Assess Your ESX and vCenter Risk

WELCOME TO THE ESX AND VCENTER RISK ASSESSMENT

For each statement, select:

Yes = Confident, validated control in place

Somewhat = Partial, inconsistent, or untested

No = Not in place / unknown

INITIAL ACCESS

Access to ESX hosts and management interfaces is restricted and not directly exposed.(Required)

Yes

Somewhat

MFA is enforced across all hypervisor and vCenter access paths.(Required)

Yes

Somewhat

We can detect unauthorized access attempts to ESXi in real time.(Required)

Yes

Somewhat

Our vCenter and ESX hypervisors are fully patched and up to date.(Required)

Yes

Somewhat

EXECUTION

We have visibility into commands executed directly on ESX hosts in real time.(Required)

Yes

Somewhat

We can detect suspicious or unauthorized execution at the hypervisor layer as it occurs(Required)

Yes

Somewhat

We can distinguish legitimate admin activity from malicious behavior in real time.(Required)

Yes

Somewhat

PERSISTENCE

We monitor for unauthorized changes to ESX configurations and services in real time.(Required)

Yes

Somewhat

We can detect persistence mechanisms that survive reboot.(Required)

Yes

Somewhat

We regularly validate the integrity of hypervisor configurations.(Required)

Yes

Somewhat

PRIVILEGE ESCALATION

Least privilege is enforced across ESX and vCenter access.(Required)

Yes

Somewhat

Privileged accounts are segmented to limit blast radius.(Required)

Yes

Somewhat

We detect abnormal privilege changes or misuse in real time.(Required)

Yes

Somewhat

DEFENSE EVASION

We maintain security visibility at the hypervisor layer (not just inside VMs).(Required)

Yes

Somewhat

We can detect tampering with security controls on ESX in real time.(Required)

Yes

Somewhat

We can identify attacker activity that mimics legitimate behavior as it occurs.(Required)

Yes

Somewhat

CREDENTIAL ACCESS

ESX and vCenter credentials are securely stored and regularly rotated.(Required)

Yes

Somewhat

We detect suspicious authentication or credential misuse in real time.(Required)

Yes

Somewhat

Service accounts and automation credentials are tightly controlled.(Required)

Yes

Somewhat

DISCOVERY

We can detect enumeration of VMs, datastores, and infrastructure in real time.(Required)

Yes

Somewhat

Access to infrastructure metadata is restricted by role.(Required)

Yes

Somewhat

Abnormal discovery activity would trigger alerts as it occurs.(Required)

Yes

Somewhat

LATERAL MOVEMENT

ESX hosts and management planes are segmented to limit movement.(Required)

Yes

Somewhat

We can detect pivoting across hosts, clusters, or vCenter in real time.(Required)

Yes

Somewhat

A single host compromise can be contained.(Required)

Yes

Somewhat

COLLECTION

We monitor access to VM disks, snapshots, and memory in real time.(Required)

Yes

Somewhat

Bulk or unusual data access across VMs is detectable as it occurs.(Required)

Yes

Somewhat

Snapshot and backup access is controlled and audited.(Required)

Yes

Somewhat

COMMAND & CONTROL

Outbound communication from ESXi hosts is restricted and monitored in real time.(Required)

Yes

Somewhat

We can detect abnormal external connections or beaconing as it occurs.(Required)

Yes

Somewhat

Management channels are monitored for misuse in real time.(Required)

Yes

Somewhat

EXFILTRATION

Data movement from ESX hosts is monitored in real time.(Required)

Yes

Somewhat

Large or unusual exports (VMs, snapshots) trigger alerts as they occur.(Required)

Yes

Somewhat

Backup/replication channels are secured against misuse.(Required)

Yes

Somewhat

IMPACT

We can detect and stop actions impacting multiple VMs simultaneously as they occur(Required)

Yes

Somewhat

We can isolate a compromised host quickly.(Required)

Yes

Somewhat

Backups and recovery mechanisms are protected from tampering.(Required)

Yes

Somewhat

We can recover critical workloads rapidly after a hypervisor incident.(Required)

Yes

Somewhat

This field is hidden when viewing the form

Total Score(Required)

ASSESS YOUR ESX AND VCENTER RISK

WELCOME TO THE ESX AND VCENTER RISK ASSESSMENT

INITIAL ACCESS

EXECUTION

PERSISTENCE

PRIVILEGE ESCALATION

DEFENSE EVASION

CREDENTIAL ACCESS

DISCOVERY

LATERAL MOVEMENT

COLLECTION

COMMAND & CONTROL

EXFILTRATION

IMPACT