Nationwide Building Society has announced an expansion of its partnership with Broadcom as the firm accelerates its digital transformation and hybrid cloud strategy.

As part of the move, the building society plans to adopt VMware Cloud Foundation (VCF) as the company works to build a new private cloud platform.

The VMware service allows enterprises to build custom private cloud setups, combining compute, storage, networking, and security capabilities.

Nationwide said the use of VCF will enable it to deliver more resilient and scalable digital services to customers while also streamlining integration of Virgin Money assets following a £2.9 billion takeover announced in April this year.

Paul Walsh, Director of Infrastructure and Service Delivery at Nationwide, said the partnership extension represents a “significant step forward” in the company’s technology strategy.

As we continue to evolve as a business, including integrating Virgin Money into the group, it is vital that we have a resilient, scalable, and secure technology foundation,” he commented.

“A private cloud built on VMware Cloud Foundation enables us to simplify operations, accelerate innovation, and deliver seamless digital experiences for our members, while maintaining the trust and stability that define the Nationwide brand.”

Nationwide eyes long-term AI gains

While VCF will enable Nationwide to establish a private cloud setup, long-term, Broadcom said it will act as a springboard for cloud native and AI applications.

As ITPro reported last year, Nationwide ranks among a host of UK banks ramping up the use of generative and agentic AI internally, with a particular focus placed on improving workforce efficiency and productivity.

In January, Nationwide announced a partnership with Moneyhub to roll out an AI-powered transaction analytics feature for customers across the UK.

Joe Baguley, Broadcom’s chief technology officer for EMEA, said Nationwide is pursuing a “deliberate and strategic approach” to private cloud that will underpin future innovation by “balancing agility and control”.

“By extending our partnership and adopting VMware Cloud Foundation as a consistent platform across the group, Nationwide will be able to integrate operations more efficiently, accelerate service delivery, and reduce operational complexity, while maintaining the security and governance expected of a leading UK financial services brand,” he said.

Hybrid cloud innovation

As part of its hybrid cloud strategy, Nationwide also maintains close ties with Amazon Web Services (AWS).

In January this year, the bank announced an extension of its partnership with the hyperscaler to deliver “more personalized experiences” for 17 million customers across the country.

Nationwide uses AWS’ cloud-based contact center platform, Amazon Connect, for customer support, giving teams access to a raft of AI-powered tools to streamline operations.

Speaking at the time, Suresh Viswanathan, group chief operating officer at Nationwide, said the expanded partnership aims to further consolidate workloads using AWS and modernize services.

"As we continue our digital transformation, we need cloud technology that can support our ambition to deliver better customer experiences, while keeping safety and security at the forefront,” Viswanathan said.

FOLLOW US ON SOCIAL MEDIA

A cloud industry group has filed an antitrust complaint with the European Commission, claiming that Broadcom is seeking to use unfair software licensing terms to control the European cloud market.

Cloud Infrastructure Service Providers in Europe (CISPE) is aiming to prevent Broadcom from terminating VMware’s Cloud Service Provider (CSP) partner program at the end of this month, saying it represents an existential threat to European cloud providers.

“With the termination of the Broadcom program allowing access to VMware virtualization software, businesses - both cloud providers and their customers - are being irreparably damaged by Broadcom’s unfair actions, which we believe are illegal," said CISPE secretary general Francisco Mingorance.

"After imposing outrageous and unjustified price hikes immediately following the acquisition of VMware, Broadcom is now applying the ‘coup de grâce’. We need urgent intervention to force them to change. The only way to stop bullies is to stand up to them.”

Earlier this year Broadcom announced plans to terminate the program in Europe, keeping only a minority of specially-picked partners and excluding most European CSPs from selling VMware products, CISPE claimed.

The trade group claims these changes will create virtual monopolies in some markets with vendors entirely dependent on Broadcom.

What CISPE wants from Broadcom

CISPE is now asking the European Commission to implement interim measures. It wants the decision to terminate its VCSP partner program to be immediately suspended, with the readmittance of European cloud service providers, allowing them to continue to sell VMware.

It also wants the reintroduction of the ‘white label’ program, axed by Broadcom in 2025, which previously allowed SMB and smaller cloud providers to offer VMware software as part of their cloud solutions.

Finally, CISPE believes that explicit protections against retaliation from Broadcom may be needed, with a system of fines to ensure compliance with these terms.

Broadcom is locked in an EU battle

The plan to terminate VMware’s Cloud Service Provider partner program came on top of other changes following Broadcom’s acquisition of VMware.

These included price hikes, bundling, and demands for up-front payments alongside minimum commitments based on potential, rather than actual, usage.

CISPE said these moves have increased costs for customers by more than 1,000% in some instances.

"In 2024, within just a few weeks, VMware changed its prices, licensing model, ordering processes, and more — without providing customers with the necessary information or sufficient time to adapt," said Danielle Jacobs, CEO at Beltug, the Belgian Association of CIOs & Digital Technology Leaders.

"To this day, our members continue to contact us about the difficulties they face. The announced shake‑up of the previously well‑functioning ecosystem between VMware partners and end users has only added to the challenges and uncertainty."

CISPE's complaint supports a similar request from Voice e.V, which represents many of the largest IT customers in Germany, filed in May last year. Broadcom has rejected the allegations.

FOLLOW US ON SOCIAL MEDIA

The exodus from VMware after its acquisition by Broadcom may not have been the stampede that was predicted, but customers are working to reduce their footprint regardless.

Customers voiced serious concerns about changes to its operating model in the wake of the acquisition, including rises in licensing costs and the removal of a series of popular licenses and products altogether.

Indeed, research from Civo at the time found more than half (51.9%) of VMware customers said they were considering ditching services while 48.7% said they were actively exploring alternative providers.

Fresh research from CloudBolt now shows that while the shift away from VMware wasn't immediate, organizations are actively unwinding dependence in a measured, workload-by-workload process.

"Two years ago, the market was dominated by knee-jerk speculation and worst-case projections,” said CloudBolt CMO Mark Zembal.

“This latest study separates noise and speculation from reality. The fear has cooled, but the pressure hasn’t — and most teams are now making practical moves to build leverage and optionality — even if for some that includes the realization that a portion of their estate never moves off VMware.”

Some are sticking with VMware because things haven't turned out as badly as feared.

In 2024, 73% of customers expected VMware costs to more than double, CloudBolt found, yet only 5% of respondents to this most recent study have seen that happen.

The majority (88%) are still concerned about future price increases, however, and these worries are shaping decisions now as the real squeeze begins. Around 86% reported they are actively reducing their VMware footprint, but progress is slow as this is a time-consuming and laborious process.

“The process of unwinding a decade of process dependencies is taking 18 to 24 months," commented one survey respondent. "This sideways abstraction is far more complex than a standard cloud lift-and-shift, leading to a significant loss of confidence in our ability to exit quickly enough to avoid the next renewal cliff.”

