Ransomware has moved past endpoints. Attackers now go straight for virtualization infrastructure, where a single breach can cripple dozens of systems at once. That shift has exposed a weakness in many security stacks that still treat hypervisors as out of scope or assume backups are enough.
Arms Cyber is responding to that reality by expanding its anti-ransomware platform to protect hypervisors directly, alongside Windows, Linux, and macOS environments. The goal is simple: close the gap between where attackers are operating and where defenses are actually enforced.
Why hypervisors have become a high-value target
Virtualization concentrates risk. Compromising a hypervisor gives attackers leverage over entire environments, not just individual machines. According to Microsoft, attacks targeting VMware ESXi hypervisors have more than doubled over the past three years as ransomware groups look for faster, broader impact.
Recent incidents have shown how damaging this can be. Hypervisor-level attacks can halt operations for weeks, disrupt supply chains, and rack up losses far beyond the cost of recovering a handful of endpoints. For many organizations, this has made it clear that endpoint-only protection leaves too much exposed.
What hypervisor protection actually means in practice
Many security tools claim to protect virtualization environments, but most stop at the guest virtual machines. Arms Cyber takes a different approach by securing the hypervisor itself, not just what runs on top of it.
Josh McCarthy, Chief Product Officer at Arms Cyber, explained to MSSP Alert, “Most tools claim this protection by supporting the guest VMs - which we also support - but ignore the hypervisor itself. A couple of examples would be adding SSH MFA to the hypervisor shell to prevent credential theft or misuse, or implementing behavioral rules to stop actions like encrypting virtual disk images from the hypervisor.”
This distinction matters. Attacks that operate at the hypervisor level can bypass endpoint agents entirely. Backup-focused tools may help with recovery, but they do not prevent data exfiltration or extended downtime once the infrastructure itself is compromised. “Arms Cyber supports both the hypervisor itself as well as the guests, resulting in comprehensive protection,” McCarthy says.
Stopping quiet attacks without heavy agents
Hypervisor-focused ransomware rarely looks like traditional malware. Instead, attackers rely on legitimate administrative tools and low-noise techniques to avoid detection. Arms Cyber’s approach is designed to surface those behaviors early without introducing kernel agents or performance penalties.
“By hardening the system preemptively and implementing behavioral rules for blocking, we prevent these attacks or catch them at the earliest signs of malicious activity,” McCarthy says. “We only support Linux-based hypervisors where all the instrumentation needed for us to be effective is available from userspace.”
This allows the platform to detect misuse of trusted tools and abnormal behavior patterns before encryption or exfiltration can spread across the environment.
Changing the economics of ransomware response
For MSSPs and incident-response teams, the biggest cost of ransomware is often not the ransom itself, but the recovery effort. Restoring from backups takes time, ties up staff, and introduces risk if the “last clean” snapshot is unclear.
Cross-hypervisor protection shifts that equation by focusing on prevention and early interruption rather than cleanup after the fact. “Preventing an attack from succeeding or stopping it very early on drastically alters the economics, response time, and downtime of a ransomware incident,” McCarthy notes. “Recovering via backups generally results in costly downtime as well as the soft costs of performing the restoration work… A preemption and prevention first strategy can eliminate a lot of these costs entirely by making sure the attack never fully succeeds.”
As attackers focus on virtualization infrastructure to cause wider damage, endpoint-only tools leave too much uncovered. By protecting the hypervisor itself, the focus shifts from cleaning up after an attack to stopping it from working in the first place. For organizations running heavily virtualized environments, that can be the difference between a small, contained incident and a full-scale outage.
