No more unprotected root access: CLI-MFA brings second-factor authentication to the hypervisor CLI and SSH, plus auditable policy lifecycle management, distributed architecture, vCenter integration, and multi-SIEM forwarding.

Vali Cyber, the leading provider of preemptive hypervisor security, today announced the general availability of ZeroLock^® 5, a major release focused on closing the two most dangerous gaps in hypervisor security: insider threats and stolen credentials on ESX and Linux hosts.

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260901722430/en/

The Hypervisor Is Now the Target

Over the past two years, ransomware operators and nation-state actors alike have shifted their focus from individual endpoints to the hypervisor layer itself. In its Cybersecurity Forecast 2026, Google Cloud warned that adversaries are pivoting to the underlying virtualization infrastructure, which it calls a critical blind spot, as security controls mature inside guest operating systems.

That shift is already visible in the wild: threat actor ShinyHunters has been observed developing "shinysp1d3r," a ransomware-as-a-service platform built to encrypt VMware ESX environments by harvesting SSH keys and abusing stolen credentials. A single compromised credential is enough to take down dozens of virtual machines before a security team ever sees an alert.

Because hypervisors sit a layer beneath where most security tools can see, attackers who reach the CLI can operate largely unseen. That's the threat ZeroLock 5 is built to address.

CLI-MFA: Multi-Factor Authentication Where It Matters Most

The centerpiece of this release is CLI-MFA, extended in 5 to govern file access, program execution, and network access at the hypervisor command line. A stolen credential is no longer enough. Any operation covered by a rule can now be set to require a time-based one-time password before it proceeds.

"We have seen firsthand what happens to a company after a hypervisor attack that started with one stolen credential. The aftermath is extraordinary, and it can bring production to a full stop," said Anthony Gadient, CEO of Vali Cyber. "CLI-MFA cuts off that path. It lets our customers build a foundation that holds even when credentials are lost."

Built to Scale Across the Largest, Most Segmented Enterprises

ZeroLock 5 is also architected for enterprises spanning multiple data centers and segmented network zones. The collector, the portion of the management console used to communicate with security agents, is now a standalone service. Collectors are deployable remotely and independent of where the central ZeroLock Management Console lives. Standardized, reusable deployments bundle all configuration into one definition that generates ready-to-run installer commands, letting teams roll out protection across dozens or hundreds of sites from a single repeatable blueprint.

"Patching is not a complete strategy at this layer. There will always be another ESX CVE, and an enterprise running hundreds of hosts across segmented zones cannot chase them fast enough," said Austin Gadient, CTO and co-founder of Vali Cyber. "What companies can do is make the attacker's post-access behavior impossible. ZeroLock 5 lets them enforce that at scale, from a single blueprint, across every site."

Additional Capabilities

ZeroLock 5 also adds:

• Auditable policy lifecycle management, moving each policy from draft to published to retired with full revision tracking
• Standardized agent installation through named, reusable deployments that generate ready-to-run installer commands
• Multi-SIEM activity forwarding with presets for Microsoft Sentinel, Splunk, Sumo Logic, and Google SecOps
• Scheduled alert-only mode
• vCenter host inventory import
• Support for VCF as well as ESX 6.7+, older versions supported upon request
• Simplified licensing

Available Now

As attackers set their sights on the hypervisor layer, the question facing every enterprise is no longer whether that infrastructure will be targeted, but whether it's well protected when it is. ZeroLock 5 is available now to existing customers as an upgrade and to new customers as part of a new deployment.

About Vali Cyber

Vali Cyber^® secures where attacks have the most impact: mission critical systems. While most defenses focus on endpoints, Vali Cyber identified Linux and hypervisors as critical yet under protected. Built for this reality, ZeroLock^® delivers preemptive security with CLI-MFA, exploit prevention, deep hypervisor visibility, and AI-driven behavioral detection. By operating at the hypervisor layer, ZeroLock stops threats in real time without performance impact or added overhead. If incidents occur, automated rollback restores workloads in seconds, ensuring uptime. Recognized by Gartner as a Key Startup in Security Software, Vali Cyber leads by protecting the foundation of modern infrastructure others overlook.

Learn more at valicyber.com.

View source version on businesswire.com: https://www.businesswire.com/news/home/20260901722430/en/

Because hypervisors sit a layer beneath where most security tools can see, attackers who reach the CLI can operate largely unseen. That's the threat ZeroLock 5 is built to address.