VMware NSX platform’s advantages in flexibility and security help the vendor continue to win in the software-defined networking (SDN) market, its networking and security leader touted. And the vendor plans to roll out more endpoint security services to reinforce its dominance.

“​​I think it may be time to say officially we've won the SDN war,” Tom Gillis, SVP and GM of VMware’s networking and advanced security business group, told SDxCentral, referring to IDC’s recent market share data showing VMware NSX’s market share continues to grow while Cisco application-centric infrastructure (ACI)’s share has been declining for the last few years.

Plus, 90 of the Fortune 100 companies are running the NSX platform as their SDN services, he claims. 

Brad Casemore, research VP at IDC, confirmed that VMware is the dominant vendor for the SDN software market with a nearly 65% market share last year, up from 60% in 2020. 

“If you look at an SDN solution, there's an architectural advantage to being in the virtualization layer, that's where SDN needs to live,” instead of putting it into the data center switch, Gillis pointed out, adding that it allows customers to deploy network automation and segmentation at scale.

Cloud giants Amazon, Google, and Microsoft made the same move, he said.

This architecture helps decouple hardware from the software, so users won’t be locked into a particular hardware vendor, Casemore explained. “That potentially gives you flexibility and choice when things like supply chain disruptions occur.”

“And organizations are also realizing that agility comes from software-based automation,” he added.

NSX Integrates With Carbon Black to Offer ENDR

VMware recently reorganized its networking and security business group to add its Carbon Black business under Gillis to form the Networking and Advanced Security business group. 

Carbon Black was an endpoint and server protection publicly traded security company, and VMware acquired it in 2019 in deal valued over $2 billion.

“SDN platform is incredibly powerful for implementing visibility and security to understand the inner workings of the application base,” Gillis said. 

The integration of NSX and Carbon Black services can provide a network-level analysis that monitors the anomalous pattern across transitions, servers, and networks. 

“Being able to see what's happening inside the server, and what's happening on the network and correlate these two things we think is magical,” he said, adding that VMware plans to offer it as an endpoint and network detection and remediation (ENDR) product by the end of this year.

ENDR is “distinctly different” from the buzzword XDR — extended detection and response, he noted. XDR uses sample data to monitor the infrastructure and VMware works with partners like Proofpoint, Splunk, and Okta to build an open XDR ecosystem, according to Gillis.

And this XDR partnership is complementary to its ENDR offering which is “a full-fidelity solution” that can feed alerts into the XDR platform, he said. “We're probably one of the most accurate sources of data going into that broader SIEM or XDR, but we're not the XDR.”

Gillis claims only VMware is able to put endpoint and network capabilities together, and that its competitors such as CrowdStrike, Palo Alto Networks, and Amazon cannot do the same.

VMware Leads Using Security as a Differentiator Trend

Those security functions work as a differentiator for VMware’s SDN products. 

“VMware was certainly at the forefront of the trend of providing microsegmentation within the data center to prevent those lateral east-west exploits,” Casemore noted.

It allows consistent policy to ensure workload isolation across the network and down into the server, virtual machines, or containers. “​​That kind of workload protection is more and more important and organizations are beginning to understand that the network has a valuable role to play in protecting workloads and providing microsegmentation,” he added.

VMware acquired SDN vendor Nicira in 2012 and re-named it NSX for vSphere or NSX-V. Then the vendor “began to realize that microsegmentation basically accounted for a significant share of the reasons why a lot of enterprises bought NSX,” Casemore said. These security use cases grew over time and the integration with Carbon Black “provides a more comprehensive security story.”

Now, more SDN vendors offer segmentation or microsegmentation services. Pluribus recently partnered with Nvidia to allow customers to apply consistent policies across the network fabric in the data center or the edge down into the SmartNIC/data processing unit (DPU), he added.

“You can see that other vendors certainly followed the lead that VMware took and they realize that this is a tremendous way for network policy to contribute to extremely robust security,” Casemore said.