This article is based on a report originally published on devops.com by Don Macvittie, written around the time of VMware’s integration of the former CloudCoreo product into its cloud portfolio.
Background: From CloudCoreo to VMware Secure State
CloudCoreo was a cloud security and compliance startup that attracted attention for pulling infrastructure security firmly into the DevOps workflow through automation—at a time when cloud misconfigurations were causing high-profile data breaches. VMware acquired the company and evolved its technology into VMware Secure State, integrating it into VMware’s broader cloud portfolio alongside CloudHealth and Wavefront.
Don Macvittie, the original author, spoke with Jason Needham, Senior Director of Product Management for Multicloud Security at VMware, to understand what changed in the transition and how Secure State fits into the wider VMware DevOps ecosystem.
What VMware Secure State Does
Secure State is positioned as a multicloud security and compliance product aimed squarely at DevOps teams. Its core capabilities fall into three areas:
1. Object Storage Security and Violation Chains
One immediately practical feature is visibility into cloud object storage buckets—their current security configurations and any misconfigurations that expose data. Given the long history of data leaks caused by publicly accessible or insufficiently restricted buckets, Secure State surfaces these issues and provides remediation guidance. The product uses the concept of violation chains to show how a sequence of configuration issues can compound into a real risk. “Authenticated user” bucket access chains are highlighted as a particularly useful example.
2. Near Real-Time State Reporting
Modern DevOps environments rely on real-time observability for application performance and infrastructure health. Secure State extends this philosophy to security and compliance by providing near real-time reporting on the security posture of cloud resources. Rather than discovering a breach after the fact, teams receive alerts as anomalous conditions emerge.
Needham offered a concrete example: a project normally accessed through a specific set of tools suddenly showed access via a JVM path instead. The alert fired immediately. In that instance the cause was a new developer experimenting with tooling—but the same signal pattern could indicate an active intrusion or compromised credentials. The value is in getting the information while it is still actionable.
3. Smart Risk Scoring
Security teams routinely face more findings than they can remediate immediately. Secure State’s Smart Risk Scoring generates a prioritized list of risks, helping DevOps and security engineers focus effort on the issues that carry the highest potential impact. Prioritization is especially valuable in multicloud environments where the total attack surface can be large and the volume of raw alerts overwhelming.
How Secure State Fits into the VMware Cloud Portfolio
VMware grouped Secure State with CloudHealth (cloud cost and governance) and Wavefront (metrics and observability) to form a broader cloud management suite. The integration is significant: VMware’s cloud platform was designed with automation-first APIs from the outset, which means adding security and compliance checks to a CI/CD pipeline is a first-class concern rather than an afterthought.
This positions Secure State as a practical DevSecOps tool—one that lets teams embed cloud infrastructure security checks directly into the delivery cycle rather than treating security as a separate, manual gate.
Why This Matters for DevOps Engineers
- Shift-left security: Compliance and security posture checks happen continuously as infrastructure changes, not only during periodic audits.
- Reduced alert fatigue: Risk scoring surfaces what matters most, reducing the noise that causes teams to ignore alerts.
- Multicloud visibility: As organizations span AWS, Azure, GCP, and private clouds, a single pane of glass for security state reduces blind spots.
- Anomaly detection: Real-time state changes—like unexpected access methods—give operations teams early warning that complements traditional SIEM tooling.
Caveats and Context
The original author noted explicitly that he had not used this version of the product firsthand, so the assessment is based on vendor briefings and product documentation rather than hands-on evaluation. Readers evaluating Secure State for their own environments should conduct proof-of-concept testing against their specific multicloud topology and compliance requirements.
It is also worth noting that this article reflects the product as described in mid-2019. VMware’s cloud portfolio has undergone significant change since then—including the Broadcom acquisition of VMware—so the current product name, packaging, and feature set may differ. Verify the current state of the product directly with the vendor.
Summary
VMware Secure State represented a meaningful step toward making cloud security automation a native part of the DevOps workflow rather than a bolt-on concern. By combining bucket misconfiguration detection, near real-time state monitoring, and prioritized risk scoring within the VMware cloud ecosystem, it addressed several of the most persistent pain points for teams managing infrastructure at scale across multiple cloud providers. The underlying thesis—that security and compliance must be automated and integrated into the delivery pipeline—remains as relevant today as it was when CloudCoreo first pursued it.