In the new vSphere ESXi architecture, the COS has been removed and all of the VMware agents run directly on the VMkernel. Infrastructure services are provided natively through modules included with the VMkernel. Other authorized 3rd party modules , such as hardware drivers and hardware monitoring components, can run in VMkernel as well. Only modules that have been digitally signed by VMware are allowed on the system, creating a tightly locked-down architecture. Preventing arbitrary code from running on the vSphere host greatly improves the security of the system.