This article is based on reporting originally published by CRN and VMware announcements made at RSA Conference 2020 (February 2020).
VMware Brings Intrinsic Security to Cloud Foundation
At RSA Conference 2020, VMware announced a significant expansion of security capabilities within VMware Cloud Foundation (VCF) — the company’s integrated software-defined infrastructure stack that underpins offerings such as VMware Cloud on AWS and VMware Cloud on Dell EMC. The announcements reinforced VMware’s stated strategy of making security intrinsic — built directly into the infrastructure rather than bolted on as a separate layer.
What Was Announced at RSA 2020
VMware unveiled the following additions to VMware Cloud Foundation:
- Carbon Black Workload Protection — Real-time Workload Audit and Remediation technology integrated directly into VCF.
- Carbon Black Next-Generation Antivirus (NGAV) — Replacing traditional signature-based antivirus with behavioral detection.
- Carbon Black Endpoint Detection & Response (EDR) — Continuous visibility into endpoint activity to detect and investigate threats.
- NSX Advanced Load Balancer with Web Application Firewall (WAF) — Providing application-aware filtering with automated learning and app-specific rules to reduce false positives.
- NSX Distributed IDS/IPS — Intrusion detection and prevention distributed across workloads, offering per-hop visibility and filtering throughout the application path.
Both the NSX and Carbon Black components are tightly integrated with VMware vSphere, the hypervisor layer at the core of VCF.
The Agentless Security Architecture
A central technical claim in VMware’s approach is the elimination of in-guest security agents. Traditional endpoint security solutions require agents installed inside each virtual machine — agents that an attacker can potentially detect, disable, or spoof.
VMware’s integration places Carbon Black’s capabilities at the hypervisor level. Endpoint telemetry is gathered via sensors built into and protected by the hypervisor itself, meaning they cannot be disabled from within the guest operating system. VMware CEO Pat Gelsinger described the architectural advantage in an interview with CRN:
“We have two assets that nobody else on the planet has. We have the VM. We’re building this intrinsically into the VM. A lot of problem with a lot of security today is they end up being agents that you add into the guest environment. If you’re an attacker, the first thing you do is turn off the agents. The VM can’t be turned off. This sits as a capability inside of the VM.”
— Pat Gelsinger, VMware CEO (interview with CRN)
NSX: Enforcement at the Network Layer
Beyond the hypervisor, VMware’s NSX networking platform provides a second enforcement point. Because NSX operates at the virtual network layer — directly handling traffic between the VM and the broader network — it can inspect all east-west traffic without requiring traffic to be redirected (or “hairpinned”) to a remote firewall appliance.
Gelsinger elaborated on this architectural advantage:
“With our NSX, I now have an enforcer point, where you can see the network traffic and see all of it from an application-centric point of view. So the VM is handing traffic into NSX and then to the microsegments — there’s nothing else sitting in-between that. You don’t have to hairpin to some remote firewall or some other service. You have that explicit point right at connectivity into the networking layer.”
— Pat Gelsinger, VMware CEO (interview with CRN)
The NSX Distributed IDS/IPS component extends this visibility by applying intrusion detection across every service hop in an application’s traffic path, reducing blind spots that would otherwise exist in traditional perimeter-based security models.
The NSX Web Application Firewall uses a scale-out software architecture, meaning WAF compute capacity scales with workload demand. VMware states this ensures security filtering capacity is maintained even under peak application loads, and that automated learning allows the WAF to build app-specific rule sets with lower false-positive rates.
Context: VMware’s Acquisition of Carbon Black
The RSA 2020 announcements built on VMware’s acquisition of Carbon Black in October 2019 for approximately $2.1 billion. Carbon Black was a leading independent endpoint security vendor, and its acquisition was a clear signal that VMware intended to compete directly in the enterprise security market — not just as an infrastructure provider, but as a security platform vendor.
VMware COO Sanjay Poonen framed the broader strategic rationale at RSA 2020:
“Attacker sophistication, security threats, breaches, and exploits are becoming more prevalent with no end in sight. And with cloud, new applications, pervasive mobility, IoT, and data at the edge, the problem is only getting harder to solve. There must be a new approach to cybersecurity — one that is built-in, unified and context-centric.”
— Sanjay Poonen, VMware COO (RSA 2020 statement)
VMware Carbon Black Cloud: Additional Updates
Alongside the VCF-focused announcements, VMware also introduced new capabilities for the VMware Carbon Black Cloud platform:
- MITRE ATT&CK Framework Integration — Automated correlation of detected behaviors to MITRE ATT&CK Technique IDs. This allows security teams to map observed activity to a standardized taxonomy of adversary tactics, techniques, and procedures (TTPs), making it easier to identify coverage gaps and prioritize remediation.
- Linux Malware Prevention — Carbon Black added malware prevention capabilities for Linux workloads, enabling organizations running Linux-based infrastructure to migrate away from Linux-specific endpoint prevention tools and consolidate onto the Carbon Black Cloud platform.
What This Means for DevOps and Platform Teams
For engineering teams running workloads on VMware Cloud Foundation — whether on-premises or through VMware Cloud on AWS or Dell EMC — these announcements have practical implications:
- Reduced agent sprawl: Agentless security at the hypervisor level simplifies VM templates and reduces the operational burden of managing, updating, and auditing security agents across large fleets.
- East-west traffic visibility: NSX Distributed IDS/IPS enables detection of lateral movement within a data center or cloud environment — a critical capability for detecting threats that have already bypassed perimeter controls.
- WAF without dedicated appliances: A software-defined WAF that scales with compute eliminates capacity planning concerns tied to physical or fixed-capacity WAF appliances.
- Threat context via MITRE ATT&CK: Integrating Carbon Black alerts with ATT&CK Technique IDs makes findings more actionable for incident responders and easier to communicate to stakeholders.
VMware’s intrinsic security strategy represents a meaningful architectural shift — moving security controls closer to the workload and network fabric rather than layering them on top. Whether that strategy delivers on its promise depends on the depth of integration and the operational maturity of the tooling as it evolves beyond the initial announcements made at RSA 2020.