Stream Security Expands Beyond Cloud-Native: Full Hybrid Cloud Visibility with VMware, NSX, and On-Prem Network Support

What We're Delivering

Complete, Real-time, Visibility Across Hybrid Environments

CloudTwin, Stream's real-time digital twin of your infrastructure, now models VMware environments, NSX network policies, and on-prem networking devices alongside your cloud resources. This means Stream can trace complete attack paths that cross environment boundaries such as a compromised VM instance that can reach an RDS in AWS through a misconfigured network segmentation

‍

‍

Context Aware Threat Detection

Stream ingests and correlates native VMware audit logs, vCenter events, and ESXi system logs in real time. Combined with NSX network flow data, we detect threats that VMware-only and cloud-only tools miss:

• Unauthorized vMotion and VM cloning — detecting potential data exfiltration through VM-level operations
• ESXi host compromise indicators — suspicious SSH access, hypervisor configuration changes, and privilege escalations
• NSX policy tampering — unauthorized micro-segmentation changes that open lateral movement paths
• Anomalous east-west traffic — identifying lateral movement within VMware clusters using NSX distributed firewall logs‍
• Anomalous control plane activity - Identify vcenter user activity anomalies‍

‍

Deep Runtime Visibility with eBPF or your existing EDR

For workloads that need deeper inspection, Stream's eBPF-based runtime sensor extends into hybrid environments, delivering:

• API-layer visibility —full L7 inspection o API traffic including complete payload for AI workloads.
• File integrity and access monitoring — real-time detection of unauthorized file modifications, sensitive data access, and configuration tampering
• Process-level telemetry — tracking process execution chains, privilege escalations, and suspicious binary execution across both cloud and VMware workloads‍
• Integrate your existing EDR - Crowdstrike, SentinelOne, PaloAlto Cortex

This gives security teams the ability to detect threats at every layer — from network routing to API payloads to process execution — regardless of where the workload runs.

‍

‍

AI Detection & Response

Detect and secure AI agents and workloads across your entire infrastructure, including both third-party services and self-hosted components.

On-Prem Network Device Coverage

Routers, switches, and firewall appliances are now first-class citizens in CloudTwin. Stream ingests device configurations, routing tables, and ACLs to:

• Map network reachability between cloud VPCs and on-prem segments
• Identify misconfigurations that create unintended connectivity
• Detect configuration changes that weaken segmentation
• Correlate network path data with cloud IAM and workload context for complete attack path modeling

‍

The Stream Difference: Context, Not Just Coverage

Adding VMware and on-prem support isn't about checkbox compliance. It's about building the only security model that reflects how hybrid infrastructure actually works, and how attackers actually exploit it.

CloudTwin continuously maintains a living model of your entire environment: cloud resources, IAM relationships, network topology, VMware clusters, NSX policies, and on-prem routing. When something changes — a new firewall rule, a modified router ACL, a shifted NSX policy — Stream updates the model in real time and re-evaluates every attack path.

This is what allows Stream to go from alert to response in under 5 minutes — even when the attack spans three environments and six network boundaries.

What's Next

VMware and on-prem networking are the beginning. We're building toward a unified security model that covers every environment where enterprise workloads run, because attackers don't respect infrastructure boundaries, and your detection shouldn't either.

If your security team is struggling with visibility gaps between cloud and on-prem environments, we'd love to show you how we can help - Book a demo

‍