One of the things I hate , is going to a customer after they’ve experienced a cyberattack. The situation is chaotic; production has come to a halt. People are being placed on forced leave. A backup is being desperately sought. And meanwhile, time passes, and there is no certainty about a restart.
For this reason security must be built-in the code of any software solution and should not be added later.
VMware Cloud Foundation 9.1 has security built-int, with many features. You can see many of theese in the picture that help in compliance.
For further details
https://blogs.vmware.com/cloud-foundation/2026/05/05/platform-security-vcf-9-1