--- title: "Antimalware and Virtual Machines: square peg, round hole problems" description: "Advantages of Antimalware for provider experience and end-user: better security, extending better security to the endpoint instances." image: https://businessinsights.bitdefender.com/hs-fs/file-986074776-jpg/Blog_pics/Antimalware_Virtual_Machines.jpg --- [![](https://businessinsights.bitdefender.com/hubfs/2021/09/logo-white.svg)](https://businessinsights.bitdefender.com/?hsLang=en-us) [![CONTACT AN EXPERT](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd) - [For Home](https://www.bitdefender.com/solutions/) - [For Business](https://www.bitdefender.com/business/) - [Resources](https://www.bitdefender.com/business/resource-library.html) - [Webinars](https://www.bitdefender.com/business/webinars.html) # [BUSINESS INSIGHTS](https://businessinsights.bitdefender.com/?hsLang=en-us) [#Enterprise Security](https://businessinsights.bitdefender.com/topic/enterprise-security) [#Virtualization & Data Center Security](https://businessinsights.bitdefender.com/topic/virtualization-data-center-security) By [**Shaun Donaldson**](https://businessinsights.bitdefender.com/author/shaun-donaldson) / Jun 10, 2014 # Antimalware and Virtual Machines: square peg, round hole problems Share this [![Share on email](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/email-color.png)](mailto:?subject=Check%20out%20https://businessinsights.bitdefender.com/antimalware-and-virtual-machines&utm_medium=social&utm_source=email%20&body=Check%20out%20https://businessinsights.bitdefender.com/antimalware-and-virtual-machines&utm_medium=social&utm_source=email) [![Share on twitter](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://businessinsights.bitdefender.com/antimalware-and-virtual-machines&utm_medium=social&utm_source=twitter&url=https://businessinsights.bitdefender.com/antimalware-and-virtual-machines&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on linkedin](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://businessinsights.bitdefender.com/antimalware-and-virtual-machines&utm_medium=social&utm_source=linkedin) [![Share on facebook](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/facebook-color.png)](http://www.facebook.com/share.php?u=https://businessinsights.bitdefender.com/antimalware-and-virtual-machines&utm_medium=social&utm_source=facebook) As endpoints are virtualized, it is tempting to assume that everything within the endpoint is virtualized, and the job is done. Of course, performing a physical-to-virtual migration is the first step in an ongoing process of optimizing applications, the underlying infrastructure, and of course, security. ## AV Storms and all the nastiness If you have virtualized most of your servers, and are starting to optimize by raising consolidation ratios, you will have noticed that traditional antivirus software creates some nasty headaches in virtualized environments. If you have virtualized desktops, you’ll have encountered *“AV storms”* from the start of the project. The *“AV storm”* problem is pretty straightforward. Traditional antivirus is built to work on isolated systems that run on dedicated hardware. In that context, each operating system instance has more-or-less direct access to hardware that no other instance has access to; each system is an island. When those endpoints are virtualized, they share hardware, and access to it is negotiated by the hypervisor. Operating system instances tend to have a lot in common; same files, same memory footprints, and so on. Hypervisors understand that and deduplicate as much of each instance footprint as possible. Essentially, one *“shared”* copy of memory pages is kept if it is the same across every instance running on that hypervisor. ![Virtualization_Virtual_Machines](https://businessinsights.bitdefender.com/hs-fs/file-986074776-jpg/Blog_pics/Antimalware_Virtual_Machines.jpg?width=789&height=518&name=Antimalware_Virtual_Machines.jpg "Virtualization_Virtual_Machines") ## Getting around the duplication problem The problem lies in the applications, and traditional antivirus is really just another application. While hypervisors are great at deduplicating many of the elements of VMs, antivirus software doesn’t play nice. Instead of keeping a central copy of everything, traditional antivirus still operates as though each VM is on an isolated hardware island. Scanning results, databases of signatures, heuristics, and whatever else, are maintained within each VM. If full-system scans are scheduled, they kick-off simultaneously. That’s not a problem in traditional environments, but when many VMs share hardware, the result is a copy of antivirus software in each VM fighting for host resources, thereby saturating the resources. To centralize and deduplicate information and resources, traditional antivirus software has to be re-architected to work in virtualized environments. A true virtualization-friendly antimalware solution will therefore use dedicated virtual appliances to house much of the antimalware functionality. The antimalware resources and information are then shared across many VMs. The result is a much decreased performance impact across the environment, freeing-up resources so that more VMs can be run on the hardware, rather than more antivirus instances. In some cases, vendors have built virtualization-friendly antimalware from the ground-up. In other cases (or within the same solution), vendors have used functionality created by VMware (specifically, vShield Endpoint) to make their solutions virtualization-friendly. Other vendors haven’t done either, and instead rely on workaround-as-a-feature functionality to temporarily appease angry customers. While it’s tempting to declare one approach as *“the best”*, I recognize that the best approach for each customer is, simply, the approach that is best suited for that customer’s environment. **So, rather than making such a bold declaration, I’ve created a Solution Paper that explains some of the differences between two approaches that Bitdefender has created in our Security for Virtualized Environments solution.