architecture

The Enterprise Case for VCF

Run AI, containers and virtual machines on one platform, on hardware you already own. What that adds up to, and what to plan around.

I've written about a lot of small pieces of VCF this year. A release here, a connectivity model there, a patch ordering trap that's going to ruin somebody's Saturday. All useful, but nobody buys a platform one feature at a time, and I've had the same conversation enough times now that it's worth writing down properly.

So: the whole thing. What came out of Explore, what shipped after it, what it actually amounts to for an enterprise, and the bits where I think the story is thinner than the slides suggest.

I worked for Broadcom when I wrote this, so I'm not a neutral party here and you should read it that way. I've tried to be straight about the parts that are still maturing, because a platform case that only covers the good news isn't much use to anyone planning real work.

Start with the problem

Hardware got expensive this year. Really expensive. The refresh you budgeted eighteen months ago doesn't buy what you assumed, and DRAM pricing in particular has caught a lot of people out.

Meanwhile somebody upstairs wants AI in production, on data that can't leave the building. The regulators have discovered operational resilience, so the evidence burden has gone up. And your team is the same size it was.

Any one of those is manageable. Together they're the reason I keep having the same conversation.

Broadcom ran a survey of 1,800 senior IT decision-makers through Radius Tech in February and March (Private Cloud Outlook 2026). It's vendor-commissioned and you should read it as such, but the numbers match what I see. 56% running or planning production AI inference on private cloud, with public cloud for the same workloads down to 41% from 56% the year before. 83% considering moving workloads back. Half have already moved some. All of those figures come from the same survey (source).

56%

AI INFERENCE ON PRIVATE CLOUD

41%

PUBLIC CLOUD, DOWN FROM 56%

83%

CONSIDERING REPATRIATION

62%

WORRIED ABOUT AI COST

The bit I find more interesting than the headline is what's driving the repatriation. Security and compliance still leads at 51%, which is what you'd expect. But cost predictability and performance have both climbed to 39% (source). People aren't moving back out of principle. They're moving back because the running costs stopped lining up with what they'd planned for.

The argument, before the detail

Run AI, containers and virtual machines on the same platform, on hardware you already own, with one operating model and one set of evidence when the auditors turn up.

Whether that's true for your estate is what the rest of this is about.

Getting more out of what you already bought

I'd lead with this for anyone under budget pressure, because none of it needs new capital.

The topology-aware CPU scheduler

Shipped in 9.1. Published figures are up to 30% higher SQL Server throughput, around 26% on Oracle, and peak PostgreSQL latency in VMmark roughly halved (Broadcom, 27 August 2026). The one with the clearest commercial edge is the SAP HANA certification at two VMs per socket on Granite Rapids with SNC-2, because that changes consolidation ratios on servers already sitting in your racks. There's a performance whitepaper with the test conditions if you want to check rather than take the headline.

Memory tiering onto NVMe

The answer to DRAM pricing, more or less. Extends usable memory using NVMe behind DRAM. Read the drive selection guidance before specifying anything, because the endurance and latency of the NVMe you pick decides whether this helps or quietly hurts.

GPU pooling and multi-tenant model sharing

Broadcom's performance team tested this in September and published the rig, which is rare enough to be worth noting. A single tenant on a light inference workload used 36 to 38% of the GPU streaming multiprocessors. Four tenants on the same hardware took it to 71%, with throughput rising from roughly 4,500 to 18,000 tokens a second (Broadcom, 21 September 2026, with the test setup in the white paper). Multi-tenant model sharing went GA in 9.1.1, so one model instance serves several teams rather than everyone running their own copy. If you've got GPUs allocated and idle, and most people do, that's capacity back without a purchase order.

Not exciting. Does show up on the budget though.

AI without moving the data

Private AI Cloud is three things stacked. VCF 9 underneath, AI Factory automating the path from bare metal to a served model, and a model layer running over 150 open-source models on a vLLM runtime (announcement).

