Originally reported by Network World (networkworld.com), February 2020. This article is based on VMware’s announcements from that period.
VMware’s Push Toward Intrinsic Security
In early 2020, VMware accelerated its “intrinsic security” strategy by announcing three new integrated security offerings. The goal: replace fragmented, bolt-on security tools with protection woven directly into the infrastructure layer. These announcements drew on technology VMware had recently acquired from Carbon Black, Avi Networks, CloudCoreo, and CloudHealth.
The three offerings introduced were:
- VMware Advanced Security for Cloud Foundation — an integrated security bundle for VMware Cloud Foundation environments
- MITRE ATT&CK Framework Integration in Carbon Black Cloud — technique-level threat detection and alerting tied to the MITRE ATT&CK Technique IDs (TIDs)
- VMware Secure State enhancements — real-time multicloud risk detection and automated remediation
VMware Advanced Security for Cloud Foundation
VMware Cloud Foundation is VMware’s core virtualization stack, bundling vSphere, NSX networking, and vSAN storage. It underpins key offerings such as VMware Cloud on AWS and the Dell EMC portfolio. The Advanced Security for Cloud Foundation package layers three security technologies on top of this foundation:
1. VMware Carbon Black Workload Protection
VMware acquired Carbon Black for approximately $2.1 billion in 2019. Within the Advanced Security package, Carbon Black technology provides:
- Real-Time Workload Audit and Remediation — continuous assessment of workload configuration and state
- Next-Generation Antivirus (NGAV) — behavior-based threat prevention beyond signature matching
- Endpoint Detection & Response (EDR) — investigation and response capabilities for active threats
A notable architectural decision was the plan to integrate Carbon Black tightly with VMware vSphere to deliver an agentless model. Rather than deploying antivirus agents inside each guest virtual machine, endpoint telemetry would be collected via sensors managed at the hypervisor level. VMware stated this design has a key security advantage: because the sensor lives in a separate trust domain from the guest OS, the hypervisor can detect if an attacker attempts to tamper with or disable the Carbon Black components — something an in-guest agent cannot reliably do if the OS itself is compromised.
“Instead, endpoint telemetry will be managed and gathered via built-in sensors protected by the hypervisor. This also means, unlike agent-based solutions, the hypervisor will be able to detect if an attacker attempts to gain root access and tamper with the VMware Carbon Black technology — all from a separate trust domain.”
— VMware official statement
2. NSX Advanced Load Balancer with Web Application Firewall
VMware acquired Avi Networks — a software-defined load balancing, analytics, and application delivery platform — in 2019 for an undisclosed sum. Rebranded as the NSX Advanced Load Balancer, the technology is paired with VMware’s Web Application Firewall (WAF) to protect web-facing workloads.
VMware engineer Vivek Bhandari explained the architectural advantage over hardware appliance-based WAF and load balancer solutions:
“Traditional hardware-based solutions are notoriously complex to manage. They are either massively over-provisioned for peak traffic or end up turning off security filtering under heavy loads. In contrast, the scale-out software architecture of the NSX Advanced Load Balancer enables capacity to scale elastically with traffic.”
— Vivek Bhandari, VMware
This is a meaningful distinction for DevOps teams: a hardware appliance that disables WAF filtering under load is providing false assurance. A software-defined, elastically scaling WAF maintains consistent policy enforcement regardless of traffic spikes.
3. NSX Distributed IDS/IPS
The third component is NSX Distributed Intrusion Detection and Prevention (IDS/IPS). Traditional perimeter IDS/IPS sits at the network edge, creating blind spots for east-west (lateral) traffic between workloads inside the data center. The NSX distributed model applies filtering at every network hop within the application path rather than only at the perimeter.
Additionally, security policies can be defined and enforced on a per-application basis, allowing teams to apply tighter controls to sensitive workloads without affecting others — a practical benefit for organizations running mixed-criticality environments on shared infrastructure.
MITRE ATT&CK Framework Integration in Carbon Black Cloud
VMware also announced that the Carbon Black Cloud would natively incorporate the MITRE ATT&CK framework, a publicly maintained knowledge base of adversary tactics, techniques, and procedures (TTPs). The integration was framed around the reality that many modern attacks do not rely on traditional malware at all.