VMware strategies are all over the place

Notably, more than half (56%) of respondents said they’ve changed their VMware strategy more than once since the takeover. Just over half (54%) are staying with VMware while actively reducing dependence in a phased approach.

Nearly three-quarters (72%) of migrated workloads are heading to public cloud IaaS, with Hyper-V/Azure Stack (38%) and SaaS replacements (34%) also popular components of the mix.

“Enterprises aren’t just asking what they want to do — they’re confronting what they can execute safely,” said Rod Squires, CEO of CloudBolt.

“The panic phase is over. Now it’s execution: reducing dependency, managing dual realities during transition, and building optionality before the next renewal decision tightens the window – and slams the budget.”

A number of big tech vendors have capitalized on the disruption over the last two years by offering VMware alternatives or services aimed at assessing their dependency, such as Pure Storage.

Outright alternatives touted by competitors include Proxmox VE, Microsoft Hyper-V, XCP-ng & Citrix Hypervisor, and Red Hat OpenShift Virtualization.

Earlier this week, Cisco threw its name into the mix with a teaser for NFVIS-for-UC, a hypervisor for running its own applications.

FOLLOW US ON SOCIAL MEDIA

A trade body representing European cloud providers is continuing its fight against Broadcom’s acquisition of VMware.

Cloud Infrastructure Services Providers in Europe (CISPE) has made a formal statement to the General Court of the European Union, outlining its concerns.

The complaint argues that by approving the merger, the European Commission (EC) enabled Broadcom to monetize VMware’s pre-existing dominance in server virtualization software.

Moreover, CISPE argued the EC ignored the known risks presented by the deal, allowing the firm to exploit its dominant position and massively increase pricing.

In a statement, CISPE pointed out that Broadcom’s CEO publicly committed to lifting VMware’s standalone earnings before interest, taxes, depreciation, and amortization (EBITDA) from between $4.7 and $5.0 billion to $8.5 billion within three years of closing.

This increase of 60 to 80% in a market growing at only 5% to 8% annually couldn't realistically come from organic growth or efficiencies, the trade body noted, but only from the aggressive monetization of VMware’s locked-in customer base through steep price rises and forced bundling.

CISPE is also unhappy about the way the deal is being financed, with Broadcom having raised $28.4 billion in new debt and assuming around $8 billion of VMware’s existing debt to fund the acquisition.

This, CISPE added, created a powerful financial incentive to extract cash rapidly from VMware’s installed base, reinforcing the provider’s market power and incentivizing aggressive pricing strategies.

CISPE claims EC ignored warnings

Notably, CISPE claims the EC ignored repeated warnings from customers and industry associations, failing to examine - or even mention - the risk that Broadcom would use VMware’s dominance to drive substantial price increases and tighten contractual lock-in.

Since the acquisition, prices have skyrocketed, in some cases by as much 1,500%.

Meanwhile, the trade body noted that multi-year subscriptions and bundling of VMware products have been forced on users - with significant cost consequences for European cloud providers and their customers.

“The Commission looked at this merger through half-closed eyes and declared it safe. By rubber stamping the deal, Brussels handed Broadcom a blank cheque to raise prices, lock-in and squeeze customers. Broadcom has, predictably cashed this cheque with interest," said Francisco Mingorence, secretary general of CISPE.

"This was a failure of oversight by the regulator with real world costs for Europe’s cloud sector, and every organization that depends upon it.”

The statement comes in response to the European Commission’s defence of its 2023 decision approving the $61 billion deal.

If CISPE succeeds in persuading the court to annul the acquisition, the Commission will be forced to re-examine it - creating significant legal uncertainty for Broadcom’s shareholders, creditors, customers, suppliers and investors, CISPE pointed out.

MORE FROM ITPRO

• Is a VMware exodus looming? Disgruntled customers are actively seeking alternative providers
• CISPE pushes EU Court to reexamine Broadcom's VMware acquisition
• Broadcom EMEA CTO claims the company has been able to solve most of its customer issues following VMware acquisition

VMware, the virtualization and cloud infrastructure solutions vendor founded in 1998 by Berkeley, California's Diane Greene, Mendel Rosenblum, Scott Devine, Ellen Wang, and Edouard Bugnion, was acquired by components company Broadcom in 2023 for $69 billion.

Broadcom divided it across VMware Cloud Foundation (VCF), Tanzu, and Application Networking and Security (ANS) divisions.

Broadcom president and CEO Hock Tan presides over division heads Krish Prasad (VCF), Purnima Padmanabhan (Tanzu), and Umesh Mahajan (ANS). Senior vice president for global commercial sales and partners Brian Moats oversees roughly 17,400 remaining VMware partners since the lower Registered tier was jettisoned.

Pre-acquisition, VMware turned over $13bn. Distribution comprised 48% of Delaware-incorporated, Palo Alto-headquartered Broadcom's overall 2024 net revenue.

With 37,000 employees and $30bn revenues for its fiscal 2024, infrastructure software comprised $21.5bn.

Key offerings

Moats suggests emphasizing VCF solutions and cyber-resilience. "We need partners to help us scale and play a bigger role in selling and deploying VCF-based private clouds."

• VCF 9.0 is key for VMware by Broadcom partners, meant to accelerate self-service out of the box.
• Its vSphere server virtualization platform targets datacenter resource utilization.
• Tools include for streamline ITops, automation, private lateral cloud security with vDefend load balancing with Avi, and intelligence via Tanzu solutions.

Recent news

• In March, three zero-day vulnerability alerts affected VMware ESXi, Workstation, and Fusion products.
• In July as Broadcom rejigged its cloud channel. Reports said invitation-only partnerships might evolve.
• August saw VMware Private AI Services become standard in VCF to assist private cloud developers.

VMware for partners

Moats says the channel is central to "extend reach, amplify innovation, and drive scale". "Our customers need partners who are all-in, from design and implementation to optimization and ongoing support," says Moats.

"Partners bring VCF to life in customer environments, from initial advisory and design through to deployment and ongoing optimization."

It's about prioritizing partners that demonstrate "real commitment and capability," and Broadcom seeks to reward "value delivered, not just volume" for predictable, profitable, and sustainable growth.

And VCF's Prasad has said it is putting more emphasis and focus on the partners adept at modernizing IT, accelerating AI adoption, and strengthening cyber resilience, with VMware-related professional services increasingly partner-led. According to CEO Tan, the company promises not to compete in professional services.

All implementation, migration, and delivery services will be entrusted to partners, especially in VCF.

Partner programs, tiers, and partner types

Broadcom's streamlined Advantage Partner Program (APP) aims to boost standards, with dedicated sales and technical resources, business planning, and services expertise.