The vLLM part matters more than the count. It means the serving layer is a community-maintained thing rather than something proprietary, so model portability is real rather than asserted. Models from NVIDIA, Google DeepMind, NEC, Alibaba and Z.ai are being validated to run on-premises.

What AI Factory actually automates

Bare metal through VCF deployment to a served model, plus Day 2. A partnership with MetalSoft extends the automation into heterogeneous bare-metal provisioning, which is the part that was never automated and where all the time went. Broadcom says this takes bare-metal-to-first-model from weeks to hours. I'd treat that as a vendor claim until somebody independent runs it, though the mechanism they describe is specific enough that I believe the direction of it.

Confidential computing

AMD SEV-SNP and Intel TDX both GA now, with memory encrypted in hardware while data is being processed. That closes the data-in-use gap that used to be handled with contract language and hope. If you've ever tried to write a sovereignty argument, the difference between a guarantee enforced in silicon and a policy enforced in software is the difference between a control and a promise. There's a full setup walkthrough published if you want to try it.

The certification backdrop

vSphere 9.1 and all future 9.x releases are NVIDIA-Certified Hypervisor. The MLPerf Inference 5.1 results cover speech to text, text to video, LLMs up to 405B parameters, graph neural networks and computer vision, across H200, B200 and Intel Xeon with AMX (results). The certification itself is here.

Security built for an automated attacker

This is the strongest part of the 2026 story and it doesn't get the keynote time it deserves.

The threat model Broadcom keeps describing is specific, and it's the right one: autonomous attack agents exploit the gap between an advisory being published and a patch being applied. That's not a flaw in your platform. It's a gap in your process, and most of us have one.

Agentic security: AgentMinder, vDefend and Avi

An AI agent isn't a user and isn't a service account, so your IAM has no idea what to do with it. AgentMinder gives it an identity, a mission, a set of authorised tools and runtime policy, then checks four things at a gateway before every invocation: identity, tool authorisation, declared intent, and which data it's reaching for. Every interaction writes to OpenTelemetry. For anyone in a regulated environment that audit trail is the whole point, because 'the model decided' is not going to survive a resilience review. vDefend adds discovery of agentic components from traffic, shadow AI detection, and distributed virtual patching using AI-generated IDPS signatures. Avi handles API protection and lateral security.

TrueSource and the 26% problem

Testing by 1Password's Off-by-1 Labs found that of 6,000 AI-generated patches, only 26% fixed the vulnerability without breaking the application. The figure is cited in Broadcom's TrueSource announcement, and Off-by-1 Labs is the primary source if you want to check the method. I think that's the most useful number published all year. AI made exploitation faster. It has not made remediation safe to automate, and plenty of vendors are selling the opposite. TrueSource sits in that gap: frontier models scanning at machine speed, humans verifying. Covers Spring and more than 5,000 Java libraries, plus Python and Node.js with clean-room builds at SLSA Build Level 3, and the same treatment for PostgreSQL, RabbitMQ, MySQL and Valkey (source).

Post-quantum, and what you can do today

Avi already supports hybrid post-quantum key exchange in TLS, so anything public-facing behind it can be protected against harvest-now-decrypt-later right now. That's the one actionable item. The dates to plan against are NIST IR 8547 deprecating RSA-2048 in 2030 and disallowing it in 2035 (NIST PQC project), lined up with NSA CNSA 2.0. Against five to seven year refresh cycles, the kit you buy in the next two rounds needs to be able to get there.

The Frontier AI Security Readiness Program

Assess, Architect, Implement, Upskill. Whether or not you engage with the programme, steal the five-pillar scoring model: People and Process, User Security, Platform Security, Lateral Security, Application Security and Recovery. Putting people and process in as a scored architectural pillar is unusual. It's also correct. Nearly every estate I've reviewed that scored badly on security didn't fail on capability, it failed because nobody owned patch cadence or the identity model had drifted for three years without anyone looking at it.

Running it at fleet scale

More changed here in 9.1.1 than the release notes let on.

