VMware Explore 2026 arrived at a moment when the enterprise AI conversation is moving rapidly from experimentation into production architecture.
For the last several years, organizations have focused heavily on gaining access to models, GPUs, AI development tools, and increasingly capable agent frameworks. But production AI introduces a much broader set of requirements. Enterprises need predictable infrastructure economics, governed data access, runtime security, model flexibility, agent identity, software supply-chain controls, and a way to operate all of those layers without creating another fragmented stack.
That was the central message behind Broadcom’s announcements at VMware Explore 2026.
Across VMware Private AI Cloud, VMware AI Factory, Tanzu Platform, AgentMinder, VMware vDefend, VMware Avi Load Balancer, TrueSource, and an expanded ecosystem of validated AI models, Broadcom presented a cohesive strategy: make VMware Cloud Foundation the operating layer through which enterprises can build, run, secure, and govern AI while keeping sensitive data under their control.
The broader implication is significant. Broadcom is no longer positioning private cloud primarily as an alternative to public cloud. It is increasingly positioning private infrastructure as a deliberate architecture for enterprise AI.
Private AI Cloud Becomes the Center of the VMware Strategy
The clearest message from Explore was that AI is becoming central to how Broadcom defines VMware Cloud Foundation.
VMware Private AI Cloud brings inference workloads, agentic applications, containers, traditional virtual machines, security, and infrastructure operations together under one architecture. Broadcom’s argument is that enterprises should increasingly bring models to their data rather than continuously moving sensitive data into external AI environments.
The positioning reflects an important change in the market. Public AI services made experimentation remarkably easy, but production introduces different concerns. Data sovereignty, compliance, intellectual property protection, GPU utilization, inference economics, and runtime security become much more important when AI begins touching actual business processes. Broadcom is betting that those pressures create a renewed role for private infrastructure.
That does not mean enterprise AI will abandon public cloud. Hybrid architectures will remain the norm. But AI gives organizations a stronger reason to evaluate where individual workloads should run based on data sensitivity, cost, performance, and governance instead of treating cloud location as a default architectural decision.
AI Factory Targets the Metal-to-Model Problem
VMware AI Factory was one of the most important announcements because it focuses on a part of AI deployment that receives far less attention than model development: everything required before the first production model can actually run.
Building AI infrastructure means provisioning physical servers, configuring accelerators, standing up storage and networking, deploying Kubernetes, installing model runtimes, establishing observability, and maintaining the environment over time. Broadcom wants to turn those layers into a software-defined deployment workflow.
VMware AI Factory is designed to automate infrastructure provisioning and lifecycle operations, with Broadcom saying VCF can reduce the path from bare metal to first model deployment from weeks to hours. A new MetalSoft integration extends that automation into heterogeneous physical hardware, with the goal of reducing bare-metal provisioning from weeks to minutes.
That matters because AI infrastructure will increasingly be heterogeneous. Organizations may run NVIDIA GPUs in one environment, AMD accelerators in another, CPUs for smaller models, and different server platforms across data centers. Broadcom’s partnerships with Dell, Cisco, Lenovo, Supermicro, AMD, and others reinforce the idea that VCF should abstract some of that hardware complexity rather than force customers into one tightly prescribed stack.
The private AI services above that infrastructure are equally important. Multi-tenant model sharing allows teams to consume shared models without duplicating GPU resources for every business unit. The AI Gateway introduces prompt routing, usage controls, token rate limiting, and application authorization. VCF also adds visibility into token throughput, latency, memory, and compute utilization.
The direction is clear: AI infrastructure is becoming an operational discipline rather than simply a capacity problem.
Token Economics Moves Into Infrastructure Operations
One of the more interesting themes at Explore was Broadcom’s repeated emphasis on token economics.Infrastructure teams traditionally monitor CPU, memory, storage, throughput, latency, and application performance. AI introduces another operational unit: tokens. At small scale, token consumption may look like a model billing concern. At enterprise scale, it becomes directly connected to infrastructure efficiency.
An inefficient agent can create repeated prompts, unnecessary reasoning loops, redundant retrieval operations, and excessive model calls. Those behaviors increase inference demand and ultimately drive GPU, memory, and infrastructure utilization.
That means FinOps for AI will increasingly need to connect application behavior with model consumption and physical compute.
Private AI may provide more predictable economics for certain high-volume workloads, but those savings are not automatic. Enterprises still need to understand which applications and agents are consuming resources and whether that consumption is delivering useful business outcomes.
Broadcom’s focus on token monitoring suggests infrastructure vendors increasingly understand that AI economics will need to become observable at the platform layer.