• Underneath sits VMware by Broadcom, working with VCF, Tanzu, Avi, vDefend, and the like. Partner types with related designations, benefits and funding are Resell/Solution Provider (transactional, working through distributors), Cloud & Managed Service Provider (MSP), Distributor/Aggregator, Technology & Alliance ecosystem integration partner, Global SI/Strategic Partner, Expert (EAPP) (invitation-only services partners [https://expert.broadcom.com/] covering implementation, technical support, consulting and education activities).
• Tiers are Select (50 points), Premier (500 points), and Pinnacle (2000 points). Remaining Registered partners are phasing out. Broadcom has also said it's increasing requirements for Premier and Pinnacle partners, including mandatory business planning and compliance training.
  • - 70% of points are for bookings.[https://news.broadcom.com/partners/redesigned-broadcom-partner-program-delivers-more-value-to-partners-and-customers]- 30% of points are for technical expertise, services delivery, post-sales, certifications, Knights program involvement and other dedicated resourcing
  • - Badges are available per APP tier, EAPP services, Expert Plus, Sales Certification, and for Knights.
• Certifications and training programs:
  • Role-based sales, pre-sales, architecture, implementation, and support certifications. VMware-specific certifications include VCF (5), legacy VMware (16), VCDX (2), and ANS (1), in addition to VMware security certifications. or broader VMware learning. Download a 2025 pathway guide.
  • Proven Professional foundational knowledge qualification.
  • Certified Expert validation of advanced expertise.- Knight certification.]Invitation-only program recognizing multiple certifications and "consistent excellence", Broadcom says.
  • E-learning and digital training opportunities. An on-demand learning FAQ is here or register for instructor-led sessions.- Online learning management system (LMS) training hub.
  • Ongoing vmLIVE Speedcasts and virtual-event training updates.
  • Support portal with knowledge base.
  • Hands-on virtual labs for Premier and Pinnacle partners.
  • Momentum training and exclusive enablement workshops.
  • Regional solution architects are available to Pinnacle partners.

Further benefits, rewards, and incentives

• Financially focused benefits and offers:
  • Deal registration, managed via dashboard. Protection and preferred pricing on approved deals ≥$10,000, valid 180 days.
  • Incumbency protection for commercial accounts. Minimum 10% price protection on renewals.- Upfront discounts. Tiered discounts via distributors.
  • Achievers’ Program, with incentives tracked and managed via dashboard. Extra rewards, rebates, and activity-based rebate claims for Pinnacle and Premier partners.
• Business tools or benefits:
  • Manufacturer suggested retail price (MSRP) lists with access to VMware SKUs.
  • Partner portal with tools, dashboards, and enablement features.
  • Partner help desk and hotline for dedicated support.
  • Manufacturer’s Authorization Letter proving authorized VMware reseller status.
  • Not for Resale (NFR) offerings, such as software or appliances for training and demos.
  • Assigned partner account support for higher tiers.
  • Partner finder listing.
  • Strategic account teamwork and engagement with Broadcom.
  • Division roadmap reviews and updates for Premier and Pinnacle partners.
  • Partner Advisory Board feedback groups.
  • Exclusive LinkedIn partner groups.
• Additional marketing tools:
  • APP logos, badges, and branding, including Broadcom logo co-branding rights and Authorized Partner badges.
  • Campaign kits and pre-built promotions.
  • Newsletters and program certificates.
  • Go-to-market sales guidance and related assets.
  • Customer and partner event access. Premier and Pinnacle partners can apply for co-presenting opportunities.
  • Partner services delivery toolkits for Premier and Pinnacle partners.
  • Regional marketing manager support for top partners.
  • Sales leads for Premier and Pinnacle partners.
• Other tools:
  • Enablement dashboard to track certifications and training.
  • End customer lookup tool.
  • Guided selling tool.
  • Private cloud modernization tooling (PCMO) for solution design. A VCF maturity model assessment tool is here.
  • 'Program leveling' dashboard tracking progression and tier status.
  • Dashboarding for managing renewals and expiring contracts.
  • Business planner tool for Premier and Pinnacle partners.

Sign up and get on board

Partners are invited to join by Broadcom's Partner Program Office, a Broadcom BU sponsor, or an authorized distributor.

Partner program guides reside on the portal. Questions about eligibility or onboarding? Email partner.helpdesk@broadcom.com. General APP questions can be directed to partnerprogram.office@broadcom.com. Services partners apply separately by speaking to their Premier or Pinnacle partner account directors (PADs) or partner business managers (PBMs).

Register for the partner portal to gain access to all training, certification, dashboards, and benefits. While logged in, live chat support is here, at the same URL as the self-service knowledge base; if not, try this support homepage.

Broadcom is also on X, LinkedIn, and YouTube; specific VMware groups remain live on X, LinkedIn, and YouTube.

Computacenter has filed its own claim against Broadcom and Dell as part of a wider lawsuit brought by Tesco.

Last month, the supermarket giant announced plans to sue Broadcom for £100 million over VMware licensing contracts. Broadcom bought VMware in 2022 for $61 billion, sparking a backlash from its own customers by changing licensing terms in a way that led to price increases for many.

Tesco said via court filings that the licensing changes led to prices it paid for VMware software to jump by 237%, accusing Broadcom of refusing to negotiate and taking advantage of its market dominance to hike up prices.

So what does any of this have to do with Computacenter? The IT reseller was pulled into the lawsuit as a defendant, because Tesco got its licenses for VMware via Computacenter.

As spotted by The Register, Computacenter has filed a legal claim against both Broadcom and Dell. Court filings seen by the publication noted that Computacenter used Dell to distribute VMWare software, and in 2021 quoted Computacenter for subscriptions for Tesco to use VMware's Tanzu Basic and Tanzu Mission Control for five years with an extra four years of support.

Computacenter is suing for damages if Tesco wins because it hasn't supplied those services at the prices quoted, despite the agreement, and Dell for breaching its contract. Dell told the publication that because of "the changes within VMware and actions by Broadcom" it couldn't fulfil the promised renewals at the pricing.

The Register also noted that Broadcom has filed documents in its defense against Tesco's initial suit, saying it can't deliver products it doesn't sell anymore, among other claims.

VMware upheaval

The lawsuit from Tesco is just one complaint of many from VMware customers after Broadcom overhauled the virtualization giant's licensing structure post-acquisition.

Broadcom said the changes were designed to "streamline" its partner program, and led to fewer companies able to resell VMware products. Critics, meanwhile, have said it appears Broadcom is focusing on larger players.

In response, the Cloud Infrastructure Services Providers in Europe (CISPE) has essentially called for the acquisition to be reversed, with its own research showing some prices have gone up by between 800% and 1,500%.

That trade body said new agreements were "often signed under significant pressure", adding: "Consequently, while Broadcom has succeeded in transitioning VMware customers to its new licensing framework, these customers continue to face substantial financial burdens and operational disadvantages due to the imposed terms."

While CISPE warned that some customers remain locked into the VMware ecosystem, rivals have started to launch competing solutions, including Pure Storage, NetApp, and HPE's VM Essentials.

In the meantime, CISPE has called for Broadcom to restore fair licensing by offering advance notice of six months or more to contractual or pricing changes, offer transparent pricing with no penalties for over or under use, and have agreed charges for peak usage.

