Virtualization security tools add a level of protection but require what you might call a necessary evil: the ability to sniff all traffic on the vSwitches to which they are connected.