This article is based on commentary by Adam Saunders, VMware Business Development Manager at Ingram Micro NZ, originally published by SecurityBrief New Zealand.
Why Perimeter Security Is No Longer Enough
“For a long time, we’ve focused on one or two layers of security and in many cases just one – perimeter. In the age of cloud, mobile devices, edge services and IoT, this is no longer enough,” says Adam Saunders, VMware Business Development Manager at Ingram Micro NZ.
The traditional model of drawing a hard boundary around a corporate network made sense when workloads, users and devices were largely contained within a single physical location. That model breaks down when employees work remotely, applications run in public clouds, IoT sensors operate at the edge, and mobile devices connect from anywhere. A breach at any one of these touch points can compromise the entire organisation if the only line of defence is the perimeter.
The response from the industry has been a shift toward layered, zero-trust security — the principle that no user, device or workload should be implicitly trusted simply because it is inside the network boundary. VMware has positioned itself as a significant player in this space, offering an integrated portfolio that addresses security at four distinct layers: the LAN, the WAN, the server and the endpoint.
Securing the LAN with VMware NSX
As organisations adopt containers and serverless computing, workload-level network security becomes critical. Wrapping a perimeter around individual workloads inside a data centre or private cloud has historically been impractical — the operational overhead and cost of deploying and managing hardware firewalls at that granularity made it unfeasible at scale.
VMware’s NSX is a network virtualisation and security platform that addresses this problem through micro-segmentation. Rather than relying on a single perimeter, NSX places security controls around every individual workload, regardless of where it runs. This creates a zero-trust internal network where lateral movement — the technique attackers use to move from one compromised system to others — is blocked by policy.
Key capabilities of VMware NSX for LAN security include:
- Micro-segmentation: Policy-driven isolation of workloads so that even if one is compromised, the blast radius is contained.
- Distributed firewall: Firewall rules enforced at the hypervisor kernel level rather than at a centralised appliance, giving consistent enforcement across all traffic.
- Zero-trust enforcement: Internal traffic is subject to the same scrutiny as traffic crossing the perimeter, ensuring users and systems only access the resources they are explicitly permitted to reach.
Securing the WAN with VMware SD-WAN (VeloCloud)
VMware acquired VeloCloud, positioned by Gartner as a leader in the SD-WAN space, to extend its security portfolio to wide-area network connectivity. SD-WAN (Software-Defined Wide Area Networking) replaces or augments traditional MPLS links with intelligent, software-managed overlays that can run across any available transport — MPLS, fibre broadband or 4G/LTE.
From a security perspective, VMware SD-WAN (VeloCloud) provides several important capabilities:
- End-to-end encryption: All traffic across the SD-WAN fabric is encrypted, covering every path between branch offices, data centres and cloud providers.
- Cloud-based orchestration: A centralised Orchestrator manages all gateways and SaaS provider connections within a meshed topology, giving IT teams unified visibility and control.
- Secure cloud on-ramp: VeloCloud acts as a direct, secure entry point into cloud platforms and SaaS applications, reducing the need to backhaul traffic through a central data centre.
- Default-deny posture: Out of the box, VeloCloud is configured in a deny-all mode. IT staff build policy incrementally by explicitly permitting the traffic flows the organisation requires — a clean implementation of least-privilege networking.
- Firewall integration: VMware partners with third-party firewall vendors to integrate with VeloCloud at the edge device. Traffic can be directed through a firewall before being forwarded, or the firewall and VeloCloud edge can operate back-to-back so that routing decisions remain with the SD-WAN device, maximising firewall throughput.
Securing the Server with vSphere and AppDefense
At the server and virtualisation layer, VMware combines vSphere — its market-leading hypervisor platform — with AppDefense to create a security model that is intrinsic to the infrastructure rather than bolted on top of it.
The key insight behind this approach is that the hypervisor has a privileged, unobstructed view of everything happening on the workloads it hosts. By embedding security controls at the hypervisor level, VMware can provide protection that guest operating systems and applications cannot tamper with or circumvent.
Capabilities at this layer include:
- Unified VM and container security: The platform covers both traditional virtual machines and modern container workloads, providing consistent security policy across hybrid application architectures.
- Behavioural analytics: AppDefense establishes a baseline of intended application behaviour and monitors for deviations. Unexpected behaviours are assigned a risk score, enabling security teams to triage alerts efficiently rather than sifting through undifferentiated event noise.
- Proactive threat detection: By understanding what an application is supposed to do, the platform can identify anomalies — such as a web server spawning an unexpected child process — that signature-based tools would miss.
- Encryption at rest and in motion: Data is encrypted both while stored and while traversing the network, reducing exposure if physical or logical access to storage is compromised.
- DevSecOps integration: By unifying developer and operations visibility across the infrastructure, security policy can be embedded in the deployment pipeline rather than applied after the fact.
Securing the Endpoint with Workspace ONE and Carbon Black
The proliferation of device types — Windows laptops, macOS machines, iOS and Android phones and tablets, and a growing range of IoT devices — has made uniform endpoint security far more complex. A single-OS assumption no longer holds, and endpoint management tools must work across heterogeneous environments.
VMware addresses this at two levels:
VMware Workspace ONE
Workspace ONE is a unified endpoint management (UEM) platform that covers application delivery, identity management, and device management across desktop and mobile operating systems. It provides enterprise-grade security controls — conditional access, application containerisation, compliance enforcement — behind a consumer-grade user experience, lowering friction for employees while maintaining the policy controls IT requires.
VMware Carbon Black
VMware acquired Carbon Black to add cloud-native endpoint detection and response (EDR) to its portfolio. Carbon Black operates as a lightweight agent on each endpoint and delivers:
- Next-generation antivirus: Combines traditional signature-based detection with machine learning to identify threats that have no known signature.
- Behavioural threat detection: By analysing sequences of behaviour rather than individual file hashes, Carbon Black can identify novel attack patterns before a signature exists for them.
- Continuous recording: Every interaction on every endpoint is recorded. If a breach occurs, security teams can trace the exact sequence of events — the precise moment of compromise, the affected device and the actions taken by the attacker — enabling faster, more accurate remediation.
- Cloud-based threat intelligence: Threat data collected across the Carbon Black customer base feeds back into the cloud platform, continuously improving detection rates across all deployments.
A Layered, Integrated Security Architecture
What distinguishes VMware’s approach from point-product security is integration. Rather than stitching together independently managed tools from multiple vendors, the NSX, SD-WAN, vSphere/AppDefense and Workspace ONE/Carbon Black components share policy context and telemetry. A threat detected at the endpoint can inform network segmentation policy; anomalies at the hypervisor layer can trigger endpoint investigation.
For organisations navigating the complexity of hybrid cloud, remote work and IoT expansion, this kind of coherent, layered architecture is increasingly important. Perimeter security alone is not a viable strategy — but neither is assembling dozens of disconnected tools. A platform approach that addresses each layer with consistent policy and integrated visibility offers a more manageable and more effective path forward.
Organisations interested in deploying VMware’s end-to-end security solutions through a channel partner can contact Ingram Micro for reseller and service provider options.