If that doesn't happen, CISPE called for regulatory action against Broadcom's "harsh, exploitative practices" — if that happens, we could see further trouble for Broadcom beyond the legal cases brought by Tesco and now Computacenter.

ITPro approached Computacenter, Broadcom, and Dell for comment, but had not received a response at the time of publication.

MORE FROM ITPRO

• VMware partners face more disruption with latest Broadcom changes
• Broadcom EMEA CTO claims the company has been able to solve most of its customer issues following VMware acquisition
• VMware license changes could spark a wave of data center 'devirtualization'

British supermarket chain Tesco is suing Broadcom for £100 million over VMware licensing contracts, claiming a failure to maintain support for software could disrupt the supply of groceries in the UK.

The case follows Broadcom's $61 billion acquisition of VMware in 2022 and the subsequent licensing changes which sparked a backlash among customers.

In court filings, Tesco claims that the changes to licenses raised prices by 237%, according to a report on Law360, and accused Broadcom of refusing to negotiate terms or packages on the threat of pulling services that the grocery giant relies upon.

The filing alleges that Broadcom is taking advantage of its market dominance to raise prices.

Neither Tesco nor Broadcom had replied to a request for comment from ITPro at the time of publishing. The case has also pulled in the technology reseller Computacenter.

VMware and Broadcom

When Broadcom bought VMware, the deal faced scrutiny from competition authorities. But after the deal was approved, the concerns didn't fade away.

Broadcom shook up VMware's product lineup and licensing structure, cutting perpetual licenses, products, and introducing changes to its partner program and pricing tiers.

Cloud Infrastructure Services Providers in Europe (CISPE) has called for the acquisition to be annulled, following a report that showed prices were up by 1,500% in some cases.

The changes to VMware in the post-Broadcom world are at the heart of Tesco's lawsuit — and also sparked separate complaints from Samsung and AT&T in the US.

What's behind the Tesco lawsuit?

According to court filings, Tesco had a perpetual license with VMware and in 2021 signed a further subscription-based license with the option to renew via reseller Computacenter, with support until 2030.

After Broadcom cut perpetual licenses and simplified its software packages, Tesco said the firm would not renew its existing subscription and was shutting down products still used by the groceries giant.

Separate reports from The Register noted that Tesco claims Broadcom is refusing to continue supporting the software until the retailer signs on to another deal.

In place of the previous deal, Broadcom offered a package that is £15m more than before — and includes a charge for software that Tesco believes it already has a perpetual license for. Tesco said it was being asked to pay 237% more for "superfluous and duplicative" licenses.

When Tesco disagreed with the new pricing structure, Broadcom responded with a "coercive 'take it or leave it' approach," according to a report in Law360, which Tesco argues is possible because of its market dominance.

"The threatened pricing simply allows Broadcom to realize material financial benefits which it would not be able to achieve under conditions of normal and sufficiently effective competition in the absence of its dominant position," the filing reads.

The software is used by Tesco for tills and logistics, and are "essential for the operations and resilience of Tesco's business and its ability to supply grocers to consumers across the UK and and Republic of Ireland," the retailer said in the filing, as reported by The Register.

"VMware Virtualization Software underpins the servers and data systems that enable Tesco’s stores and operations to function, hosting approximately 40,000 server workloads and connecting to, by way of illustration, tills in Tesco stores," the filing adds.

Tesco called its demand for £100m in compensation conservative and said it could rise significantly, though we'll have to wait until the High Court decides the case before seeing if the court agrees.

MORE FROM ITPRO

• Broadcom EMEA CTO claims the company has been able to solve most of its customer issues following VMware acquisition
• Broadcom records huge growth as CEO Hock Tan hails “successful integration” of VMware
• There’s a ‘cloud reset’ underway, and VMware Cloud Foundation 9.0 is a chance for Broadcom to pounce on it

VMware is rejigging its cloud channel program once again – and as of yet it’s unclear which partners will be invited to join the new version.

First reported by The Register last week, Australian reseller, Interactive, revealed Broadcom has contacted VMware Cloud Service Providers to alert them that a new Cloud Service Provider program will begin in November.

The new framework is invitation only and will slash the number of authorized partners — with suggestions that Broadcom is choosing to focus on bigger players.

Any existing partners who will not be included have already been sent a notice of non-renewal, Interactive said in its post.

This means they will be able to continue offering services until 31 October. However, after that they'll only be able to continue servicing existing contracts until the end of their terms, with no new contracts allowed.

Interactive added that Broadcom is ending its white label program, which was only started last year to help alleviate concerns in the partner community.

The move basically means some partners will lose their VMware business, while their customers will need to find a new supplier ahead of the end of their contract, if affected, and migrate their systems.

Why the change?

According to Interactive, the change is part of Broadcom’s continued efforts to “align the VMware partner ecosystem with its strategic efforts and the needs of customers”.

In a statement given to ITPro, a spokesperson confirmed the move, noting that the new strategy forms part of its goal to drive simplification, consistency, and innovation across the VMware Go To Market ecosystem”.

“Recent changes to this ecosystem are consistent with this strategy. Broadcom is focusing more and going deeper with the VCSPs who have demonstrated commitment to their cloud services built on VMware,” the spokesperson added.

“This will enable us to deliver greater value, stronger execution, and a more streamlined experience for Broadcom's VMware customers of all sizes and enable a truly competitive offering to the hyperscalers through our CSPs."

Broadcom changes have spooked VMware customers

The change to the VMware Cloud Service Providers system is the latest disruption in the wake of Broadcom's $61 billion acquisition of the virtualization giant.

Since the acquisition, Broadcom has introduced a series of licensing tweaks that have frustrated customers and partners.

A report by the European Cloud Competition Organisation — set up to monitor Microsoft's compliance with a licensing complaint settlement — said in May that some VMware licensing costs had climbed by as much as 1,500% since the acquisition.

Most recently, in June Broadcom said it would "streamline" its partner program for VMware resellers to help improve support — and that meant reducing the number of approved partners and removing an entire tier of resellers.

That meant some customers would have to find new resellers.

One survey last year found more than half of VMware customers were considering ditching the company after Broadcom's acquisition. As a result, a host of major industry players have stepped in with rival options, HPE, Pure Storage and NetApp.

MORE FROM ITPRO

• Broadcom EMEA CTO claims the company has been able to solve most of its customer issues following VMware acquisition
• There’s a ‘cloud reset’ underway, and VMware Cloud Foundation 9.0 is a chance for Broadcom to pounce on it
• Broadcom slammed by cloud trade group amid claims it's "holding the sector to ransom" with VMware license changes

VMware Cloud Foundation 9.0 has officially dropped, with Broadcom touting a host of new capabilities for customers to “accelerate innovation, control cloud costs, and enable sovereignty and security”.

According to Broadcom, CVF 9.0 boasts a “completely new architecture” aimed at streamlining private cloud deployments and removing friction between infrastructure and application teams.

This includes the launch of a new unified interface for cloud admins, which Broadcom said will provide a "holistic view” of private cloud operations.

