AI Changed the Threat Landscape. VMware's Answer Is a Security Architecture That Fights Back at Machine Speed

The core security problem with AI is not that it makes attacks better. It is that AI makes attacks faster than human-operated security processes can respond.

According to IBM's 2025 study of 602 organizations, one in four malicious breaches were already AI-enabled, and the FBI logged nearly $893 million in AI-related losses that year. But those numbers reflect AI-assisted attacks, where human operators use AI tools to accelerate what they already know how to do.

The next wave is fundamentally different. Frontier AI models are now probing production code at machine speed, chaining low-severity vulnerabilities into critical exploit paths that no human researcher would have connected. The window between vulnerability discovery and exploitation is collapsing from weeks to hours, and in some cases, minutes.

This article examines how VMware Cloud Foundation, vDefend, and Avi Load Balancer combine to address this new threat landscape with a layered, defense-in-depth security architecture built into the infrastructure itself.

The Three Threats: Faster Discovery, Autonomous Exploitation, Agentic Attack Surfaces

To understand VMware's security approach, it helps to break down what "AI-powered threats" actually means in practice. There are three distinct categories, each requiring a different defensive response.

Accelerated vulnerability discovery. Frontier AI models can analyze source code, binary executables, and network protocols to identify exploitable flaws at a pace that overwhelms traditional patch cycles. VMware's own security team has acknowledged that running frontier AI models against production code "is producing a wave of vulnerability findings that are orders of magnitude higher than historical norms." This is not an anomaly. It is the new baseline.

Autonomous exploit execution. Once vulnerabilities are discovered, AI agents can generate, test, and deploy exploits without human intervention. Traditional security assumed a human attacker with limited time and attention. AI-powered attack agents can run thousands of parallel exploitation attempts, adapt their approach based on defensive responses, and pivot laterally through a network at machine speed. According to CrowdStrike data, 62% of AI-driven attacks in 2025 targeted critical infrastructure sectors.

Agentic AI attack surfaces. For organizations running open-source models, the risks extend beyond network attacks to the models themselves, including supply-chain vulnerabilities in model formats and EDR blind spots (see our analysis: The Hidden Risks of Downloading and Running Open-Source LLMs Locally↗). As enterprises deploy their own AI agents for business processes, a new attack surface emerges. Agents call tools, read datastores, and communicate with other agents over protocols like Model Context Protocol (MCP) and agent-to-agent (A2A). These interactions happen at layers that traditional perimeter controls cannot inspect. A compromised agent with access to a database connector can exfiltrate data at the speed of an API call, not the speed of a human typing queries.

For a deeper look at how Anthropic's own frontier AI model discovered 10,000 zero-day vulnerabilities in a single research exercise, see our earlier analysis: Anthropic Fable 5 Takedown: What 10,000 Zero-Day Vulnerabilities Mean for Enterprise Security↗.

Each of these threats requires security controls that operate at the infrastructure layer, not bolted on top of it.

VMware's Layered Defense: vDefend, Avi, and VCF Security Architecture

VMware's security strategy addresses all three threat categories through a defense-in-depth architecture integrated directly into VMware Cloud Foundation. The key insight is that security enforcement happens at the hypervisor and network fabric level, meaning it is beneath the OS, beneath the application, and beneath the attacker's ability to disable it from inside a compromised workload.

But before examining the specialized security layers, it is worth understanding the security foundation that VCF itself provides. These are not add-ons. They are built into the platform.

The VCF Security Foundation: What Ships in the Box

VCF 9.1 delivers a comprehensive set of platform-level security capabilities that form the baseline every workload inherits, regardless of whether vDefend or Avi are deployed.

Confidential Computing. Intel TDX (Trust Domain Extensions) and AMD SEV-SNP are now generally available in VCF 9.1. These hardware-level technologies encrypt virtual machine memory in use, not just data at rest or in transit. Even a compromised hypervisor administrator cannot read the contents of a TDX-protected workload. For AI inference workloads processing sensitive data, this is a fundamental capability: the model, the input data, and the output all remain encrypted in memory throughout processing.

Encryption everywhere. VCF encrypts data across all three states. vSAN encryption protects data at rest across the storage layer, including clusters using global deduplication. Encrypted vMotion secures workloads during live migration between hosts, now accelerated by Intel QAT hardware offloading that reduces the CPU overhead of encryption operations. VM-level encryption adds another layer for workloads requiring dedicated key management.

