Assess Your ESX and vCenter Risk

Step 1 of 13

INITIAL ACCESS

Access to ESX hosts and management interfaces is restricted and not directly exposed.(Required)

Yes

Somewhat

I don't know

MFA is enforced across all hypervisor and vCenter access paths.(Required)

Yes

Somewhat

I don't know

We can detect unauthorized access attempts to ESXi in real time.(Required)

Yes

Somewhat

I don't know

Our vCenter and ESX hypervisors are fully patched and up to date.(Required)

Yes

Somewhat

I don't know

EXECUTION

We have visibility into commands executed directly on ESX hosts in real time.(Required)

Yes

Somewhat

I don't know

We can detect suspicious or unauthorized execution at the hypervisor layer as it occurs(Required)

Yes

Somewhat

I don't know

We can distinguish legitimate admin activity from malicious behavior in real time.(Required)

Yes

Somewhat

I don't know

PERSISTENCE

We monitor for unauthorized changes to ESX configurations and services in real time.(Required)

Yes

Somewhat

I don't know

We can detect persistence mechanisms that survive reboot.(Required)

Yes

Somewhat

I don't know

We regularly validate the integrity of hypervisor configurations.(Required)

Yes

Somewhat

I don't know

PRIVILEGE ESCALATION

Least privilege is enforced across ESX and vCenter access.(Required)

Yes

Somewhat

I don't know

Privileged accounts are segmented to limit blast radius.(Required)

Yes

Somewhat

I don't know

We detect abnormal privilege changes or misuse in real time.(Required)

Yes

Somewhat

I don't know

DEFENSE EVASION

We maintain security visibility at the hypervisor layer (not just inside VMs).(Required)

Yes

Somewhat

I don't know

We can detect tampering with security controls on ESX in real time.(Required)

Yes

Somewhat

I don't know

We can identify attacker activity that mimics legitimate behavior as it occurs.(Required)

Yes

Somewhat

I don't know

CREDENTIAL ACCESS

ESX and vCenter credentials are securely stored and regularly rotated.(Required)

Yes

Somewhat

I don't know

We detect suspicious authentication or credential misuse in real time.(Required)

Yes

Somewhat

I don't know

Service accounts and automation credentials are tightly controlled.(Required)

Yes

Somewhat

I don't know

DISCOVERY

We can detect enumeration of VMs, datastores, and infrastructure in real time.(Required)

Yes

Somewhat

I don't know

Access to infrastructure metadata is restricted by role.(Required)

Yes

Somewhat

I don't know

Abnormal discovery activity would trigger alerts as it occurs.(Required)

Yes

Somewhat

I don't know

LATERAL MOVEMENT

ESX hosts and management planes are segmented to limit movement.(Required)

Yes

Somewhat

I don't know

We can detect pivoting across hosts, clusters, or vCenter in real time.(Required)

Yes

Somewhat

I don't know

A single host compromise can be contained.(Required)

Yes

Somewhat

I don't know

COLLECTION

We monitor access to VM disks, snapshots, and memory in real time.(Required)

Yes

Somewhat

I don't know

Bulk or unusual data access across VMs is detectable as it occurs.(Required)

Yes

Somewhat

I don't know

Snapshot and backup access is controlled and audited.(Required)

Yes

Somewhat

I don't know

COMMAND & CONTROL

Outbound communication from ESXi hosts is restricted and monitored in real time.(Required)

Yes

Somewhat

I don't know

We can detect abnormal external connections or beaconing as it occurs.(Required)

Yes

Somewhat

I don't know

Management channels are monitored for misuse in real time.(Required)

Yes

Somewhat

I don't know

EXFILTRATION

Data movement from ESX hosts is monitored in real time.(Required)

Yes

Somewhat

I don't know

Large or unusual exports (VMs, snapshots) trigger alerts as they occur.(Required)

Yes

Somewhat

I don't know

Backup/replication channels are secured against misuse.(Required)

Yes

Somewhat

I don't know

IMPACT

We can detect and stop actions impacting multiple VMs simultaneously as they occur(Required)

Yes

Somewhat

I don't know

We can isolate a compromised host quickly.(Required)

Yes

Somewhat

I don't know

Backups and recovery mechanisms are protected from tampering.(Required)

Yes

Somewhat

I don't know

We can recover critical workloads rapidly after a hypervisor incident.(Required)

Yes

Somewhat

I don't know

TOTAL POINTS:(Required)

0–19: HIGH RISK

Hypervisor-level controls are limited or absent. An attacker could gain access and impact multiple workloads with little resistance—and minimal real-time visibility.

20-38: EXPOSED

Controls exist, but not where or when it matters. Without real-time enforcement at the hypervisor layer, attackers can bypass defenses using valid credentials and native tools. This is where most organizations sit and what most modern attack playbooks are built for

39-57: PARTIALLY SECURE

Some areas are well-defended, but coverage is inconsistent. Gaps in real-time detection and hypervisor-layer control leave paths for attackers to operate and achieve broad impact before containment.

58-76: PREEMPTIVELY SECURE

Controls operate in real time at the hypervisor layer. Threats can be stopped early, limiting spread, impact, and time to containment.

Share your score with a Vali Cyber Engineer.

We’ll review it with you and offer tips and insights into how to better protect your hypervisors.

Name(Required)

First Last

Business Email(Required)