Log management is now converged into VCF Operations, which is why eleven management packs went GA on the same day, each one rebuilt to carry logs as well as metrics. Five of the eleven are databases: SQL Server, Oracle, PostgreSQL, MySQL, MongoDB. The database layer has always been where infrastructure monitoring stops and somebody else's console starts, and that boundary is where half the time in a major incident gets burned comparing screenshots on a bridge call.

There's an AI Assistant in the Operations console for Day 2 work, and for regulated customers the useful part is that you can point it at a model you host yourself. Also OpenTelemetry observability for VKS, since containers appear and vanish faster than infrastructure polling can follow.

The licensing line that catches people out

Infrastructure management packs are available on vSphere Foundation, VCF Edge and VCF. Application and management packs, which is the database category, are VCF Edge and VCF only (feature comparison). Same story for application monitoring via Telegraf and the Prometheus Management Pack Builder. If database visibility is your main operational gap and you're on vSphere Foundation, that's an edition conversation, and it's the kind of thing people find in month three rather than during design.

Self-service, without handing over the keys

VCF Automation gives you organisations and projects, quotas, and a catalogue. VKS gives application teams Kubernetes on the same platform. Data Services Manager does the same for databases. GitOps with Argo CD landed natively in 9.1.1, in Tech Preview, one instance per hosting namespace and scoped to a single region.

If you're building this, the tenancy model is the thing to get right. Organisation and project hierarchy, quota approach, network isolation boundaries. It's expensive to change once real tenants depend on it, and in my experience it's the decision that gets made last, usually by whoever is free that week.

Open at the edges

This is the part of the strategy I find most persuasive, and it's got nothing to do with features.

EVPN interoperability means VCF Networking meets an existing physical fabric on a published standard instead of a proprietary integration. Cisco Nexus One first, then Arista, which turns it from a partnership into a pattern. In practice it means a recent network refresh stops being a reason not to adopt.

Same thinking in hardware. AMD Instinct with ROCm alongside NVIDIA. Dell, Cisco, Lenovo, Supermicro. ODM self-certification. There's a documented Supermicro HGX reference architecture that goes right down to the cable type, and it uses RoCEv2 Ethernet on Broadcom Tomahawk 4 rather than InfiniBand, which keeps the GPU fabric something your network team can actually reason about.

Fewer decisions you can't reverse. That's worth something in a five year platform choice.

What to plan around

A lot of the AI stack is still preview

The AI gateway, native object storage and the GitOps service are all Tech Preview with no committed GA dates. Tanzu governed data products are Fall 2026. Plan for them, don't build on them, and be careful how they appear in a business case.

Some of the numbers need attribution

Several figures around 9.1.1, including a 2.6x Kubernetes improvement and a 46% operational cost reduction, are Broadcom's own internal estimates and are labelled that way in the announcement. Same with the 137% ROI figure published in September. They come with the attribution attached, and it's worth keeping it attached when you reuse them, because a finance team will ask where a number came from before they'll build on it.

The upgrade is a real project

The move to 9.1 needs subscription licensing in place, so for some estates that's a procurement conversation to close before the technical planning starts. Boot devices under 128 GB need remediating and Auto Deploy is deprecated, so hosts with local disks need moving to Zero Touch Provisioning (ESX hardware requirements). Patch ordering in 9.1.1 contradicts what everyone has learned to expect from a maintenance release (release notes). None of it is insurmountable. All of it is work, and it's much cheaper to find in week zero than week three.

The operating model change is the bigger one

Provider and consumer split. Who curates the catalogue, who owns quotas, who gets called when a self-service workload falls over at 2am. Agent identity as a new class your IAM has no model for. These are organisational questions dressed as technical ones, and they decide whether the platform gets adopted or quietly routed around.

How I'd judge it for a real estate

Not a buying checklist. A deciding-honestly checklist.