ESX Live Patching. Critical security updates can be applied to TPM-enabled hypervisor hosts without migrating workloads or entering maintenance mode. vCenter Quick Patching reduces patching time to approximately five minutes with zero workload disruption. In an environment where frontier AI models are discovering vulnerabilities faster than traditional patch cycles can respond, reducing the window between patch availability and deployment from days to minutes is a meaningful security improvement.

Hypervisor hardening. The User-Level Monitor (ULM) reimplements the virtual machine monitor to run in unprivileged user-mode rather than kernel mode, reducing the hypervisor attack surface. ESX supports EDR integration, running endpoint detection agents in isolated containers on the hypervisor itself, monitoring processes and network activity at the infrastructure layer. File Integrity Monitoring (FIM) detects unauthorized changes to vCenter binaries every four hours, aligned with NIST and PCI DSS requirements.

Compliance automation. The Security Configuration Guide provides a baseline with 260 controls aligned to NIST 800-53 R5, PCI DSS 4.0.1, and the Secure Controls Framework. VMware Advanced Cyber Compliance (ACC) continuously monitors the environment against these baselines and automatically remediates drift using VMware Salt. STIG Readiness Guides provide validated configurations for federal and defense contractor compliance with DISA standards.

Identity and access. VCF Identity Broker centralizes SSO integration with OAuth-based token validation for programmatic interfaces. Fleet-level password policies, vault integration with CyberArk support, break-glass account management, and bulk certificate operations through expanded Microsoft CA and OpenSSL support round out the identity layer.

Centralized audit and visibility. A standardized audit trail provides a time-sliced, centralized view of user activity across all VCF components for forensic analysis. The Security Operations Dashboard delivers single-pane-of-glass visibility into the security configuration state of the entire VCF fleet.

These capabilities mean that even before deploying vDefend for lateral security or Avi for application protection, every workload running on VCF 9.1 inherits hardware-level memory encryption, encrypted storage and migration, automated compliance enforcement, and continuous integrity monitoring. The specialized security layers described below build on this foundation.

vDefend Distributed Firewall: East-West Lateral Security

The most dangerous phase of any breach is not the initial entry. It is the lateral movement that follows, as attackers traverse from a compromised workload to high-value targets like databases, identity stores, and backup systems. This is where vDefend's distributed firewall operates.

Unlike traditional firewalls that sit at network choke points, vDefend embeds security enforcement directly into the hypervisor at every virtual network interface card (vNIC). Every packet moving between workloads passes through policy enforcement, regardless of whether those workloads sit on the same physical host or across the data center.

The performance numbers matter here. VMware's own published benchmarks claim vDefend's distributed firewall in VCF 9.1 delivers 75 Gbps throughput per host on 100G NIC servers under synthetic east-west traffic loads, a 241% improvement over previous generations. VMware further states that across a full VCF instance, that scales to 75 Tbps of inspected east-west traffic with every internal flow inspected at line-rate speeds. These are vendor-reported figures based on controlled lab conditions; real-world throughput will vary with factors like packet size distribution, flow mix, inspection depth, and rule complexity.

Microsegmentation policies can be defined by application identity, workload tags, or security zones, enforcing least-privilege communication rules that limit blast radius even after a successful breach. With approximately 4,000 application IDs for Layer 7 visibility, policies can be granular enough to distinguish between legitimate database queries and exploitation attempts using the same protocol.

vDefend IDPS: Virtual Patching at Machine Speed

When frontier AI models discover a new vulnerability on Monday morning, most enterprises cannot deploy a patch across production by Monday afternoon. Testing, staging, change control, and rollout windows mean critical systems remain exposed for days, weeks, or sometimes months.

vDefend's Intrusion Detection and Prevention System (IDPS) addresses this gap through virtual patching: deploying network-level signatures that block exploit attempts before they reach vulnerable software, without modifying the software itself.

The IDPS operates at the hypervisor level, inspecting traffic at each vNIC with deep packet inspection. VMware reports that its "Turbo IDPS" architecture in VCF 9.1 delivers 17 Gbps per host, an 89% improvement over previous generations, scaling to what VMware claims is 17 Tbps of distributed virtual patching capacity per VCF instance. Signatures are updated multiple times daily, and custom signatures can be deployed for rapid response to zero-day exploits.

