Strengthen Virtualization Security with Zero Networks and Oracle

Summary

Since Broadcom acquired VMware, many organizations facing higher renewal costs are moving to KVM-based alternatives such as Oracle Virtualization, and attackers are increasingly targeting virtualization hosts, because compromising one host can ransom every VM on it. In this webinar, John Priest, Director of Product Management for Oracle Virtualization, explains how Oracle Linux KVM and Oracle Linux Virtualization Manager deliver the core features VMware customers rely on, and Nicholas DiCola, VP of Customers at Zero Networks, shows how Zero Networks’ integration with Oracle Virtualization protects the full stack. Zero Networks automatically discovers and microsegments KVM hosts, the Virtualization Manager, and guest VMs without agents, and puts network-layer MFA in front of administrative access like SSH.

Key takeaways

• After Broadcom’s acquisition of VMware in November 2023, the move to subscription, per-core licensing, and bundles has many customers and partners looking for alternatives.
• KVM is an open-source hypervisor built into the Linux kernel that has been in use for about 20 years and runs many public clouds, including Oracle Cloud Infrastructure.
• Oracle Virtualization pairs an Oracle Linux KVM hypervisor with Oracle Linux Virtualization Manager, the equivalent of vCenter, which supports more than 1,000 hosts and up to 10,000 VMs, plus VirtIO drivers for Windows workloads.
• Equivalent features include live migration (vMotion), scheduling policies (DRS), snapshots, high availability, and disaster recovery. Migration is supported through tools like virt-v2v, partner tools, and professional services.
• In virtualized environments, one compromised machine can lead to all being compromised, and attackers increasingly target hypervisor hosts to ransom every VM at once.
• Zero Networks automates network and identity segmentation, closes privileged ports until a user passes MFA at layers 3 and 4, and extends that protection to Oracle Virtualization hosts, the manager, and its web interface.

This webinar was recorded in June 2025. Product versions and support dates reflect that time.

How has Broadcom’s acquisition of VMware changed the virtualization market?

[0:00] John Priest, Director of Product Management, Oracle Virtualization: Thank you, Beth, and thanks for the introductions. Let’s get into today’s material, starting with reimagining virtualization with Oracle Virtualization, an alternative to VMware. I’m John Priest, Director of Product Management for Oracle Virtualization. First, I’d like to give you an overview of the market conditions we see with VMware.

[0:22] John Priest: VMware has been the leader in server virtualization. It created the market with a very solid product. But Broadcom’s acquisition of VMware in November 2023 changed the whole server virtualization market. As soon as Broadcom acquired VMware, it made a number of changes to the product portfolio. It moved from perpetual licenses to paid annual subscriptions. It shifted to a per-core licensing model. And it created bundles; VMware Cloud Foundation and VMware vSphere Foundation are two of the primary bundles offered right now. Essentially, there are now just a few SKUs that customers order, and we often find that customers don’t use all the products in those bundles, but that’s Broadcom’s offering going forward.

[1:22] John Priest: There have also been changes in the sales teams, the partner programs, and the roadmap and development. The net result is that many partners that have sold VMware are looking for alternatives, and so are many end users: enterprise customers running server virtualization on premises. Many have seen renewal notices with increases they can’t afford. They’re upset, and they’re looking for other options right now.

Why is KVM a viable alternative to VMware?

[2:10] John Priest: One option many of them are considering is the KVM hypervisor. KVM is an open-source hypervisor that’s ubiquitous both on premises and in the cloud. KVM, the kernel-based virtual machine, is embedded in the Linux kernel, and it’s been around for about 20 years. The industry sees it as a high-performing hypervisor with low overhead and fast application startup and performance. It’s very scalable. KVM is used not only by many customers for on-premises server virtualization, but also as the primary hypervisor in many public clouds, including Oracle Cloud Infrastructure. So it’s a viable, reliable, general-purpose virtualization solution that’s been proven in the market.

[3:12] John Priest: Oracle has shifted to KVM as our primary hypervisor, and it’s what we offer for on-premises server virtualization today. We’ve offered the KVM hypervisor in our Oracle Linux distribution for 20 years now. It’s the core of the server virtualization technology we offer to customers looking for an alternative to VMware, and it’s designed for multicloud deployments.

What does Oracle Virtualization include?

[3:39] John Priest: The solution has three key components. The first is the management component. For those using VMware, this is your vCenter: the main management portal you’ll use to set up your KVM compute hosts, virtual machines, virtual networks, and virtual storage. It’s built on the oVirt open-source project, which we both use and contribute to, and it’s based on the 4.5 release of that community project. It’s also part of the Oracle Linux 8 distribution, which matters because Oracle Linux 8 is a very stable release, both for the KVM hypervisor and as the operating system for the manager, and it’s fully supported through July 2029, with extended support already in place. That’s the foundation for the management platform.

