The enterprise attack surface is expanding rapidly as agentic AI brings a constantly shifting cloud infrastructure into play.

That pace is pushing security decisions down toward the virtualization layer, where policy can be enforced without slowing traffic. Perimeter defenses alone no longer hold, and enterprises that delay a broader lateral security program risk falling behind increasingly automated attacks, according to Umesh Mahajan (pictured), vice president and general manager of the Application Networking and Security Division at Broadcom Inc.

“This is the time where you can’t put off security any longer,” Mahajan said. “‘Oh, I got a perimeter firewall. I’m good.’ No, no, no – not good. It can be bypassed. Now the security gurus or experts are saying, ‘No, you can’t take two years, three years. You have to deploy lateral security.'”

Mahajan spoke with theCUBE’s John Furrier at VMware Explore 2026, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed agentic AI’s effect on the enterprise attack surface, zero-trust enforcement and API protection for Kubernetes workloads. (* Disclosure below.)

Building zero trust into cloud infrastructure

Enterprises have often bought security tools piecemeal over the years, and the seams between them are where attackers operate. Broadcom’s answer is an integrated software stack in which the elements share context, delivered through its vDefend and Avi Load Balancer product lines, Mahajan explained.

“Our customers have bought multiple security products. They can’t put it together,” he said. “It’s like buying Swiss cheese. Yeah, you have pieces of security, but you have plenty of holes which people can drive through.”

Scale is the other constraint, Mahajan noted. AI workloads generate heavy east-west traffic and punish any inspection step that adds delay, which is why the company has pushed enforcement into the hypervisor rather than a separate appliance tier, part of a wider update to VMware’s security portfolio for AI-era threats. That includes firewalling and intrusion detection and prevention, with the company aiming to handle security processing at high throughput while keeping latency low.

“We are doing 75 terabits per vCenter cluster for firewalling. We are doing 17 terabits for IDS IPS, and the other aspect is also latency,” Mahajan said. “Because in AI workloads, latency matters, so our security is done at the hypervisor level.”

In other words, Broadcom is pushing security enforcement into the hypervisor to inspect traffic at scale without introducing the latency of sending it through separate security appliances. But protecting those workloads also requires visibility into what is running, Mahajan noted. Agents and Model Context Protocol services are transient, so administrators need a real-time picture of what is authorized and what is shadow IT before they can quarantine anything, and that visibility work is now landing alongside private cloud modernization programs. Bolting protection on later, once the cloud infrastructure is already carrying production AI traffic, is the failure mode executives are trying to avoid.

“It has to be at the infrastructure level; it has to be at scale,” he said. “Otherwise, when are you going to do it? Two years from now, by that time you’ll be compromised.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of VMware Explore 2026:

(* Disclosure: TheCUBE is a paid media partner for the VMware Explore 2026 event. Neither Broadcom, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE