To secure your VMs, keep the guest operating systems patched and protect your environment just as you protect your physical machine. Consider disabling unnecessary functionality, minimize the use of the VM console, and follow other best practices.

Protect the guest operating system
To protect your guest operating system, make sure that it uses the most recent patches and, if appropriate, anti-spyware and anti-malware applications. See the documentation from your guest operating system vendor and, potentially, other information available in books or on the Internet for that operating system.
Disable unnecessary functionality
Check that unnecessary functionality is disabled to minimize potential points of attack. Many of the features that are used infrequently are disabled by default. Remove unnecessary hardware and disable certain features such as host-guest filesystem (HGFS) or copy and paste between the VM and a remote console.
See Disable Unnecessary Functions Inside Virtual Machines.
Use templates and scripted management
VM templates enable you to set up the operating system so that it meets your requirements, and to create other VMs with the same settings.
If you want to change VM settings after initial deployment, consider using scripts, for example, PowerCLI. This documentation explains how to perform tasks using the GUI. Consider using scripts instead of the GUI to keep your environment consistent. In large environments, you can group VMs into folders to optimize scripting.
For information on templates, see Use Templates to Deploy Virtual Machines and the vSphere Virtual Machine Administration. For information on PowerCLI, see the VMware PowerCLI documentation.
Minimize use of the virtual machine console

The virtual machine console provides the same function for a VM that a monitor on a physical server provides. Users with access to a virtual machine console have access to VM power management and to removable device connectivity controls. As a result, virtual machine console access might allow a malicious attack on a VM.

Consider UEFI secure boot
Starting with vSphere 6.5, you can configure your VM to use UEFI boot. If the operating system supports secure UEFI boot, you can select that option for your VMs for additional security. See Enable or Disable UEFI Secure Boot for a Virtual Machine.