Stream Security Expands Beyond Cloud-Native: Full Hybrid Cloud Visibility with VMware, NSX, and On-Prem Network Support

The cloud security industry has a blind spot , and it's hiding in plain sight. Most cloud detection and response solutions were built for one world: public cloud. AWS, Azure, GCP. Clean APIs, structured logs, well-documented services. But that's not the world many enterprises actually live in. The reality? Your attack surface doesn't stop at your cloud boundary. Workloads run on VMware. Traffic routes through on-prem to cloud, And adversaries know that the seams between environments are where detection falls apart. Today, we're closing that gap. Stream Security now delivers full attack path analysis and runtime threat detection across hybrid cloud environments, starting with VMware (including NSX), on-premises routers, and network infrastructure.

Stav Sitnikov

CPO

CDR

CloudTwin

No items found.

TL;DR

Stream Security now extends CloudTwin beyond public cloud to VMware, NSX, and on-prem network devices. You get full attack path analysis, runtime threat detection, and real-time topology modeling across your entire hybrid environment - not just the cloud or on-prem part of it.

What We're Delivering

Complete, Real-time, Visibility Across Hybrid Environments

CloudTwin, Stream's real-time digital twin of your infrastructure, now models VMware environments, NSX network policies, and on-prem networking devices alongside your cloud resources. This means Stream can trace complete attack paths that cross environment boundaries such as a compromised VM instance that can reach an RDS in AWS through a misconfigured network segmentation

‍

Vmware network architecture — Real-time system architecture visibility

Vmware to Cloud attack path — Hybrid Cloud Attack Paths

Vwmare configuration change impacts — Configuration Change Impact Analysis

‍

Context Aware Threat Detection

Stream ingests and correlates native VMware audit logs, vCenter events, and ESXi system logs in real time. Combined with NSX network flow data, we detect threats that VMware-only and cloud-only tools miss:

Unauthorized vMotion and VM cloning — detecting potential data exfiltration through VM-level operations
ESXi host compromise indicators — suspicious SSH access, hypervisor configuration changes, and privilege escalations
NSX policy tampering — unauthorized micro-segmentation changes that open lateral movement paths
Anomalous east-west traffic — identifying lateral movement within VMware clusters using NSX distributed firewall logs‍
Anomalous control plane activity - Identify vcenter user activity anomalies‍

‍

Vmware threat detection — Runtime Threat Detection

Deep Runtime Visibility with eBPF or your existing EDR

For workloads that need deeper inspection, Stream's eBPF-based runtime sensor extends into hybrid environments, delivering:

API-layer visibility —full L7 inspection o API traffic including complete payload for AI workloads.
File integrity and access monitoring — real-time detection of unauthorized file modifications, sensitive data access, and configuration tampering
Process-level telemetry — tracking process execution chains, privilege escalations, and suspicious binary execution across both cloud and VMware workloads‍
Integrate your existing EDR - Crowdstrike, SentinelOne, PaloAlto Cortex

This gives security teams the ability to detect threats at every layer — from network routing to API payloads to process execution — regardless of where the workload runs.

‍

vmware threat investigation — Threat Investigation

‍

AI Detection & Response

Detect and secure AI agents and workloads across your entire infrastructure, including both third-party services and self-hosted components.

Vmware AI Usage Discovery ant Threat Detection — AI Workload Discovery

On-Prem Network Device Coverage

Routers, switches, and firewall appliances are now first-class citizens in CloudTwin. Stream ingests device configurations, routing tables, and ACLs to:

Map network reachability between cloud VPCs and on-prem segments
Identify misconfigurations that create unintended connectivity
Detect configuration changes that weaken segmentation
Correlate network path data with cloud IAM and workload context for complete attack path modeling

‍

The Stream Difference: Context, Not Just Coverage

Adding VMware and on-prem support isn't about checkbox compliance. It's about building the only security model that reflects how hybrid infrastructure actually works, and how attackers actually exploit it.

CloudTwin continuously maintains a living model of your entire environment: cloud resources, IAM relationships, network topology, VMware clusters, NSX policies, and on-prem routing. When something changes — a new firewall rule, a modified router ACL, a shifted NSX policy — Stream updates the model in real time and re-evaluates every attack path.

This is what allows Stream to go from alert to response in under 5 minutes — even when the attack spans three environments and six network boundaries.

What's Next

VMware and on-prem networking are the beginning. We're building toward a unified security model that covers every environment where enterprise workloads run, because attackers don't respect infrastructure boundaries, and your detection shouldn't either.

If your security team is struggling with visibility gaps between cloud and on-prem environments, we'd love to show you how we can help - Book a demo

‍

About Stream Security

Stream is the AI-native platform built to fight AI-enabled attacks. It autonomously prevents, detects, hunts, and remediates exposures and threats across production at machine speed - driving risk toward zero. It replaces the fragmented stack of scanners, runtime agents, exposure tools and playbooks with one live model of production.Defending Production needs a new approach: Stream is the only Autonomous Production Defense Platform that works across your entire production estate. It runs on a patented CloudTwin®, a high-fidelity security data harmonization layer that models Cloud, SaaS, identity, runtime, AI, network, perimeter, on-prem, security controls, and the behavior running on top of them into one live model of production: real-time, fully correlated, continuously updating. Not a snapshot. And it does not stop at boundaries - the boundaries that fragment every other tool are the same boundaries an attacker moves across. Inside CloudTwin they are one system.