[4:48] John Priest: The second component is compute, your ESXi equivalent: Oracle Linux KVM is the hypervisor you can migrate to. And for customers running Windows workloads, the third component is our VirtIO drivers for Windows, similar to VMware Tools.

[5:10] John Priest: Looking at the solution graphically, the manager is our administration dashboard. It gives you a view into your virtualization environment, including the number of KVM hosts you’ve set up and the virtual machines you’ve configured, and you can manage everything from this interface. We also expose a REST API for automation and integrations, which I’ll touch on later. It’s a very scalable, high-performing management platform that supports more than 1,000 KVM hosts and up to 10,000 virtual machines under a single engine.

[5:51] John Priest: From there, you add your KVM compute hosts, based on Oracle Linux 8.10, our latest stable release for the compute hypervisor, and then your virtual machines. We support a wide range of guest operating systems, from Oracle Linux and Red Hat Enterprise Linux to Ubuntu, Rocky Linux, and AlmaLinux, as well as the Windows Server and Windows desktop workloads I mentioned. So you can run a wide variety of operating systems to support whatever applications you need. These components are very similar to a vCenter deployment and the ESXi hypervisor, with similar functionality.

[6:43] John Priest: Taking a deeper look at the administration portal, the dashboard gives you a single view into your environment, including the number of clusters and hosts. This example shows 752 hosts under a single manager and 13,000 configured virtual machines, so it’s very scalable and high-performing. You can see events and alerts, and click into any area of the interface to drill down for more information. The VM window lets you see and sort all of your configured VMs, and drill into any individual virtual machine. It’s very user-friendly and easy to navigate. There’s also a menu system on the left, with workflows for configuring hosts, virtual storage, and virtual networking.

How does Oracle Virtualization compare with VMware features?

[8:12] John Priest: Now let’s look at the key server virtualization features you need to operate on premises. These include virtual machine snapshots, which take a copy of a running VM for backup or to use as a template for new VMs, along with VM migration, storage migration, high availability, disaster recovery, scheduling policies, and role-based access. All of these are part of the product. Sometimes the names differ between VMware and Oracle Virtualization. Two examples: in VMware, vMotion moves a running VM from one host to another without disrupting the application; in Oracle Virtualization, that’s live migration. And VMware’s Distributed Resource Scheduler, or DRS, automatically balances VMs across a cluster based on CPU or memory utilization; in Oracle Virtualization, that’s a scheduling policy. It’s the same core functionality you expect. We’ve tested it, and many of our customers have validated it through proofs of concept and deployments.

What does Oracle Virtualization cost, and how do you migrate from VMware?

[10:05] John Priest: We’re often asked: beyond equivalent capability, why move to Oracle Virtualization? One of the main drivers is that it’s based on open source, so there’s no direct licensing cost. There is an annual Oracle Linux Premier Plus support contract, which gives you access to our support team by phone or web portal for questions and troubleshooting, access to more advanced technology like Ksplice live patching, and access to our knowledge articles. What we’ve seen with many customers looking for alternatives is that the overall cost of that support contract is much lower than what they’re seeing in the Broadcom bundles proposed for their renewals. So it’s a lower-cost solution.

[11:21] John Priest: Customers also ask how to migrate from VMware to Oracle Virtualization. There are a few ways. We offer open-source tools, including virt-v2v, which copies virtual machines from your VMware environment into Oracle Virtualization so you can start and manage them there. A number of partner tools also support moving running VMs into Oracle Virtualization. And our professional services team has done many of these migrations and can support you as well.

What certifications and partner integrations does Oracle Virtualization support?

[12:11] John Priest: I also want to touch on the ecosystem around the platform, starting with certifications. On the application side, we work very closely with Oracle teams like Database and Fusion Middleware. Those applications are developed, built, and tested on Oracle Linux KVM. But it’s a universal platform that runs any application supported on the guest operating systems I showed. We also work closely with many server vendors. Beyond the generic x86 servers this hypervisor runs on, we certify Oracle Linux KVM with leading x86 partner vendors, and if new firmware or drivers are needed, we have those relationships. We publish a hardware certification list, and an independent software vendor catalog of applications we’ve certified.

[13:46] John Priest: One of the key things is the integrations we’ve built with partners to deliver more advanced capabilities. We have open infrastructure, an open API, and documented, fully supported open interfaces, and many partners use them to build integrations with our product. Our team focuses on core server virtualization, and when customers need other management or networking components to round out their data center, we partner with best-in-breed companies. Leading backup and restore vendors access our product through the REST API to take VM snapshots and store them offline. We work with vendors that offer vSAN-like capabilities, with configuration management vendors that provide a manager-of-managers view and automation across your environment, and with the migration partners I mentioned.

[15:27] John Priest: One of the key partnerships we have right now, from a networking perspective and for microsegmentation and identity-based protection, is Zero Networks. They’ve built an integration, we have a strong partnership, and Zero Networks is one of those best-in-breed companies. At this point, I’d like to hand over to Nicholas to go deeper into the Zero Networks solution and how it integrates with Oracle Virtualization.

