Broadcom Gives Its vDefend AI Assistant Power to Push Security Rules

Broadcom is putting a generative-AI assistant inside VMware vDefend that can move beyond explaining security incidents to creating and applying firewall and intrusion-prevention rules for detected ongoing attacks. That makes the feature’s division of labor consequential: the firewall assistant is read-only, while the threat-defense assistant is designed for active remediation.

The feature, called AI Assistant for VMware vDefend, is integrated into the vDefend Security Services Platform 5.2. Broadcom has divided it into AI Assistant for Firewall and AI Assistant for Threat Defense, separating operational guidance from actions that can change security policy.

The threat-defense assistant appears in event tables for Network Detection and Response, Network Traffic Analysis, and Malware Prevention Service. It is intended to explain threats and campaigns in natural language, help analysts triage isolated events, and form hypotheses about attacks, false positives, or possible data exfiltration.

Its operational role extends to remediation. Broadcom says the assistant can create vDefend Distributed Firewall and IDS/IPS rules in response to detected attacks, and offers one-click options intended to stop imminent threats. Users can choose a narrower policy for a specific workload or a broader response spanning more ports and destinations.

AI Assistant for Firewall is aimed at enterprise and security administrators. It uses a natural-language interface to provide insights drawn from live configurations, real-time policy violations, firewall alerts, metrics, rule analysis, flow data, inventory objects, and API reference material.

What the read-only assistant can surface

• Firewall metrics, capacity dashboards, and rule analysis.
• Flow context involving virtual machines, IP addresses, groups, tags, services, ports, and protocols.
• API reference lookups, without generating code.

Broadcom says data collected during generative-AI interactions is not used to train the underlying large language model and is not persisted by that model. That statement addresses model training and persistence, not every operational control surrounding a policy change.

The documentation overview describes active remediation and user-selected policy scope, but does not specify whether generated rules require a review or approval step before they are applied. For security teams, that implementation detail will determine how the assistant fits into an existing incident-response process.

Broadcom’s design does not treat every natural-language security request alike. Administrators get a lookup and analysis tool for firewall operations; analysts and security operators get an incident-focused assistant that can recommend and enact remediation through Distributed Firewall and IDS/IPS policy. The value of that second path will rest on whether its threat classification and policy scope match the judgment required in a live event.