VMware acquired security firm Lastline in a move that will add a network detection and response (NDR) component to VMware’s NSX architecture and Carbon Black security platforms.

Lastline is known for its anti-malware research and artificial intelligence (AI)-powered network detection and response. Its core product is a malware sandbox that can look at every instruction a malware executes to see how it works and then can block different malware iterations.

“As a result, Lastline’s system detects twice the number of malicious files as a signature-based system,” noted Tom Gillis, SVP and GM for VMware’s Networking and Security business, in a blog post. “The Lastline system uses machine learning that recognizes essential elements of an attack, unlike the narrow signature-based systems that miss the many variants an attacker may use.”

He also noted that the Lastline system is different from anomaly detection systems that treat “every outlier as bad and results in many false positives. Lastline leverages the deep understanding of malicious behavior to flag clearly bad activities such as east-west movement, command and control activity, and data exfiltration.” Gillis added that Lastline “detonates more than 5 million file samples daily.”

The Lastline platform will be folded into VMware’s NSX team. Lastline will also join with VMware’s Carbon Black Threat Analysis Unit to bolster the vendor’s security offerings.

“This broad context will enable very high-fidelity security decisions, and be operationally simple to deploy, allowing us to bring intrinsic security to the enterprise at scale,” Gillis said. VMware has been pushing the intrinsic security angle over the past year.

“Intrinsic security doesn’t just mean it’s built in, it means it’s built differently,” Gillis said earlier this year during a press briefing at the RSA Conference 2020. “And so, when we talk about intrinsic security, we focus on security that we can implement because we have an intrinsic advantage or capability with our [virtualization] platform, and that’s what’s different and unique.”

Financial terms of the deal were not released, but Lastline had raised more than $52 million in funding since its founding in 2012. Its latest was a $28.5 million Series C led by Thomvest Ventures in 2017.

The purchase comes less than a month after VMware acquired Kubernetes-focused security startup Octarine. The Silicon Valley-based company provides visibility into cloud-native workloads and also integrates into the DevOps process to analyze application risks at time of build, before they are deployed into production.

VMware has spent billions of dollars to bolster its security posture. It launched its initial standalone security product, AppDefense, in 2017.

That product launched with Carbon Black as a partner, and last August, VMware announced a deal to buy the endpoint security vendor for $2.1 billion. VMware since renamed its security business VMware Carbon Black. That business counted more than 15,000 customers at the end of VMware’s most recent operating quarter. Earlier this year VMware COO Sanjay Poonen said since the Carbon Black acquisition, VMware is now a $1 billion security business.

The virtualization giant also has a multi-cloud security product called Secure State. It’s based on cloud security posture management technology that VMware acquired when it bought CloudCoreo in 2018.