**  [![Download the Solution Paper: "The 8 Differences Between "Agentless" Security and BD Tools"](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/df27876a-e9be-4af1-a0cc-afc716abc0c7.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/df27876a-e9be-4af1-a0cc-afc716abc0c7) ### Explore More Topics - [Enterprise Security (743)](https://businessinsights.bitdefender.com/topic/enterprise-security) - [Threat Research (201)](https://businessinsights.bitdefender.com/topic/threat-research) - [Cloud Security (174)](https://businessinsights.bitdefender.com/topic/cloud-security) - [SMB Security (170)](https://businessinsights.bitdefender.com/topic/smb-security) - [Ransomware (166)](https://businessinsights.bitdefender.com/topic/ransomware) - [Privacy and Data Protection (137)](https://businessinsights.bitdefender.com/topic/privacy-and-data-protection) - [Cybersecurity Awareness (134)](https://businessinsights.bitdefender.com/topic/cybersecurity-awareness) - [Endpoint Protection & Management (126)](https://businessinsights.bitdefender.com/topic/endpoint-protection-management) - [Endpoint Detection and Response (124)](https://businessinsights.bitdefender.com/topic/endpoint-detection-and-response) - [Managed Detection and Response (119)](https://businessinsights.bitdefender.com/topic/managed-detection-and-response) - [Virtualization & Data Center Security (82)](https://businessinsights.bitdefender.com/topic/virtualization-data-center-security) - [Threat Intelligence (76)](https://businessinsights.bitdefender.com/topic/threat-intelligence) - [IT Compliance & Regulations (71)](https://businessinsights.bitdefender.com/topic/it-compliance-regulations) - [Bitdefender Threat Debrief (55)](https://businessinsights.bitdefender.com/topic/bitdefender-threat-debrief) - [Managed Service Providers (53)](https://businessinsights.bitdefender.com/topic/managed-service-providers) - [#Featured (52)](https://businessinsights.bitdefender.com/topic/featured) - [Advanced Persistent Threats (46)](https://businessinsights.bitdefender.com/topic/advanced-persistent-threats) - [Events (38)](https://businessinsights.bitdefender.com/topic/events) - [Independent Testing (18)](https://businessinsights.bitdefender.com/topic/independent-testing) - [Cybersecurity Advisory Services (9)](https://businessinsights.bitdefender.com/topic/cybersecurity-advisory-services) - [Podcast (3)](https://businessinsights.bitdefender.com/topic/podcast) - [top (2)](https://businessinsights.bitdefender.com/topic/top) See all topics ### Subscribe to Blog Updates ## Read more about this topic ### [Antimalware as a Competitive Differentiator – 3 Advantages for Infrastructure-as-a-Service (IaaS) Providers](https://businessinsights.bitdefender.com/antimalware-differentiator-3-advantages?hsLang=en-us) ### [Protecting the Grid: Utilities and Energy Companies Need to Be Smart About Security](https://businessinsights.bitdefender.com/utilities-and-energy-companies-need-to-be-smart-about-security?hsLang=en-us) ### [Grappling with the Security Talent Shortage? Maybe Automation Can Help](https://businessinsights.bitdefender.com/grappling-with-the-security-talent-shortage-maybe-automation-can-help?hsLang=en-us) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2685110570-png/Bitdefender-Mar2015-Theme/Images/avatar_img_footer.png) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2676149282-png/Bitdefender-Mar2015-Theme/Images/logo_white_footer.png) - [![https://twitter.com/Bitdefender_Ent](https://businessinsights.bitdefender.com/hs-fs/file-2658233851-png/Bitdefender-Mar2015-Theme/Images/ft_soc_tw.png?width=33&name=ft_soc_tw.png)](https://twitter.com/Bitdefender_Ent) - [![Linkedin-icon-300x300](https://businessinsights.bitdefender.com/hs-fs/hubfs/Bitdefender-Mar2015-Theme/Images/Linkedin-icon-300x300.png?width=33&name=Linkedin-icon-300x300.png)](https://www.linkedin.com/company/bitdefender-gravityzone-enterprise-security) - [![](https://businessinsights.bitdefender.com/hs-fs/file-2676149307-png/Bitdefender-Mar2015-Theme/Images/ft_soc_yt.png)](https://www.youtube.com/user/BitdefenderSecurity) - [Legal Terms](https://www.bitdefender.com/legal/) - [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-websites.html) - [EULA](https://www.bitdefender.com/site/view/legal-eula.html) - [Contact Us](https://www.bitdefender.com/business/contact.html) Copyright © 1997-2023 Bitdefender All rights reserved. ![](https://px.spiceworks.com/px/5rec) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Shaun Donaldson", "url" : "https://businessinsights.bitdefender.com/author/shaun-donaldson" }, "datePublished" : "2014-06-10T15:51:00.000Z", "headline" : " Antimalware and Virtual Machines: square peg, round hole problems", "image" : [ "https://businessinsights.bitdefender.com/hs-fs/file-986074776-jpg/Blog_pics/Antimalware_Virtual_Machines.jpg" ], "mainEntityOfPage" : { "@id" : "https://businessinsights.bitdefender.com/antimalware-and-virtual-machines", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://businessinsights.bitdefender.com/hubfs/Bitdefender_Logo_Transparent-2.png" }, "name" : "Bitdefender" } } ```