The new Quick Start App, for example, aims to reduce setup time and complexity for cloud administrators while fleet management tools allow users to plan and execute upgrades across an array of clusters more efficiently.

With the launch of VCF 9.0, Broadcom looks to target growing interest in private cloud amidst surging AI adoption and lingering security concerns.

Recent research from GTT Communications, for example, found growth rates for private cloud are now outpacing that for public cloud options. Similar research from Node4 showed 97% of respondents are planning to move some workloads back to on-prem infrastructure.

In a virtual press briefing ahead of the VCF 9.0 launch, Prashanth Shenoy, VP of product marketing, VCF division at Broadcom, said research by the tech giant shows a “cloud reset” is underway - and the firm’s new capabilities address this shift directly.

“We are seeing a cloud reset happening in the market,” he said. “Private cloud is now viewed by organisations as a strategic equivalent to public cloud. So it’s not a ‘public cloud plus one’ strategy anymore, it’s more of a ‘cloud smart strategy’ with private cloud taking a predominant role in our customers’ cloud transformation.”

Shenoy said there are a number of contributing factors to this shift, with AI adoption rates a leading consideration for enterprises exploring the prospect of shifting to private cloud. Security and cost-related concerns are also driving private cloud interest, he added.

Research from the firm found 69% of customers had repatriated workloads from public cloud to private cloud environments, for example, or were at least planning to do so in the year ahead.

“The reason behind these tailwinds for private cloud really lies on three big areas. It's around the trust and security that the private cloud provides, it's around the access, the performance, the predictability needed for generative AI workloads, and number three, it's the cost transparency, the cost control, and the cost predictability that our customers are looking towards,” he explained.

So how does VCF 9.0 address these considerations for enterprises? Here’s what customers can expect.

Under the hood of VMware Cloud Foundation 9.0

Among the biggest updates for VCF 9.0 include new identity and access management capabilities. This new approach will centralize single sign-on, password policies, and certificates, which Broadcom said aims to “enable consistency across environments”.

By consolidating log management practices and integrating new analytics features, the company hopes to improve rapid response for security incidents and help admins better understand workload behaviors, and facilitate “targeted responses” for security operators.

Broadcom is also keen to highlight a more “frictionless” cloud consumption process for platform and development teams aimed at simplifying infrastructure consumption insights.

“Platform teams can effectively organize, provision, and manage tenant resources with granular control,” the company said in a statement.

“More secure, role-based access is enabled through streamlined administration of both admin and tenant identities. Compliance across all deployments is maintained by built-in governance policies, while pre-configured blueprints simplify provisioning, lessen manual tasks, and guarantee repeatable, compliant infrastructure.”

As part of the VCF 9.0 launch, the firm also revealed developers will be given access to automated IaaS services in a bid to create a more “genuine cloud-like experience”.

Developers gain access to automated and elastic self-service IaaS services, creating a genuine cloud-like experience.

VCF 9.0 targets cloud cost transparency

With cloud costs remaining a pervasive challenge for enterprises, Broadcom is framing VCF 9.0 as a more cost-efficient option compared to public cloud.

Enterprises will now be able to access built-in analytics tools to create predictive cost modeling for infrastructure planning and forecasting, for example. This, Broadcom said, will help avoid “unforeseen financial challenges”.

Similarly, automated resource optimization tools will also reclaim underutilized capacity to bolster workload efficiency and cut down on infrastructure sprawl.

“Detailed showback and chargeback data, grounded in resource allocation, provide a clear return on infrastructure investment,” the firm added.

Sovereignty and security

Focusing specifically on security capabilities, the new SecOps dashboard for VCF users offers a “quick view” of platform security and data controls, according to Broadcom.

The new feature also comes with integrated compliance policies which enables users to accommodate differing regulatory frameworks on both sides of the Atlantic and globally.

Broadcom noted that through its collaboration with AMD and Intel, this will also allow enterprises access to “secure enclaves” and encrypted memory to allow IT teams to deploy workloads across single infrastructure planes while taking into account varied security policies.

MORE FROM ITPRO

• Broadcom just announced huge changes to its VMware partner program
• Broadcom EMEA CTO claims the company has been able to solve most of its customer issues following VMware acquisition
• Broadcom's 'harsh' VMware contracts are costing customers up to 1,500% more

Broadcom is accused of increasing VMware licensing costs by up to 15 times and trapping customers in unnecessarily long contracts.

That's according to a report by the European Cloud Competition Organisation (ECCO), set up by Cloud Infrastructure Services Providers in Europe (CISPE) to monitor Microsoft's compliance with last year's settlement to avoid an antitrust complaint.

Beyond Microsoft, ECCO has also reported on Broadcom following its 2023 acquisition of VMware, detailing a range of complaints about licensing changes that have sparked a pushback from customers.

ECCO released a report in February summing up the issues, and said Broadcom's behavior had actually worsened in the ensuing months. In ECCO's second report on Broadcom, it acknowledges that most CISPE members have signed new licensing agreements with VMware's owner.

The organization suggested that many of these agreements were “often signed under significant pressure” due to a lack of alternatives. This, the report noted, has posed serious problems for customers and ramped up costs.

"Consequently, while Broadcom has succeeded in transitioning VMware customers to its new licensing framework, these customers continue to face substantial financial burdens and operational disadvantages due to the imposed terms."

Broadcom customers report steep price increases

One of the main complaints is Broadcom changing licensing terms for VMware software, ending specific products in favor of bundled offers as well as canceling perpetual licenses and pay-as-you-go pricing in favor of three-year-long contracts.

That has led to an "exponential increase in prices" for some users, an annex to the report said, with CISPE members reporting price hikes between 800% and 1,500%.

Only one CISPE member was able to ditch VMware, though that came with significant internal costs and several months of work. Others have been unable to due to the lack of real alternatives to VMware software and the short timelines involved.

CISPE said it was likely that an alternative to VMware would arrive within years. Indeed, industry stakeholders have been rolling out a range of competing products for customers in this regard.

HPE recently unveiled plans to launch its own competitor solution, dubbed VM Essentials. Meanwhile, Pure Storage and NetApp have also been active in this domain.

In the meantime, CISPE warned many customers will remain locked in and will continue to face increased costs.

"However, at the moment where the decision was made to terminate all contracts and impose new onerous terms, Broadcom was fully aware that such alternatives did not exist and would take years to develop and be certified by major vendors, as it was already the case for VMware," the annex report added.

Urgent measures

CISPE called for Broadcom to accept a series of "minimum urgent measures" to restore fair licensing.

That includes advance notice of at least six months to any contractual terms and pricing changes, as well as transparent pricing including no penalties for over or under use, agreed charges for peak usage, and more flexible licensing.

The industry trade group also called for better access for smaller companies to higher-tier partner status, the ability to be both a reseller and a service provider, and safeguarding around user data with regards to usage reporting.

In the absence of such changes, it called for regulatory action against Broadcom's "harsh, exploitative practices."