Scott Lundgren, Vice President of Engineering at VMware Carbon Black, cited findings from the Verizon Data Breach Investigations Report indicating that only 28% of attacks at that time involved malware — meaning traditional signature-based AV is ineffective against the majority of real-world attack techniques. (Note: readers should verify this figure against the specific DBIR edition referenced, as annual report figures change.)
The MITRE ATT&CK integration in Carbon Black Cloud gave customers the ability to:
- Search events by MITRE Technique IDs (TIDs)
- View MITRE TID documentation directly from within the product dashboard
- See when a specific TID is encountered in their environment
- Configure dashboard alerts to fire when particular TIDs are detected
This kind of native ATT&CK mapping accelerates SOC workflows: rather than manually cross-referencing alerts against external documentation, analysts can triage and contextualize detections in a single interface.
Windows AMSI Support and Linux Malware Prevention
Two additional Carbon Black Cloud capabilities were announced alongside the MITRE integration:
- Microsoft Windows Anti-Malware Scanning Interface (AMSI) support: AMSI allows security products to inspect the de-obfuscated content of scripts at execution time — including PowerShell, VBScript, and others. Lundgren noted that 70% of attacks observed in Carbon Black’s Global Incident Response Threat Report featured lateral movement, often using legitimate tools like PowerShell to execute malicious commands. AMSI integration gives Carbon Black visibility into what scripts are actually doing, even if obfuscated at rest.
- Linux malware prevention: VMware cited Linux running approximately 70% of web servers and 90% of cloud servers, along with the emergence of Linux-specific threats such as HiddenWasp, QNAPCrypt, and Evilgnome, as justification for expanding Carbon Black’s coverage to Linux endpoints. With this addition, Carbon Black Cloud aimed to provide unified endpoint security across Windows, macOS, and Linux from a single cloud-native platform.
VMware Secure State: Multicloud Risk Detection and Automated Remediation
VMware Secure State was developed from two acquisitions: CloudCoreo, focused on continuous cloud configuration automation, and CloudHealth, a cloud management and cost optimization platform. Together they formed the foundation of a product designed to give security and DevOps teams shared visibility into multicloud environments.
The enhancements announced at this time included:
- Real-time visibility and detection — continuous monitoring of cloud resource configurations for security risks
- Risk prioritization — helping teams focus on the most impactful issues first
- Flexible remediation framework (beta) — automating corrective actions across multiple cloud environments
A key design intent was to facilitate collaboration between cloud security teams and DevOps teams, building security enforcement into normal multicloud operational workflows rather than treating it as a separate audit function. This aligns with broader DevSecOps principles of shifting security left and integrating it with infrastructure-as-code and CI/CD pipelines.
What This Means for DevOps and Infrastructure Teams
The overall pattern in VMware’s 2020 security push has lasting relevance for infrastructure and DevOps practitioners:
- Agentless security at the hypervisor layer reduces operational overhead and eliminates a class of agent-tampering attacks. If your organization runs VMware, understanding how Carbon Black’s vSphere integration changes your endpoint security model is worth evaluating.
- Distributed IDS/IPS and WAF at the software layer removes the performance cliff that causes hardware appliances to drop inspection under load — a serious operational risk in production environments.
- MITRE ATT&CK mapping in your security tooling is increasingly a baseline expectation. Teams without it are doing more manual correlation work than necessary.
- Linux endpoint security has historically been underinvested relative to Windows. Expanding coverage to Linux is increasingly critical as cloud-native infrastructure is overwhelmingly Linux-based.
- Multicloud security posture management (the category VMware Secure State fits into, now broadly called CSPM) has become a standard requirement for organizations running workloads across AWS, Azure, GCP, or VMware Cloud.
VMware’s intrinsic security approach — embedding protection within the infrastructure stack rather than layering separate tools on top — represents a meaningful architectural direction, though its practical effectiveness depends heavily on how well the acquired technologies are integrated over time.