Improving Cloud Security Effectiveness

Testing with AttackIQ

VMware security leaders Chad Skipper and Victor Monga describe partnering with AttackIQ to validate controls during product development, customer demos, and QA—proving detection value across multi-cloud ransomware scenarios rather than slide-ware claims.

Threat Landscape

They cite thousands of daily ransomware attempts, rising breach costs, phishing-driven initial access, and long attacker dwell times before lateral movement toward data exfiltration—stressing need to shorten time-to-detect.

Kill Chain Coverage

Walking an example chain from Cobalt Strike command-and-control through discovery and lateral movement, they map VMware Carbon Black EDR, hypervisor-integrated network sandboxing with full OS/CPU emulation, distributed IDS/IPS, and NDR correlation.

Why Emulation Depth Matters

Shallow sandboxes that only observe processes and file writes miss anti-analysis sleeps and in-memory encryption staging. Hypervisor-level full-system emulation extracts MITRE-mapped behaviors—C2, hard-coded IPs, and ransomware prep—giving defenders actionable telemetry on initial access.