This is particularly relevant for AI-discovered vulnerabilities. When a frontier AI model identifies a new exploit path, a virtual patch can be deployed across every workload in the environment within hours, long before the traditional patching process even begins. The IDPS also maps alerts to the MITRE ATT&CK framework, providing security teams with kill-chain visibility into how attacks progress through the environment.

Concrete examples illustrate the value: vDefend IDPS signatures already protect against well-known exploitation patterns like Log4Shell (CVE-2021-44228), MOVEit Transfer authentication bypass (CVE-2024-5806), and more recent AI-discovered vulnerabilities like Ni8n8mare (CVE-2026-21858), blocking malformed payloads before they reach the application layer.

Avi Load Balancer: North-South Application and API Protection

While vDefend secures internal traffic, Avi Load Balancer protects the north-south boundary where internet-facing applications meet external traffic. Avi has evolved from a traditional load balancer into a full Web Application and API Protection (WAAP) platform.

This matters because the attack surface is expanding. According to industry data, 87% of global organizations suffered an API security incident last year, and 43% of CISA's known exploited vulnerabilities are API-related. As organizations expose AI-powered services through APIs, these endpoints become high-value targets.

Avi's WAAP capabilities include WAF protection against OWASP Top 10 threats, distributed DDoS mitigation, advanced bot management, Layer 7 rate limiting, IP reputation filtering, and SSL/TLS termination, all within a single software-defined architecture. The system uses closed-loop analytics and AI-assisted application learning to establish a positive security model that validates known-good behavior in real time, rather than relying solely on blocking known-bad patterns.

For API security specifically, Avi automatically discovers API traffic using AI/ML without manual developer input, then classifies endpoints into Shadow, Orphan, Zombie, and Active categories (the SOZA framework). Shadow APIs are undocumented endpoints that developers forgot about. Zombie APIs are deprecated endpoints still accepting traffic. Both represent attack surfaces that most organizations do not even know they have.

On the performance side, VMware claims Avi delivers 12.25 Tbps of scale-out throughput per controller instance, an 88% increase over previous releases, with elastic auto-scaling that adjusts capacity based on traffic patterns. As with the vDefend figures, these are vendor-published numbers from controlled testing environments.

Securing Agentic AI Workloads: The New Frontier

An important distinction: the VCF platform security, vDefend distributed firewall, vDefend IDPS, and Avi WAAP capabilities described above are production-proven, shipping, and benchmarked. The agentic AI security capabilities described in this section are newly announced architecture. They represent Broadcom's stated direction for securing autonomous AI workloads, but enterprises should evaluate them as emerging technology rather than production-validated infrastructure.

As enterprises deploy autonomous AI agents that interact with tools, databases, and other agents, a new class of security challenges emerges that traditional controls were never designed to address. These include agent identity lifecycle management, tool authorization boundaries, intent validation, agent-to-agent trust, prompt injection defense, and policy complexity at scale.

At VMware Explore 2026, Broadcom announced three integrated solutions targeting these challenges on Private AI Cloud:

vDefend for agentic discovery. vDefend automatically identifies agentic AI components, including MCP servers, LLMs, datastores, and tools, by continuously monitoring traffic flows across VCF. This addresses the shadow AI problem: AI agents deployed by business units without security team awareness. The platform also generates AI-powered IDPS signatures using its own agentic pipeline, fighting AI with AI at the network layer.

Avi for agent and tool control. Avi inspects agent-to-tool communications to prevent misuse, blocking unauthorized MCP tool access, remote code execution attempts, and file injection attacks. The system establishes baseline traffic patterns across agents, LLMs, and tools, then identifies and isolates anomalous behavior in real time. Data protection policies prevent agents from exfiltrating credentials, PII, and sensitive financial data.

AgentMinder for identity governance. For a full deep-dive on AgentMinder's architecture and enforcement model, see our analysis: Broadcom AgentMinder: Identity-First Governance for Agentic AI↗. The newly announced AgentMinder treats autonomous agents as enterprise-grade identities, binding their authority to declared missions, approved tools, and authorized resources. A cloud-native gateway evaluates identity, tool, intent, and resource permissions on every tool invocation using least-privilege policies. Built on OpenTelemetry, it provides compliance-grade audit trails for every agent session and action.