Why does microsegmentation matter in virtualized environments?

[15:59] Nicholas DiCola, VP of Customers, Zero Networks: Thanks, John. To set some context on why microsegmentation is so important, especially in a virtualized environment: once an attacker is in, we say one compromised equals all compromised, because they can very easily move laterally across the environment. The network is too open, and accounts have too many permissions, whether the environment is physical or virtual. And since most people run virtualized environments, it’s even easier to move laterally between VMs once an attacker reaches the server environment.

[16:34] Nicholas DiCola: When we ask customers about their segmentation maturity, from perimeter firewalls all the way up to holistic segmentation, most tell us they’re somewhere in the middle. They ultimately want holistic segmentation of networks and identities, and they know it would raise their security posture, but it’s very expensive in human labor and time to get there. Microsegmentation and identity segmentation are super important, but very hard to achieve.

How does Zero Networks automate network and identity segmentation?

[17:11] Nicholas DiCola: That’s where we come in. Zero Networks is a platform for the cornerstone of zero trust: network microsegmentation for any asset, least-privilege identity segmentation, and zero trust network access. Once a customer starts their journey with Zero Networks, it’s actually very easy. We fully automate network and identity segmentation, using a learning engine to learn what’s used in the environment and block everything that isn’t, so you only open what’s needed from a network and identity perspective. We do this without agents, by controlling native operating system capabilities like the host-based firewall, so you don’t have to deploy anything else to the machine.

[18:07] Nicholas DiCola: More importantly, attackers moving laterally typically use privileged access, so we added a third component: MFA-based just-in-time access for all interactive privileged access. Once Zero Networks is deployed and you want to use RDP, for example, you get a self-service MFA prompt through your existing MFA provider that opens access temporarily, so there’s no long-term standing access. This is how you really stop attackers: reduce network ports and identity access, add MFA to protect all privileged access, and they’re unable to move laterally.

[18:48] Nicholas DiCola: Now we say one compromised equals none compromised, especially in virtualized environments. When attackers get in and can’t use network ports or identities to spread to other VMs or machines, they’re stuck, with nowhere else to go. So they leave and go to another organization where they can move laterally.

How is network-layer MFA different from traditional MFA?

[19:15] Nicholas DiCola: It’s important to double down on the MFA piece and compare it to traditional MFA. Most traditional MFA works at the application layer: once you connect over a protocol, it prompts you for MFA. The problem is that attackers can still run reconnaissance or exploits against the service, because the network is still open, regardless of the application-layer MFA. Zero Networks moves MFA down to layers 3 and 4. The network port is closed, and you have to complete MFA to even open it. That means attackers can’t use reconnaissance or exploits to discover these services, because they’re shut down until someone completes MFA. That’s very important for stopping attackers from spreading through lateral movement.

Why are attackers targeting virtualization hosts?

[20:10] Nicholas DiCola: We’ve seen many reports that attackers are now targeting virtualization hosts, because if I can get to the host, I can get to all the VMs. If I can ransom that host and all of its VMs, your business is essentially shut down, and that’s what attackers want, so you’ll pay the ransom. We’ve seen many attacks going after VMware in particular, because, as John said, it’s so widely used across the market, which makes it a big target. And for customers running it, there’s no way to really microsegment those hosts; they’re open and available inside the network. VMware does have a microsegmentation offering for VMs, but nothing for the hosts or the virtualization manager.

How do Zero Networks and Oracle Virtualization protect the full virtualization stack?

[20:59] Nicholas DiCola: This is where we’ve partnered with Oracle Virtualization to provide something uniquely different. Because the hosts run open-source Linux, which we support, Zero Networks can manage and microsegment both the hosts and the virtualization manager, closing all unused ports. We automatically learn what’s needed, automatically discover which machines are Oracle Virtualization hosts and which are virtualization managers, and build rules so they can communicate with each other. We can even protect administrative access to the Oracle Virtualization hosts: instead of having SSH open all the time, it’s closed and requires MFA. That stops attackers from reaching the hosts and ransoming all the VMs on them.

[21:54] Nicholas DiCola: We can also protect all the VMs hosted on top. We support the same guest operating systems John mentioned, so all of those VMs can be microsegmented too. And if you want, we can add our network-layer MFA in front of the Oracle Virtualization Manager web interface. So you can protect the entire virtualization stack, and all the VMs it hosts, with microsegmentation across the environment.

[22:37] John Priest: Thank you, Nicholas. It’s a great solution, and it’s been great working with your team on this integration and the strong partnership we have. Thank you all for joining today. We kept this brief, but there’s a lot more behind both the Oracle Virtualization technology and the Zero Networks technology, and we’d be happy to set up further sessions for deeper dives and demos. Reach out to your sales teams or your contacts at either company and let us know how we can help.

[23:12] Nicholas DiCola: Thanks again, John, for having us. Please reach out if we can help.