Model Choice Becomes Part of the Infrastructure Layer
Broadcom also expanded the model ecosystem around VCF. The company announced validated support for NVIDIA Nemotron 3, Google DeepMind Gemma 4, NEC cotomi, Alibaba Cloud Qwen3.8-27B, and Z.ai GLM 5.2. With vLLM serving as the default runtime, Broadcom says customers can run more than 150 open source models while supporting mixed compute across AMD, Intel, and NVIDIA infrastructure.
This is strategically important because enterprise AI is moving toward multi-model architectures. Different models will increasingly be selected for coding, reasoning, multimodal workloads, language specialization, customer interaction, and cost-sensitive inference. Model development is moving too quickly for most enterprises to confidently assume that one provider will remain the best fit for every workload.
Broadcom still has to demonstrate how seamless model switching becomes once customers integrate those models into data, security, monitoring, and application workflows. But abstracting model deployment from underlying infrastructure is an important part of reducing long-term lock-in.
Agent Governance Moves Into Runtime Control
AgentMinder represents one of Broadcom’s more strategically important announcements. Agentic AI introduces a fundamentally different identity problem from traditional applications. Enterprises do not simply need to know who an agent is. They need to understand which mission it has been assigned, which tools it should be allowed to invoke, what resources it can access, and whether each action remains appropriate as the workflow changes.
AgentMinder is designed to address that problem by treating agents as enterprise identities while binding their authority to declared missions, permitted intent, approved tools, and authorized resources.
Runtime enforcement evaluates tool calls using contextual information, while an OpenTelemetry-based observability layer provides chain-of-custody information across agent sessions and actions.
This reflects a broader shift in enterprise identity architecture. Traditional access control asks whether an identity has permission to use a resource. Agentic systems increasingly require continuous authorization that asks whether a specific action should be allowed in the current context.
That is a much more dynamic governance problem. AgentMinder’s ability to operate alongside models deployed on-premises, in virtual private clouds, or on public-cloud infrastructure is also important. Enterprises are unlikely to build every agent on one framework or deploy every model in one environment, so agent governance will increasingly need to extend across platforms.
Governed Data Becomes the Foundation for Trusted Agents
The Tanzu announcements reinforce another key theme from Explore: governing the agent is not enough if the data behind the agent cannot be trusted. Broadcom introduced AI-ready data foundations in Tanzu Platform built around access, context, and lineage.
Federated querying allows agents to access data where it already lives rather than forcing enterprises to create additional copies elsewhere. Data can then be prepared as governed products before agents consume it, while lineage is maintained so outputs can be traced back to their originating sources.
That reflects one of the biggest lessons emerging from production AI. Agents are only as reliable as the context available to them. Enterprise data is often fragmented, poorly described, inconsistently permissioned, or buried inside systems never designed for machine consumption. Giving an agent more raw information does not necessarily improve accuracy. In some cases, it simply creates more opportunities to reason incorrectly.
Tanzu also extends its deny-by-default agent runtime, where agents receive no access to APIs, networks, MCP servers, external services, or credentials unless explicitly granted. The agent sandbox is being integrated with VMware vSphere Kubernetes Service, while developers can use prebuilt harnesses or bring their own development approach and rely on Buildpacks for deployment.
The important point is that governance is moving into the platform instead of remaining scaffolding developers must build themselves.
Agentic Security Expands Beyond Identity
Explore also showed that Broadcom sees agent security as a layered problem. AgentMinder handles identity and authorization. Tanzu controls runtime access and data. VMware vDefend and Avi Load Balancer are being extended into the network and application traffic connecting agents, models, tools, MCP servers, and datastores.
VMware vDefend’s planned Agentic Zero Trust capabilities are designed to discover AI components through traffic monitoring, including models, MCP servers, tools, and datastores. Broadcom also plans shadow AI monitoring and AI-generated Intrusion Detection and Prevention signatures intended to accelerate virtual patching.
Avi adds another layer through Agentic Threat Defense. The planned capabilities include restricting access to unauthorized MCP tools, detecting remote code execution and file injection attempts, establishing behavioral baselines for identifying zero-day activity, and detecting sensitive information leaving the environment.
The broader takeaway is that no single agent security layer will be sufficient. Identity controls who the agent is. Authorization determines what it should do. Runtime containment limits what it can reach. Network security observes communication patterns. Application-layer security evaluates what is actually happening inside those interactions.
That layered architecture is likely to become increasingly common as agent deployments move into production.
