VMware security is a layered discipline that combines purpose-built products, strategic acquisitions, and ongoing administrator vigilance. Core products such as NSX and AppDefense address different threat vectors, while the Service-defined Firewall ties them together into a unified, zero-trust strategy. Even the most sophisticated tooling, however, must be supplemented with solid operational practices such as tested, airgapped backups.
Security in NSX: Microsegmentation and Zero Trust
VMware NSX is primarily a software-defined networking platform, but security is a first-class feature rather than an afterthought. Its key security mechanism is microsegmentation, which divides the data center network into logically isolated groups at the workload level rather than at the network perimeter.
Traditional perimeter security models place a single firewall around the entire network. If an attacker breaches that perimeter, they gain broad lateral movement. Microsegmentation counters this by placing firewall policies around individual workloads. A compromised VM is contained within its segment and has little ability to pivot to neighbouring workloads.
- Zero-trust enforcement: Every workload is treated as untrusted by default; policies must explicitly permit communication.
- Policy consistency: NSX propagates security policies across vCenter Server and the underlying hardware, ensuring consistent enforcement throughout the data center.
- Disaster recovery integration: NSX security policies can follow workloads to redundant or recovery facilities, maintaining posture during a failover.
How AppDefense Fits In: Intended-State Security
NSX secures the network layer, but threats can also originate from within a workload itself—malicious or compromised applications that behave unexpectedly. VMware AppDefense addresses this by focusing on application behavior rather than known threat signatures.
AppDefense operates on the concept of the intended state: a baseline that defines what normal looks like for each VM or application. An Intended State Engine (ISE) builds this baseline automatically by communicating with configuration management systems and application automation frameworks to gather information about apps, workloads, and underlying operating systems.
Once the intended state is established, AppDefense continuously monitors VM behavior. Any deviation triggers a response:
- Alerting: Admins receive notifications when a VM behaves outside its intended state.
- Automated remediation: AppDefense can quarantine a suspicious VM, power it off, or delete it entirely—without waiting for manual intervention.
This approach is particularly valuable in large environments where an admin cannot realistically monitor every application manually.
The Service-defined Firewall: A Holistic Security Layer
VMware’s Service-defined Firewall combines the application visibility of NSX with the intended-state intelligence of AppDefense. Running inside the hypervisor itself, it inspects traffic and enforces policy with context that a traditional hardware or perimeter firewall does not have.
A conventional firewall typically makes a binary decision: block or allow. The Service-defined Firewall adds a third option—quarantine—which holds ambiguous or suspicious traffic for further inspection rather than blindly permitting or dropping it. This makes it significantly harder for malicious data disguised as legitimate traffic to slip through.
Key capabilities include:
- Distributed enforcement at the hypervisor level, eliminating blind spots that exist when traffic never traverses a physical firewall appliance.
- Automated policy actions: lock down apps, restrict user access, or isolate data based on real-time behavioral context.
- Protection at both the perimeter and internally—defending against threats that have already penetrated the network edge.
Note: The original source article cited a test by Verodin (a cybersecurity validation firm) claiming the Service-defined Firewall detected and prevented 100% of tested attacks. This figure should be treated with caution—vendor-commissioned or third-party validation tests rarely reflect all real-world threat scenarios. See review notes.
Key Security Acquisitions: CloudCoreo, Intrinsic, and Carbon Black
Between 2018 and 2019, VMware made three notable security acquisitions that extended its capabilities beyond the core hypervisor and networking stack:
CloudCoreo
CloudCoreo focuses on cloud security posture management. It provides configuration and vulnerability assessments across multi-cloud environments, helping teams identify, prioritise, and remediate misconfigurations in public cloud infrastructure. VMware acquired it with the goal of embedding security directly into cloud provisioning and management workflows.
Intrinsic
Intrinsic specialises in application runtime security, particularly for serverless workloads. Its technology uses virtualisation to enforce user-defined policies around JavaScript-based applications and integrates with serverless platforms including AWS Lambda, Azure Functions, and Google Cloud Functions.
Carbon Black
Announced at VMworld 2019, the Carbon Black acquisition was VMware’s most significant security move to date. Carbon Black develops cloud-native endpoint security software with capabilities including:
- Next-generation antivirus and malware detection
- Endpoint detection and response (EDR)
- Threat hunting
- Alert monitoring and incident response
Carbon Black’s technology has since been integrated into VMware’s broader security portfolio under the VMware Carbon Black brand.
Preparing for and Responding to Breaches: Admin Best Practices
Even the most sophisticated tooling does not eliminate the possibility of a breach. Administrators must maintain operational security hygiene to ensure that, when an attack occurs, recovery is fast and data loss is minimal.
Regularly Test Backups
Attackers—particularly ransomware operators deploying variants such as CryptoLocker—frequently target backup infrastructure before triggering the primary attack. Compromising backups first ensures victims have no easy recovery path. Administrators should:
- Schedule regular, automated backup verification to confirm that backup sets are complete and restorable.
- Apply antimalware and antivirus scanning to backup data and replication streams.
- Treat backup systems as part of the attack surface—apply the same patching and access-control discipline as to production systems.
Maintain Airgapped Backup Copies
An airgapped backup is a copy stored offline or on a network segment that is not reachable from production systems. If all backup systems are online and network-connected, a sufficiently advanced attacker can reach and corrupt them all. Airgapping provides a recovery option that survives even a complete compromise of the online environment.
Practical considerations for airgapped backups:
- The frequency of airgapped copies determines the maximum data loss in a worst-case scenario. More frequent copies mean less data at risk.
- Storage constraints often limit how much data can be airgapped. Prioritise the most critical data sets.
- Test restoration from airgapped media on a defined schedule—a backup that has never been tested is not a reliable backup.
Putting It All Together
Securing a VMware environment requires layering complementary controls:
- Network segmentation (NSX): Limit lateral movement by isolating workloads.
- Behavioral monitoring (AppDefense): Detect and respond to anomalous application behavior automatically.
- Hypervisor-level firewall (Service-defined Firewall): Enforce context-aware policy with block, allow, or quarantine actions.
- Endpoint security (Carbon Black): Detect and respond to threats at the endpoint level.
- Cloud posture management (CloudCoreo): Continuously assess and correct cloud misconfigurations.
- Operational discipline: Test and airgap backups, patch systems promptly, and apply least-privilege access controls throughout.
No single product resolves every risk. The combination of purpose-built VMware security tools, well-configured infrastructure, and vigilant administration provides the most robust defence for modern virtualised data centres.