Securing the ESXi Hypervisor – by default the ESXi Shell and SSH services are not running and only the root user can log in to the Direct Console User Interface (DCUI) if you decide to enable ESXi or SSH access you can set timeouts to limit the risk of unauthorized access
VMware has also published a list of best practices for administrators of their ESXi hypervisors on how to secure them and limit the attack surface on the hypervisor itself