Worse than Microsoft?

CISPE said that Broadcom wasn't interested in working to address the licensing complaints. This comes in stark contrast to Microsoft, which has worked proactively with the industry trade group to alleviate customer concerns.

“Unlike Microsoft, Broadcom shows no interest in finding solutions, or even in working with European cloud infrastructure providers," said Francisco Mingorance, secretary general of CISPE, in a statement.

"Broadcom can report that most have signed new contracts, but we know that these are punitive and threaten the viability of service providers locked-in to the VMware ecosystem. Urgent action is needed."

ITPro approached Broadcom for comment on the CISPE claims, but had not received a response at time of publication.

MORE FROM ITPRO

• CISPE governance pivot is ‘deeply rooted in European interests,’ board member claims
• Navigating devirtualization as businesses move away from the cloud
• Microsoft says it’ll protect EU cloud customers from shutdown demands

Broadcom has published a critical security advisory disclosing three zero-day vulnerabilities affecting its VMware ESXi, Workstation, and Fusion products.

The three flaws range in severity, with the most serious being CVE-2025-22224, a critical time-of-check time-of-use (TOCTOU) vulnerability in VMware ESXi and Workstation rated 9.3 on the CVSS.

A blog from Rapid7 stated that the TOCTOU flaw could lead to an out-of-bounds write condition, meaning an attacker with local administrative privileges on a virtual machine (VM) could exploit the weakness to execute code as the VM’s VMX process running on the host.

Meanwhile, CVE-2025-22225, is a high severity arbitrary write vulnerability that affects ESXi too.

Given a CVSS base score of 8.2, the flaw could allow an attacker with privileges to trigger an arbitrary kernel write leading to an escape of the sandbox.

Broadcom also disclosed an information disclosure vulnerability, CVE-2025-22226, which affects VMware ESXi, Workstation, and Fusion, caused by an out-of-bounds read in host guest file system (HGFS).

Broadcom warned that a malicious actor with admin privileges to a VM may be able to exploit the flaw to leak memory from the VMX process.

All three of these flaws were first spotted by researchers at Microsoft’s Threat Intelligence Center, who reported the issue to Broadcom.

Broadcom’s advisory indicates that all three CVEs are already being targeted by attackers, noting that it “has information to suggest that exploitation has occurred in the wild”.

This looks to have been confirmed by CISA adding all three to its Known Exploited Vulnerabilities (KEV) list shortly after Broadcom published its advisory.

It added that based on the information included in the advisory, all three of these CVEs could be chained together in an attack.

“This is a situation where an attacker who has already compromised a virtual machine’s guest OS and gained privileged access (administrator or root) could move into the hypervisor itself.”

Rapid7 noted that these are not remotely exploitable vulnerabilities, however, and would require the attacker having existing privileged access on a VM that is running on a vulnerable VMware hypervisor.

At the time of writing there is no known public exploit code for any of the CVEs, but Rapid7 warned that due to ESXi hypervisors being popular targets among both financially motivated and state-sponsored adversaries, it recommends applying the fixes pushed out by Broadcom “on an expedited basis”.

VMware ESXi 7.0 and 8.0; Cloud Foundation 4.5.x and 5.x; Telco Cloud Platform 5.x, 4.x, and 2.x; and Telco Cloud Infrastructure 3.x and 2.x are vulnerable to all three flaws.

Broadcom VMware Workstation 17.x is vulnerable to CVE-2025-22224 and CVE-2025-22226, whereas VMware Fusion 13.x is only vulnerable to the latter.

MORE FROM ITPRO

• A batch of €5 hard drives found at a flea market held 15GB of Dutch medical records
• Malware-free attacks surged in 2024 as attackers drop malicious software for legitimate tools
• Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claim

Chip giant Broadcom has posted impressive Q4 and fiscal year results, citing strong VMware growth following an acquisition posed significant early challenges.

Earnings for Broadcom’s full fiscal year saw revenue increase by 44% year-over-year to a record $51 billion. Infrastructure software revenue also grew to $21.5 billion, according to CEO Hock Tan.

The firm has seen a positive reaction to this earnings call, with a surge in share price skyrocketing Broadcom to a $1 trillion market cap alongside firms such as Apple and Microsoft.

While not all of this growth is attributable to its acquisition of VMware, Tan cited the “successful integration” of the virtualization software provider during the company’s earnings call last week.

“The integration of VMware is largely complete, revenue is on a growth trajectory, and operating margin reached 70% exiting 2024,” Tan said.

“Since closing the acquisition just over a year ago, we’ve signed up over 4,500 of our largest 10,000 customers for VCF (VMware Cloud foundation),” he added.

The push to VCF has been a big part of Broadcom’s messaging post-acquisition. As Broadcom EMEA CTO Joe Baguley told ITPro in November, the firm has been focused on putting the subscription price changes in a positive light.

That’s because, under the new pricing model, customers gain access to the entire suite of VMware products in VCF under a single licensing fee.

The integration of VMware within the Broadcom domain hasn’t been without its challenges, however. Customers expressed serious concerns in the wake of the acquisition. Concerns voiced by customers centered around the firm’s shift away from a perpetual license setup, which critics claimed could increase prices.

Research from UK cloud firm CIVO found that more than half (51.9%) of VMware customers were considering ditching services.

Gartner found a similar trend among customers, predicting an increased level of ‘devirtualization’ in the industry, defined by moving workloads away from virtualized platforms such as VMware.

Broadcom’s VMware success in context

Broadcom’s push to VCF is a strong move, according to CCS analyst Bola Rotibi, though the numbers Tan presented suggest there is still work to be done - less than 50% of the biggest customers have moved onto the platform.

“That's the biggest customers. So whilst it's a great number, it's still not a brilliant number, not the best number,” Rotibi told ITPro.

Overall though, Broadcom's strategy is a smart move, Rotibi added. Customers ultimately want simplicity, she said, and that’s what Broadcom is offering in its reshaping of VMware.

“If Broadcom has simplified the offering, and what they're saying is that ‘here's the payment’, the question then is on the user to say, ‘Well, okay, are we utilizing it effectively,?’” Rotibi said.

Broadcom’s gameplan

Broadcom has been able to cut costs to create margin improvements according to Tony Harvey, Senior Director at Gartner. Whether this will have a long-term improvement on product development is yet to be seen though, he told ITPro.

“They have also been successful in moving customers onto the VCF platform generating more revenue,” Harvey said.

Customers who have been able to ditch VMware are often the smallest and least profitable customers, Harvey said. Large enterprises moving away from the platform would be faced with much larger projects and there may be little revenue benefit in doing so.

“As such those organizations who are planning to migrate will renew with VMware – most likely for 3 years - and any revenue impacts will not be seen until the next renewal cycle,” Harvey said.

“Note that there is also a strong tie with Hardware refresh cycles as well as in many cases new hardware may be required to be the migration target,” he added.

“Broadcom is very much focused on its largest and most profitable customers and while smaller customers may move to other vendors, this will simply be regarded as cost of doing business by Broadcom.”

