VMware vDefend Advanced Threat Prevention

VMware vDefend Advanced Threat Prevention is a purpose-built network security solution designed to detect and prevent advanced threats traversing east-west (lateral) traffic within software-defined data centers and multi-cloud environments. Formerly part of the VMware NSX security portfolio and rebranded under the vDefend product line in 2025-Q1, it delivers integrated Intrusion Detection and Prevention System (IDS/IPS) capabilities alongside Network Detection and Response (NDR) functions directly at the workload level, without requiring dedicated physical appliances or network hairpinning.

The solution operates as a distributed security service tightly coupled with VMware NSX, inspecting traffic flows between virtual machines, containers, and bare-metal workloads at line rate. Its threat-detection engine combines signature-based IDS/IPS rules with behavioral analytics and network traffic analysis (NTA) to identify lateral movement, command-and-control callbacks, malware propagation, and zero-day exploitation attempts. Threat intelligence feeds are continuously updated through VMware's threat research infrastructure, and detected events are correlated and surfaced through a unified security console integrated with NSX Manager.

VMware vDefend Advanced Threat Prevention is targeted at enterprise organizations seeking to enforce micro-segmentation security postures with active threat prevention rather than passive monitoring alone. It is particularly suited to regulated industries—including financial services, healthcare, and government—that require deep packet inspection of internal traffic to satisfy compliance mandates such as PCI-DSS, HIPAA, and NIST frameworks. The solution is offered under a subscription licensing model (part number VDEFEND-ATP-C-SUB), enabling flexible term-based procurement aligned to organizational capacity requirements.

Ideal for

• Detecting and blocking lateral movement by threat actors who have breached a perimeter control and are attempting to propagate across internal workloads within a VMware NSX-segmented data center.
• Enforcing active IDS/IPS inspection on east-west traffic between application tiers (web, application, and database layers) without redirecting traffic to out-of-band physical security appliances.
• Satisfying PCI-DSS Requirement 11.4 and similar compliance mandates that require intrusion detection and prevention mechanisms on internal network segments handling cardholder or sensitive data.
• Providing network detection and response (NDR) visibility into encrypted and unencrypted lateral traffic flows for security operations center (SOC) teams conducting threat hunting and incident investigation.
• Integrating east-west threat event data with SIEM and SOAR platforms to enable automated response playbooks triggered by confirmed IDS/IPS alerts within the virtualized infrastructure.
• Extending consistent advanced threat prevention policy across hybrid and multi-cloud environments where workloads span on-premises NSX deployments and VMware Cloud instances.

Technical specifications

Available from Omnixon Global. Submit an RFQ and our team will confirm configuration and availability for your order.