TrueSource Extends the AI Story Into Software Supply-Chain Security
TrueSource represented a different side of Broadcom’s strategy. The portfolio combines Spring Enterprise, TrueSource Trusted Artifacts for Java, Python, and Node.js, hardened Bitnami images, and TrueSource Data Services for PostgreSQL, RabbitMQ, MySQL, and Valkey. The underlying thesis is that AI accelerates both software development and vulnerability exploitation.
Broadcom is pushing back against the idea that fully autonomous AI patch generation is ready to replace human engineering. The company cited testing from 1Password’s Off-by-1 Labs in which only 26% of 6,000 AI-generated patches successfully fixed vulnerabilities without breaking applications. Broadcom instead uses frontier models to accelerate scanning while retaining human verification of fixes.
That balance is worth watching. AI can accelerate security processes, but enterprises still need confidence that automated remediation will not introduce operational instability. TrueSource therefore fits the larger Explore narrative: automation should increase speed, but accountability still matters when AI touches production systems.
Customer Deployments Strengthen the Private Cloud Argument
Broadcom also highlighted several customer deployments that give the strategy more substance.
Chunghwa Post used VCF Private AI Services and GPU virtualization to create shared AI infrastructure. Broadcom reports that the organization reduced production AI environment deployment time by 99%, lowered server capital expenditure by 80%, and used its anti-fraud systems to detect and block approximately NT$900 million in fraudulent transactions.
Standard Chartered said approximately 70% of its global infrastructure footprint is already operating on its VCF architecture across 55 markets, with infrastructure deployment reduced from weeks to a day. Land Bank of Taiwan moved its mission-critical core from bare metal to VCF and VMware vSphere Kubernetes Service while reducing weeks of environment configuration to minutes and doubling API speeds.
The University of Texas System provides another useful AI example, using VCF Private AI Services to support shared AI infrastructure across 13 academic and health institutions while retaining control over sensitive data and infrastructure costs.
These are vendor-selected examples and should not be treated as universal benchmarks. But they demonstrate the outcome Broadcom now needs to reproduce consistently: faster provisioning, better infrastructure utilization, stronger governance, and measurable business impact.
Broadcom Is Trying to Collapse the AI Infrastructure Stack
Taken together, the announcements reveal the larger strategy. Broadcom is attempting to bring AI infrastructure provisioning, model deployment, token monitoring, governed data, agent runtimes, enterprise identity, network security, application security, and software supply-chain controls into a common operating architecture.
That addresses a very real enterprise problem. AI architectures are becoming fragmented before many organizations have even reached broad production deployment. Models, gateways, agent frameworks, MCP servers, vector databases, observability products, security tools, and GPU schedulers increasingly come from different vendors and operate through different governance models.
A unified architecture can reduce that complexity, but it also increases platform dependency.The more infrastructure, security, identity, data, and developer workflows an enterprise operates through VCF, the more strategically important that platform becomes.
Broadcom appears to recognize that tension. Support for Kubernetes, OpenTelemetry, AuthZEN, MCP, vLLM, multiple model providers, and heterogeneous hardware reinforces an openness narrative around the stack. The test will be whether that openness translates into meaningful portability once organizations build operational processes around the platform.
Looking Ahead
VMware Explore 2026 made Broadcom’s direction increasingly clear. Private AI Cloud provides the overarching architecture. VMware AI Factory automates the infrastructure underneath it. Model validation expands choice above it. Tanzu connects developers and agents to governed enterprise data. AgentMinder introduces identity and runtime authorization. vDefend and Avi extend security into agentic traffic. TrueSource addresses the software supply chain underneath those workloads.
Over the next 12 to 24 months, we expect several trends highlighted at Explore to accelerate:
- Private and public AI will increasingly operate as parts of one hybrid architecture rather than competing deployment models.
- Token economics will become an infrastructure and FinOps discipline.
- Multi-model architectures will push model portability higher on enterprise requirements lists.
- AI governance will shift from static permissions toward continuous runtime authorization.
- Agent identities, MCP servers, tools, and models will become first-class security assets.
- Governed enterprise context will become as important as model capability for production AI.
- Network and application security will increasingly become AI-aware.
- Software supply-chain security will use AI aggressively while preserving human accountability for high-risk remediation.
The biggest question for Broadcom now is execution. The company has assembled a broad vision spanning infrastructure, applications, security, identity, data, and AI. Some capabilities are available today while others remain roadmap items, and enterprises will need to distinguish between those carefully.
Broadcom also has to prove that integration creates simplicity rather than simply moving complexity underneath a larger platform. But the direction coming out of VMware Explore 2026 is clear. VMware Cloud Foundation is no longer being positioned simply as the infrastructure beneath enterprise workloads.
Broadcom increasingly wants it to become the operating layer through which enterprises build, run, govern, and secure AI in production.