The architectural principle is defense-in-depth for agentic workloads: network segmentation via vDefend, application-layer inspection via Avi, and identity governance via AgentMinder, each operating at a different layer and each capable of blocking threats the others might miss. The architecture is conceptually sound, but open questions remain around policy explosion as agent populations grow, false positive rates in intent validation, secrets management across agent chains, and how effectively these controls handle model compromise or sophisticated prompt injection. These are challenges the industry as a whole is still working through, not just VMware.

The Operational Model: From Reactive Patching to Continuous Defense

VMware's Frontier AI Security Readiness Program, launched August 31, 2026, formalizes the operational methodology around these technologies into four stages:

Assess. Conduct a VCF Security Assessment using web-based tools with risk-based scoring across production and DMZ environments to establish a security baseline. Organizations can apply for the program and access the assessment through the Frontier AI Security Readiness Program portal↗.

Architect. Apply VCF Security Blueprints across five pillars: People and Process, Platform Security, User Security, Lateral Security, and Application Security and Recovery. The full set of VCF 9.1 Design Blueprints↗ is available on Broadcom TechDocs, including the vDefend Lateral Security Design Blueprints↗. For hardening baselines and compliance guidance, the VCF Security and Compliance Guidelines↗ repository on GitHub provides technical security guidance, code samples, and configuration baselines aligned to NIST, PCI DSS, and DISA STIG standards.

Implement. Deploy hardened configurations with automated patching, continuous monitoring, and AI-assisted triage and remediation capabilities. The VCF Security Configuration Guide↗ provides the 260-control baseline for implementation.

Upskill. Develop organizational capability through the VCF 9.1 security curriculum and the forthcoming AI Resilient Infrastructure Expert (ARIE) certification track.

The program reflects a broader shift in security thinking. When attackers operate at machine speed, human-paced response processes are a liability. The goal is not to eliminate human judgment from security operations, but to compress the gap between threat detection and defensive response to something that matches the speed of the threat itself.

Air-Gapped and Compliance Environments

A significant operational detail: all vDefend capabilities now function in completely air-gapped environments, with offline threat intelligence updates that can be downloaded and manually uploaded without cloud connectivity. The on-premises malware prevention sandbox eliminates the need to send files to external services for analysis, keeping sensitive data within local data centers.

For a broader look at how VCF 9.1 enables secure on-prem AI deployment, including MCP support, GPU pooling, and TCO analysis, see: VCF 9.1 Private AI Services: How to Run Enterprise AI On-Prem↗.

This matters for regulated industries. Organizations operating under HIPAA, PCI-DSS, or government security requirements cannot always send network traffic or suspicious files to cloud-based security services. vDefend's fully on-premises architecture means zero trust lateral security, virtual patching, and malware analysis all operate without any external dependency.

What This Means for Enterprise Security Strategy

The technical capabilities are real, but the strategic implications are what matter most.

First, the patch window problem is being solved architecturally, not operationally. Instead of trying to patch faster, virtual patching at the hypervisor layer provides immediate protection while traditional patching follows its necessary testing and rollout process.

Second, east-west security at line rate changes the economics of microsegmentation. When inspecting every internal packet was a performance penalty, organizations made pragmatic compromises. If VMware's reported 75 Tbps figure holds across real-world traffic patterns, flow mixes, and rule complexity, the performance barrier becomes substantially less significant for many high-throughput workloads. That does not eliminate every deployment consideration, but it removes the single biggest objection enterprises have historically raised against comprehensive lateral security.

Third, the agentic AI security story is still early, but VMware is staking out a position as the infrastructure layer where agent governance happens. If enterprises run their AI workloads on VCF, the argument goes, security enforcement happens beneath the agent, at a layer the agent cannot circumvent.

Whether this layered architecture delivers on its promise depends on execution: how quickly signatures are updated, how accurately agentic discovery identifies shadow AI, and how effectively AgentMinder's governance policies scale across thousands of autonomous agents. The technology exists. The operational maturity will determine whether it matters.

---

VMware Cloud Foundation 9.1, vDefend, and Avi Load Balancer collectively represent VMware's most comprehensive security response to the AI-accelerated threat landscape. With frontier AI models discovering vulnerabilities at machine speed and autonomous agents creating new attack surfaces, the case for infrastructure-native security has never been stronger.