Customers shouldn’t believe the negative reports about VMware following its acquisition by Broadcom, the latter's EMEA CTO Joe Baguley told ITPro.

While there’s been a lot of noise in the press around the results of the acquisition, Baguley said his response has been to ask customers whether they’ve spoken to the firm directly.

“Then you have that conversation, and it all works out fine. You know, 99.9% of the time, it works out fine,” Baguley said.

This comes after a year in which Broadcom has changed its licensing structure, created fears around higher prices, and slashed numerous products within the VMware environment.

Baguley said that explaining the licensing change to customers has been a keen focus for the firm, as customers have often been viewing updated prices without considering the entire context of the change.

“The numbers people were looking at looked wrong because they were in different contexts,” Baguley said.

He said that rather than customers just buying cores and then paying for support, the new subscription-based pricing model means people are being charged annually rather than paying an upfront cost.

This means the annual subscription cost could appear higher compared with annual support costs, he said, but that doesn’t necessarily account for the dropped upfront cost.

“That's the conversation you go through with customers, and they're like, ‘oh no, so you’re not doubling my prices.’ Well no, though, on the face value, it looks like that,” Baguley said.

“Obviously it's more complicated than that, I’m really simplifying the example here, but in essence, that's what we're talking about, is how people sort of get through that,” he added.

Key to Broadcom’s strategy with customers has been reminding them of the value VMware offers, Baguley said, as under the new subscription pricing model customers gain access to the entirety of VMware Cloud Foundation (VCF).

“It's talking about the value of what they're now eligible for in the new product offering,” Baguley said.

A tumultuous year

Despite Baguley’s positive outlook, the past year under Broadcom has been a trying time for VMware. The EMEA CTO said the firm has had positive interactions with customers, but at least some have raised concerns.

Research from UK cloud firm Civo claimed that over half (51.5%) of VMware customers were considering ditching VMware services. 48.7% said they were actively exploring alternative cloud providers.

Analyst firm Gartner made a similar assessment, predicting an increased level of ‘devirtualization’ - moving workloads off virtualized platforms - related to increased costs at VMware after the acquisition.

Cloud storage firm Pure Storage even rolled out a new virtual machine (VM) assessment tool specifically designed to assist customers in navigating changing costs at VMware.

Cloud repatriation presents an opportunity for VMware, according to company executives, amid reports that hyperscalers are feeling the heat from enterprises moving workloads back to private setups.

VMware is actively targeting repatriated workloads to shift them onto the VMware Cloud Foundation (VCF) platform, Broadcom’s UK&I managing director Tamar Brooks told press at VMware Explore 2024.

“We would definitely be trying to make sure we capture those and put them on the VCF private cloud, definitely,” Brooks said.

Broadcom’s EMEA CTO Joe Baguley echoed a similar sentiment, telling ITPro it’s the firm’s job to remind users of private cloud’s necessity and its continued role as a critical aspect of enterprise IT infrastructure.

“You're going to be running stuff that's your infrastructure, your platform. You're going to be doing that. So you might as well do it properly,” Baguley told ITPro.

“We've not got to go after a market - the market’s ours already, we're just making sure that people recognize that it's there,” he added.

This comes after AWS claimed it was facing competition from cloud repatriation to on-prem environments. The firm argued this point as part of a Competition and Markets Authority (CMA) investigation into UK cloud competition.

AWS disagreed with the idea that cloud customers never return on-prem, saying that it now competes with on-prem IT infrastructure.

Recent research from IDC aligns with this claim, revealing that rising costs have contributed to a sense of missed expectations for customers in the cloud.

This puts VMware in a strong position, as customers can run workloads repatriated from the cloud in private environments. If the trend continues, it represents a huge opportunity for VMware.

As to why, Brooks puts it down to cost - cloud costs have spiraled, she said, with the emergence of unforeseen costs and issues surrounding egress fees creating a lack of control over spending. Recent research documenting a struggle in cloud spending predictions backs this up.

“Cost has been the biggest driver that I've seen to repatriate,” Brooks said.

Tech firm 37 signals reportedly saved $2 million a year, according to comments from the firm’s CTO recently, with predictions that it will ultimately save $10 million over five years.

Cloud repatriation is rising, but there’s a catch 

While IDC’s research put cloud repatriation efforts on the up, it also noted that only between 8% and 9% of firms are considering full workload repatriations. Most are only moving specific workloads off the cloud.

Similarly, when AWS claimed it was facing competition from on-prem repatriation, Civo CEO Mark Boost told ITPro it was overstating the extent of this trend.

VMware isn’t putting all its eggs in the cloud repatriation basket, though. Luigi Freguia, president of EMEA sales at Broadcom, told the press it’s important for VMware to cater to both public and private cloud environments.

“We are extending the opportunity for clients to still run workloads where they want,” Freguia said.

Reports of cloud repatriation don’t mean customers are going to do everything outside of the public cloud, Freguia said, but it is a growing area. In his view, VMware must support both options.

It’s been a year since VMware was last in Barcelona for its annual VMware Explore conference, and quite the year it’s been. At last year's conference, Broadcom was just around the corner from finalizing its $61 billion acquisition of the firm, leaving it in a tumultuous position.

While the firm announced some data management and private AI offerings, there was a sidelining of the acquisition last year. While Broadcom CEO Hock Tan appeared onstage during the event’s opening keynote to reassure attendees that Broadcom would maintain VMware R&D and streamline its products, this didn’t entirely cut through the sense of anticipation that ran through the event.

Unfortunately for VMware, this anticipation has given way to genuine concern over the last 12 months as Broadcom has weathered criticism for VMware licensing changes.

VMware Explore Barcelona 2024 needs to change the conversation. If the firm wants to retain its long-standing command of the server virtualization market then its leadership needs to allay fears surrounding services and memberships.

As the first such event held under the Broadcom banner, it’s a defining moment for the firm – with a slight make-or-break atmosphere. Already, customers are seeking alternatives to VMware, with research from UK cloud firm Civo finding that over half (51.9%) are considering abandoning services following the acquisition.

VMware’s future as a company depends on its ability to turn the tide on these sentiments and convince the industry that it can still be relied on under Broadcom’s ownership.

The need for better messaging

It’s no secret that VMware is suffering in the wake of its acquisition, with some firms even looking to capitalize on VMware’s flailing customer base. Take Pure Storage, for example, which released a virtual machine (VM) assessment tool specifically targeting VMware licensing spend.

Gartner predicted that businesses may start undergoing ‘devirtualization’ processes, moving workloads back onto physical systems in the face of spiraling costs triggered by the Broadcom turmoil.

VMware Explore Barcelona is a prime stage from which VMware can broadcast welcome news on its licenses and help quash customer concerns. It’s by no means last chance saloon – but any step in the wrong direction risks ceding ground to other firms offering virtualization or on prem solutions.

