Once vMotion is triggered, Deep Security Virtual Appliance (DSVA) restores the status for the guest virtual machine (VM), sending policy from the Deep Security Manager (DSM) to restart the protection.
There was an issue found in Deep Security 12.0 GM version, it may take a long time until the VM can be protected again after the vMotion.
This symptom can be noticed in Trend Micro Deep Security Virtual Appliance with agent version 12.0 and NSX-T that enable Guest Introspection functionality only.
There is an implement introduced in Deep Security 12.0 U1 and above, however, it may still take up to 25 seconds until the VM can be protected after vMotion.
It is a current limitation as per design, and there is no resolution at this point.