References

1. VMware, "Frontier AI Security Readiness Program," VMware Cloud Foundation Blog, August 31, 2026. https://blogs.vmware.com/cloud-foundation/2026/08/31/frontier-ai-security-readiness-program/↗

2. VMware, "AI Has Changed the Threat Landscape. Is Your Infrastructure Ready?" VMware Cloud Foundation Blog, May 11, 2026. https://blogs.vmware.com/cloud-foundation/2026/05/11/ai-has-changed-the-threat-landscape-is-your-infrastructure-ready/↗

3. VMware, "VMware vDefend IDPS: Frontier AI," VMware Security Blog, August 2026. https://blogs.vmware.com/security/2026/08/vmware-vdefend-idps-frontier-ai.html↗

4. VMware, "VMware vDefend Advances Multi-Layer Lateral Security, Deployment Automation and Performance for the Frontier AI Era," VMware Security Blog, August 2026. https://blogs.vmware.com/security/2026/08/vdefend-ssp-for-frontier-ai-era.html↗

5. VMware, "vDefend for VCF 9.1: Zero Trust Lateral Security for the AI Era," VMware Security Blog, May 2026. https://blogs.vmware.com/security/2026/05/vdefend-vcf-9-1-zero-trust.html↗

6. VMware, "Virtual Patching: Guarding Against a Tsunami of AI-discovered Exploits with vDefend and Avi," VMware Load Balancing Blog, April 11, 2026. https://blogs.vmware.com/load-balancing/2026/04/11/virtual-patching-guarding-against-a-tsunami-of-ai-discovered-exploits-with-vdefend-and-avi/↗

7. VMware, "Avi Strengthens Web Application Security, Boosts Performance and Improves Operational Efficiency," VMware Load Balancing Blog, August 6, 2026. https://blogs.vmware.com/load-balancing/2026/08/06/avi-waap-and-ai-assistant/↗

8. Broadcom, "Broadcom Delivers End-to-End Security, Identity, and Observability for Agentic AI," Broadcom Investor Relations, August 31, 2026. https://investors.broadcom.com/news-releases/news-release-details/broadcom-delivers-end-end-security-identity-and-observability↗

9. Broadcom, "VMware by Broadcom Response to AI Security," Broadcom Knowledge Base, Article 440443. https://knowledge.broadcom.com/external/article/440443/vmware-by-broadcom-response-to-ai-securi.html↗

10. Broadcom, "Agentic Zero Trust Threat Defense: VMware vDefend and Avi," Broadcom Newsroom. https://www.broadcom.com/company/news/articles/cloud/agentic-zero-trust-threat-defense-vmware-vdefend-avi↗

11. IBM, "Cost of a Data Breach Report 2025," IBM Security.

12. CrowdStrike, "Global Threat Report 2026," CrowdStrike.

13. VMware, "Frontier AI and VMware Cloud Foundation Security: Top Resources at VMware Explore 2026," VMware Cloud Foundation Blog, August 19, 2026. https://blogs.vmware.com/cloud-foundation/2026/08/19/frontier-ai-and-vmware-cloud-foundation-security-top-resources-at-vmware-explore-2026/↗

14. DeepStrike, "AI Cyber Attack Statistics 2026: Costs, Cases & Defense." https://deepstrike.io/blog/ai-cyber-attack-statistics-2025↗

15. VMware, "Strengthen Zero Trust Security and Resilience with VCF 9.1," VMware Cloud Foundation Blog, May 5, 2026. https://blogs.vmware.com/cloud-foundation/2026/05/05/platform-security-vcf-9-1/↗

16. VMware, "Securing your VMware Cloud Foundation 9.1 Environment," VMware Cloud Foundation Blog, August 6, 2026. https://blogs.vmware.com/cloud-foundation/2026/08/06/securing-your-vmware-cloud-foundation-9-1-environment/↗

17. Broadcom, "VCF 9.1 Design Blueprints," Broadcom TechDocs. https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/design/design-blueprints-for.html↗

18. VMware, "VCF Security and Compliance Guidelines," GitHub. https://github.com/vmware/vcf-security-and-compliance-guidelines↗

19. Broadcom, "VCF 9.1 Security and Compliance," Broadcom TechDocs. https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/security-and-compliance.html↗

20. VMware, "Introducing VMware vDefend Lateral Security Design Blueprints for VCF 9.1," VMware Security Blog, June 2026. https://blogs.vmware.com/security/2026/06/vdefend-design-blueprints-vcf-9-1.html↗