Defense-in-Depth for Hypervisors

ZeroLock® runs directly on the hypervisor to stop attacks before they start, catch what can get past, and undo the damage.

Unlike endpoint tools that operate inside workloads, ZeroLock protects the virtualization layer itself, where attackers can manipulate hosts, virtual machines, and storage simultaneously.

Request a Demo
ZeroLock graphic

Hypervisor-Native Security Architecture

ZeroLock runs directly on the hypervisor to monitor and control activity at the virtualization layer, with no kernel modules and no changes to the hypervisor.

Architecture overview

vCenter

ZeroLock

Applications
Guest Operating Systems
Virtual Machines

Endpoint Security
Network Security
Identity Security

Hypervisor

ZeroLock Hypervisor Security

Hardware

Infrastructure Security

Because protection occurs at the hypervisor layer:

  • No agents are required inside virtual machines
  • Guest operating systems remain untouched
  • Controls apply to every workload on the host
  • Visibility extends below the operating system
ZeroLock graphic

ZeroLock sees and controls activity at the layer where most security tools stop, which is exactly where attackers have moved.

See Defense-in-Depth for Hypervisors in Action

5 minute demo video

Preempt

Stop attacks before they start.

Attackers increasingly arrive with valid credentials or a fresh exploit. These controls stop them at the hypervisor, before they can touch workloads or infrastructure.

CLI-MFA

ZeroLock requires MFA on the commands you choose at the moment of action, not just at login. Even an attacker with an active session can’t stop VMs, delete files, or remove security tools without proving who they are again.

Exploit Prevention & Virtual Patching

Lockdown rules break the exploit instead of waiting for the patch, so your team patches on its own schedule. New rules ship within 24 hours for CVSS 7.0+ vulnerabilities.

Application Allowlisting

Hypervisors run a small, predictable set of processes. ZeroLock inventories approved applications and blocks anything new before it can run.

Data Exfiltration & File Access Prevention

Restricts which processes can read, write, or modify VMX, VMDK, and snapshot files, and can block outbound connections an attacker would use to pull data off.

Canary Files

Decoy files that legitimate processes never touch. Any attempt to read, encrypt, or move one signals an attack, even a zero-day.

Anti-tampering

Locks down ZeroLock’s own files, processes, and configuration, so even root on a host or vCenter admin can’t disable it or loosen its policy.

Protect

Detect and undo what may get through.

No security strategy is static, which is why resilience matters as much as prevention. Patented AI behavioral detection runs inside the agent and catches what can get past, even attacks no rule anticipates.

AI Behavioral Detection

Sees the pattern of an attack, like mass VM shutdown, snapshot deletion, or encryption, even when attackers use only built-in tools.

Ransomware & Wiperware Protection

Stops destructive attacks in real time, with models that make every decision locally, without calling out to a cloud.

Real-time Remediation & Automated Rollback

Restores encrypted files to their pre-attack state and removes attacker persistence automatically, so workloads are running again in seconds.

Process Tree Visibility

Shows exactly how each attack unfolded, so your team can validate remediation, explain impact to auditors, and refine policy.

Perform

Built for how your team works.

Attackers aren’t limited to one platform, and your SOC can’t defend what it can’t see. One lightweight ZeroLock agent protects most major hypervisors, deploys in minutes, and streams every event into the SIEM and SOAR tools you already run, all while preserving performance, uptime, and control.

Lightweight

50MB of RAM, 100MB of disk, and under 5% of one CPU core, with no kernel modules or changes to the hypervisor.

Rapid Deployment

One-line install, up and running in minutes, with ESX deployment through vCenter and vLCM.

Most Major Hypervisors

VMware Cloud Foundation 9.x, VMware ESX(i) 6.7+, Nutanix-managed ESXi 6.7+, Nutanix AHV 2017+*, Citrix Hypervisor 8.0+, XenServer 6.5+, XCP-ng 8.3+, Proxmox 3.0+, Red Hat Enterprise Virtualization 3.6+, HPE Morpheus 8.0+, Dell VxRail 4.8+, and KVM (kernel 3.5+). Licensing transfers across platforms.
*Nutanix does not currently support third-party products running on AHV.

Flexible Deployment Options

SaaS or self-hosted, including air-gapped and intermittently connected environments, with the same protection either way.

Built into Your SOC

A certified CrowdStrike Falcon Next-Gen SIEM integration, plus Splunk, Google SecOps, Microsoft Sentinel, Sumo Logic, Elastic, and Swimlane. The full API is at api.zerolock.com.

Broadcom-Signed VIB

Deploys without lowering the host acceptance level and keeps you eligible for Broadcom support.

Case Studies

ZeroLock in Action

See how organizations across sectors use ZeroLock to protect their core.

TECH SPECS

ZeroLock® Endpoint Agent Requirements for Hypervisors

OS

  • VMware Cloud Foundation 9.X
  • VMware ESXi, 6.7+ (Older versions supported upon request.)
  • Nutanix-managed ESXi, 6.7+
  • Nutanix AHV 2017+*
  • XenServer, 6.5+
  • Citrix Hypervisor, 8.0+
  • XCP-ng 8.3+
  • Proxmox, 3.0+
  • Red Hat Enterprise Virtualization, 3.6+
  • HPE Morpheus, 8.0+
  • Dell VxRail, 4.8+
  • KVM, Kernel 3.5+

* Note, Nutanix does not currently support third-party products running on AHV.

Processor

x86-64, ARM-64 (coming soon)

Memory

50MB

Disk Space

100MB

Kernel Mods.

No kernel modification or modules required

Installation Methods

  • One-line, web-based deployment (Wget)
  • File-based deployment (Tar.gz or Bash)
  • VCF & ESXi: Signed VIB and deployable via vCenter
ZeroLock® Server Requirements (only required for on-prem deployment)

RAM

16GB

Disk Space

128GB (dependent on number of endpoints and data retention duration)

CPU Cores

6 or more recommended

Installation Reqs.

  • Self-deployment: Latest version of Docker installed
  • OVA-deployment: ESXi 7.0 or later
ZeroLock® Bidirectional API-First Architecture

Documentation

Visit api.zerolock.com for a full API

Existing integrations

  • SIEM: Splunk, Sumo Logic, Elastic, Google SecOps, CrowdStrike Next-Gen
  • SOAR: Swimlane
  • Incident API: Veeam
Download Our One-Sheet

Cover Your Core Before the Next Attack

Modern attacks target the foundation of enterprise computing. ZeroLock stops them, catches what can get past, and undoes the damage before it becomes an incident.

Talk to an Engineer

Integrated with

CrowdStrike
Google Security Operations
Splunk
Swimlane
veeam