Measure utilisation first. CPU, memory, GPU streaming multiprocessors. The consolidation argument only works if your own numbers show headroom. Work out whether AI on your own infrastructure is a genuine requirement or something everyone has assumed. If the data can leave, the case is much weaker. Price the sovereignty and compliance premium up front rather than discovering it in month four. Separate what's GA from what's preview, and build the plan on the first list only. Count the edition boundaries against what you actually intend to use. Ask whether the organisation can absorb an operating model change, separately from whether the technology works. Score doing nothing properly. If it loses, it should lose on evidence rather than being waved away.

What I actually think

The direction is more coherent than it was two years ago. One control plane for virtual machines, containers, GPUs, models, data and agents, with open standards at the edges so your fabric and your hardware aren't stranded. Everything from Explore fits that shape, which is not always the case with platform strategies.

Whether it suits you comes down to two things that have nothing to do with the feature list. Whether you've got a real reason to run AI on infrastructure you control. And whether your organisation can change how it operates while still keeping the lights on.

If both are yes, the platform is further along than a lot of people outside it realise, and the case is strong. If either is still an open question, that's the thing to resolve first, because it shapes everything that follows.

Sources, figure by figure

Every number above, and where it came from. Where a figure is a vendor estimate rather than an independent measurement, I have said so.

MARKET AND SURVEY DATA

Broadcom Private Cloud Outlook 2026: the 56%, 41%, 83%, 62%, 51% and 39% figures, plus the methodology. Radius Tech, 1,800 senior IT decision-makers at organisations of 1,000-plus employees, fielded February to March 2026 across eight countries. Vendor-commissioned.
See How Organizations Achieved 137% ROI with VCF 9: the ROI figure. Broadcom-published, check the underlying study before reusing.

PERFORMANCE

Next-Gen Topology-Aware CPU Scheduler: 30% SQL Server, 26% Oracle, PostgreSQL latency, and the SAP HANA two-VMs-per-socket certification. Broadcom testing.
Optimizing AI Deployments with VCF, Part 1 and the white paper: the 36 to 38% and 71% GPU utilisation figures, the 4,500 to 18,000 tokens per second throughput, and the full test configuration. Broadcom performance team, 21 September 2026.
MLPerf Inference 5.1 results on VCF and NVIDIA Hypervisor Certification.
New AI and Kubernetes operations capabilities in 9.1.1: the 2.6x Kubernetes and 46% operational cost figures. Broadcom internal estimates, labelled as such.

SECURITY

Broadcom Strengthens Spring Security with TrueSource: the 26% of 6,000 AI-generated patches figure, originally from 1Password's Off-by-1 Labs, plus the 5,000-plus Java libraries and SLSA Build Level 3 claims.
Frontier AI Security Readiness Program: the five-pillar model and the four-stage structure.
End-to-End Security, Identity and Observability for Agentic AI: AgentMinder, vDefend and Avi capabilities.
NIST Post-Quantum Cryptography project and NSA CNSA 2.0 FAQ: the 2030 and 2035 dates. NIST IR 8547 is the specific document for the deprecation timeline.

PLATFORM, RELEASE AND LICENSING

Broadcom Introduces VMware Private AI Cloud: the 150-plus model count and the vLLM runtime.
Broadcom Announces VMware AI Factory: the MetalSoft partnership and the weeks-to-hours claim.
VCF 9.1.1.0 release notes: patch ordering, the Bill of Materials, and the direct 5.2.x and 9.0.x upgrade path.
VCF 9.1 and VVF 9.1 feature comparison: the edition boundaries on management packs and application monitoring.
ESX hardware requirements: boot device sizing and the Auto Deploy position.
Centralizing GitOps with VCF 9.1.1: the one-instance-per-namespace and single-region scoping.
Confidential Computing setup walkthrough, Supermicro HGX reference architecture and NVMe drive selection for memory tiering.
Open networking with Cisco: the EVPN interoperability work.

Figures move between releases and surveys get re-run. Check anything you intend to put in a design document or a business case against the source before you use it.

Views expressed here are my own.