Vali Cyber ZeroLock 5 brings MFA to the hypervisor command line

Vali Cyber released ZeroLock 5, a major release focused on closing the two most dangerous gaps in hypervisor security: insider threats and stolen credentials on ESX and Linux hosts.

The hypervisor is now the target

Over the past two years, ransomware operators and nation-state actors alike have shifted their focus from individual endpoints to the hypervisor layer itself. In its Cybersecurity Forecast 2026, Google Cloud warned that adversaries are pivoting to the underlying virtualization infrastructure, which it calls a critical blind spot, as security controls mature inside guest operating systems.

That shift is already visible in the wild: threat actor ShinyHunters has been observed developing “shinysp1d3r,” a ransomware-as-a-service platform built to encrypt VMware ESX environments by harvesting SSH keys and abusing stolen credentials. A single compromised credential is enough to take down dozens of virtual machines before a security team ever sees an alert.

Because hypervisors sit a layer beneath where most security tools can see, attackers who reach the CLI can operate largely unseen. That’s the threat ZeroLock 5 is built to address.

CLI-MFA: Multi-factor authentication where it matters most

The centerpiece of this release is CLI-MFA, extended in 5 to govern file access, program execution, and network access at the hypervisor command line. A stolen credential is no longer enough. Any operation covered by a rule can now be set to require a time-based one-time password before it proceeds.

“We have seen firsthand what happens to a company after a hypervisor attack that started with one stolen credential. The aftermath is extraordinary, and it can bring production to a full stop,” said Anthony Gadient , CEO of Vali Cyber. “CLI-MFA cuts off that path. It lets our customers build a foundation that holds even when credentials are lost.”

Built to scale across the largest, most segmented enterprises

ZeroLock 5 is also architected for enterprises spanning multiple data centers and segmented network zones. The collector, the portion of the management console used to communicate with security agents, is now a standalone service.

Collectors are deployable remotely and independent of where the central ZeroLock Management Console lives. Standardized, reusable deployments bundle all configuration into one definition that generates ready-to-run installer commands, letting teams roll out protection across dozens or hundreds of sites from a single repeatable blueprint.

“Patching is not a complete strategy at this layer. There will always be another ESX CVE, and an enterprise running hundreds of hosts across segmented zones cannot chase them fast enough,” said Austin Gadient , CTO of Vali Cyber. “What companies can do is make the attacker’s post-access behavior impossible. ZeroLock 5 lets them enforce that at scale, from a single blueprint, across every site.”

Additional capabilities

ZeroLock 5 also adds:

Auditable policy lifecycle management, moving each policy from draft to published to retired with full revision tracking

Standardized agent installation through named, reusable deployments that generate ready-to-run installer commands

Multi-SIEM activity forwarding with presets for Microsoft Sentinel, Splunk, Sumo Logic, and Google SecOps

Scheduled alert-only mode

vCenter host inventory import

Support for VCF as well as ESX 6.7+, older versions supported upon request

As attackers set their sights on the hypervisor layer, the question facing every enterprise is no longer whether that infrastructure will be targeted, but whether it’s well protected when it is. ZeroLock 5 is available now to existing customers as an upgrade and to new customers as part of a new deployment.

CISA review makes the case for eliminating vulnerability classes

Askeal, the AI cybersecurity assistant that gives verifiable, expert-backed answers

NIS2 compliance: Fixing IAM and access control before the 2026 audit

Download: The High-Performance Team Playbook

Simplify security management with CIS SecureSuite Platform

Download: The IT and security field guide to AI adoption

CISA review makes the case for eliminating vulnerability classes

Askeal, the AI cybersecurity assistant that gives verifiable, expert-backed answers

NIS2 compliance: Fixing IAM and access control before the 2026 audit

What your vendor says PQC tells you if they are ready

Attackers plant remote access tools on compromised PaperCut servers