hundreds of VMs. MFA on SSH, though, feels like it belongs in the base platform…
Let’s wait for GA and more documentation, then pilot it and share your thoughts!
Would you be willing to pay a little bit extra for MFA and config version control on your hypervisor?
More information from Broadcom directly:
https://www.broadcom.com/company/news/product-releases/64761
https://blogs.vmware.com/cloud-foundation/2026/10/13/proactive-hypervisor-defense-introducing-vmware-hyperarmor/
