New enhancements include a prescriptive workflow to accelerate Advanced Threat Prevention (ATP) deployment, an on-premises Malware Prevention System, comprehensive air-gapped support, an AI Assistant for firewall operations, major performance gains for the Distributed Firewall and Intrusion Detection and Prevention Service (IDPS), and automated migration tooling.
Earlier in May, VMware vDefend delivered Self-Service Lateral Security for VMware Cloud Foundation (VCF) 9.1, featuring support for unified lateral threat prevention for VMs and VKS workloads, high-performance threat prevention with IDPS Turbo Mode, and enhanced distributed firewall capabilities.
As Frontier AI continues to reshape the threat landscape, enterprises face new challenges in securing, operating, and scaling their private clouds. Attackers are using Frontier AI to exploit software vulnerabilities at machine speed, and the rapid adoption of agentic AI is drastically expanding the attack surface. At the same time, fragmented tools and manual processes are slowing down security teams, while rising hardware costs make it difficult for organizations to scale efficiently.
VMware vDefend addresses these challenges with new innovations focused on three pillars: enhanced security, simplified operations, and optimized performance and resources.
The detailed innovations under these three pillars are as follows:
The sections below describe each vDefend innovation in detail and highlight customer benefits.
Infiltration occurs when network traffic goes uninspected; therefore, implementing IDPS across all workloads, not just mission-critical ones, is essential. Additionally, robust network security requires zero-day threat detection and mitigation capabilities.
vDefend 1-2-3 for ATP is a new guided workflow that accelerates the deployment of Advanced Threat Prevention across private cloud environments. Designed similarly to the vDefend 1-2-3-4 for DFW workflow for lateral (macro and micro) segmentation, ATP workflow streamlines the implementation of IDPS, Network Traffic Analysis (NTA), and Network Detection and Response (NDR), reducing deployment times from months to weeks.
The workflow consists of three stages:
By using this guided workflow, IT teams can rapidly deploy Advanced Threat Prevention, including virtual patching and zero-day threat mitigation, to strengthen security posture and compliance.
Highly regulated industries face strict data sovereignty requirements and compliance standards such as HIPAA and GDPR, which make it essential to keep sensitive data and files inside local data centers. vDefend now offers an on-premises Malware Prevention System (MPS) that meets these requirements without compromising threat detection. This architecture brings malware sandboxing directly into the local data center, eliminating the need to upload files to an external public cloud. By keeping all sensitive data, files, and metadata strictly inside local boundaries, enterprises remove external attack surfaces while maintaining full control over their sensitive data.
For infrastructure requiring absolute operational isolation and strict data privacy, defending against modern threats without exposing internal systems to the internet is critical.
vDefend now offers a comprehensive, air-gapped deployment model to keep all network traffic, files, and data strictly inside the local data center. It eliminates external dependencies and public cloud connectivity. Security teams can safely download offline threat intelligence updates and manually upload them to vDefend. This maintains up-to-date signatures against new threats without connecting to external cloud services.
Complex workflows and troubleshooting slow infrastructure and security teams down, consuming time, introducing risk, and holding back business agility. To reduce this complexity, VMware is introducing an AI Assistant for vDefend. By embedding intelligence directly into the platform, the tool accelerates troubleshooting, provides version-aware design guidance, and automates policy cleanup to eliminate duplicate and redundant rules. It also offers real-time visibility into live configurations, performance metrics, security events, and API assistance for automation. This operational intelligence allows security teams to streamline day-to-day operations and improve overall efficiency.
Enterprise IT teams need deep traffic visibility and security posture assessments to manage security risks effectively. The Security Services Platform (SSP) serves as a scale-out data lake that ingests network flow records and telemetry, providing granular flow visibility, security assessment scores, policy recommendations, and guided workflows. With rising server costs, vDefend now offers a leaner SSP deployment model with a lower-footprint entry point starting at 32 CPU cores. This new deployment model reduces physical server requirements by up to 33%, allowing organizations to lower infrastructure costs. The scale-out architecture of the SSP platform allows it to expand as needs grow.
vDefend delivers major performance improvements across both the Distributed Firewall (DFW) and IDPS engines.
Migrating from legacy, agent-based firewall solutions is often slow and resource-intensive due to the manual effort required to translate complex rule sets. To eliminate this deployment friction, VMware offers the vDefend and Avi Conversion Tool (vACT) to automate security policy migrations. The tool automatically converts existing firewall rules and configurations directly into native vDefend policies. By accelerating transition and minimizing manual errors, vACT enables organizations to reduce overall migration costs and improve lateral security posture more quickly.
The new enhancements are delivered in vDefend Security Services Platform 5.2, vDefend 9.1.1, and vDefend and Avi Conversion Tool (vACT) 3.0 releases, all of which are compatible with the VCF private cloud 9.1 release.
As enterprises deploy agentic AI in their private cloud, Zero Trust lateral security will be necessary day one. Additionally, security technologies must recognize new agentic AI constructs, such as LLMs, agents, tools and AI protocols. One example is the Model Context Protocol (MCP), which enables agents to interact with various enterprise tools, data, and services. In addition to securing MCP traffic, it is important to harden the MCP itself in line with established enterprise-ready protocols like HTTP, SIP, SSH, and TLS. vDefend engineers took a leading role by championing a proposal to harden stateless MCP interactions, which is now reflected in Agentic AI Foundation’s updated MCP specification released in July 2026 (see coverage in the Ars Technica article). Such collaborations are critical for achieving the visibility and policy enforcement required to secure agentic AI workloads.
Modern enterprises require a multi-layer private cloud lateral defense that is distributed, automated, and high-performance to protect workloads against evolving, AI-driven threats. The latest vDefend enhancements further strengthen the solution through streamlined Advanced Threat Prevention workflows, flexible deployment models for highly sensitive environments, AI-assisted firewall operations, and significantly improved distributed firewall and IDPS performance. Together, these innovations enable security teams to stay ahead of threats and ensure the robust, multi-layer security required for modern private clouds.
To learn more about vDefend, see the links below.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。