The firm also needs to get its messaging right – or rather, the leadership at Broadcom needs to get its messaging right. Following its slashing of perpetual licenses and backlash against the cutting of other products, Tan did little to ease fears or console users.

Tan described the changes as part of a simplification of VMware’s structure and said he thought the firm was off to a good start under this new ownership, largely sidelining concern.

With Tan’s comments doing little to reduce the fallout, Cloud Infrastructure Providers in Europe (CISPE) quickly hit out at the licensing changes, calling Broadcom’s practices “anti-cloud” in nature.

Regardless of the stance you take on the changes at VMware, it’s clear that Broadcom needs to take this year’s event as a chance to realignits messaging on the subject.

As such, VMware Explore 2024 is just as much a PR event as it is a tech event.VMware will need to underscore any announcements with clear messaging that keeps users in the loop about how their experience of VMware services might change.

Taking back cloud leadership

Every cloud has silver linings and it’s important to note that VMware has not had a year bereft of positive announcements. The firm has released products even as it has cut others, and VMware Explore 2024 will no doubt offer up headline announcements to interest partners and customers alike.

In June, VMware announced an expansion to its private cloud platform, VMware Cloud Foundation (VCF), aimed at reducing complexity and responding to customer needs around deployment and resiliency.

Later in the summer, the firm rolled out another update to VCF, this time with a focus on improving speed, ease, and cost for the deployment of private cloud systems for businesses.

On the back of these announcements, we can expect private cloud to be a big topic at VMware Explore 2024. The firm will likely leverage its virtualization credentials to position itself as a leader in this area.

Whatever the focus, VMware will be laser-focused on delivering value for its customers in next week’s offerings. Attractive products and platforms will inevitably play a vital role in securing VMware’s ongoing customer base.

Though Broadcom posted healthy revenue growth in its most recent earnings call, trust in the firm’s leadership of VMware is showing signs of weakness. The good news is VMware has every chance to shore up support at this pivotal event.

ITPro’s George Fitzmaurice will be covering VMware Explore Barcelona live from 4 - 6 November. To stay up-to-date with the latest news and announcements from the conference, follow our live blog and subscribe to our newsletter above.

Pure Storage has unveiled a new virtual machine (VM) assessment tool aimed at easing cost management for enterprise users in the wake of Broadcom’s VMware acquisition.

The offering – generally available in FY2025 Q4 – will help IT decision makers (ITDMs) monitor performance, plan scenarios, and rightsize recommendations through the Pure1 platform.

Optimizing VMs will be simplified with the tool, Pure Storage revealed, proving an especially attractive concept in a world where many VMware VMs have become difficult to manage under the firm’s new ownership.

Speaking during a press conference at Pure//Accelerate London 2024, Prakash Darji, GM of Pure’s Digital Experience Business Unit, said the announcement was focused on helping customers optimize their VMware license spend in the wake of the Broadcom acquisition.

“With Broadcom VMware licensing, they did what Oracle did many years ago, where they changed their metric to not what cores you are using, [but] what cores you could be using,” Darji said.

Darji’s thinking is that customers “were not prepared” for this change, thus providing the impetus for Pure Storage’s development of the new tool.

With the platform, the storage provider aims to give users “recommendations on how to optimize the core licenses within VMware,” and help them “decide what to consolidate to save on core density on the VMs.”

"We could even allow them to model how much it's costing them on their VMware licensing for putting their vCenters on a disk system versus a flash system,” Darji added, vCenter being the server management software delivered by VMware.

A turbulent time for VMware customers 

Following Broadcom’s mammoth $69 billion acquisition of VMware in 2023, customers have been left in a state of disarray over how the VMware business model is changing.

Research from Civo earlier this month revealed that over half (51.9%) of VMware customers are considering abandoning the firm’s services after Broadcom’s leadership dropped numerous licenses and products.

The Cloud Infrastructure Service Providers in Europe (CISPE) trade group has hit out at Broadcom for the changes, accusing the firm of “holding the sector to ransom” by abusing its market share to charge higher prices.

Broadcom’s CEO Hock Tan has largely shrugged off the backlash, however, describing the changes as part of a simplification process focused on driving innovation and meeting customer needs more effectively.

In June, VMware unveiled its first Cloud Foundation overhaul since the acquisition with the aim of complexity reduction, improved deployment, and improved cyber resilience.

VMware customers are becoming increasingly frustrated with uncertainty and spiraling licensing costs, new research suggests, after its acquisition by IT giant Broadcom.

Research from Civo found more than half (51.9%) of VMware customers were considering ditching services after Broadcom finalized its acquisition of the cloud computing and virtualization firm.

After a series of drastic changes to its operating model including the removal of a series of popular licenses and products, 48.7% of VMware customers told Civo they were actively exploring alternative cloud providers.

Two of the top three priorities respondents said they were looking for in a new provider were flexibility and fair and open pricing, as mounting costs and vendor lock-in concerns make VMware an increasingly unappealing value proposition for businesses.

Open source was cited as a popular potential alternative, with 44.8% of current VMware customers stating they were considering migrating to open source solutions.

But businesses do have some concerns around making the switch to open source, Civo found, with 28.6% of respondents noting they were worried about the state of open source security.

A further 23.2% stated the lack of support and service level agreements (SLAs) in the open source ecosystem was another factor preventing them from making the switch.

Hock Tan, CEO at Broadcom, struck on this point speaking on stage at VMware Explore earlier this month in Las Vegas, declaring “the future is private” and insisting that the changes made at VMware have centered around this mantra.

VMware has had a rocky start to life under Broadcom

Broadcom’s overhaul of VMware’s operating model has caused widespread consternation among customers.

Tan claimed these changes were centered around removing unnecessary complexity, driving down costs, and improving security, positioning VMware’s flagship Cloud Foundation product as the single private cloud platform that businesses need.

But stakeholders have not been so receptive to the changes Broadcom has implemented since taking the reins at VMware.

The Cloud Infrastructure Service Providers in Europe (CISPE) consortium slammed Broadcom, accusing it of “holding the sector to ransom” with its licensing changes.

In March, it called on EU regulators to investigate the changes it had implemented, namely unilaterally canceling license terms for virtualization software many firms rely on, claiming they could “decimate” the region’s cloud infrastructure.

Commenting on the results of its recent study, Henry Godwin, VP of global sales at Civo, said he’s heard widespread complaints among VMware customers, labeling the current situation with ballooning prices untenable.

“We’ve heard from a lot of concerned VMware customers over the previous nine months. Ultimately, businesses want certainty. They cannot continue in a situation where prices are skyrocketing, without any parallel improvement in service,” he reported.

“What we’re beginning to see now is these dissatisfied customers look elsewhere. While open-source solutions have a significant allure due to the predictability in pricing, users also want to receive support, both on-prem and with their migration., Providers must respond to these evolving customer needs by ensuring that they deliver not just on cost, but on security, support, and service reliability.”

ITPro approached Broadcom for comment on Civo’s findings, but did not receive a response.

Broadcom has unveiled VMware Cloud Foundation (VFC) 9, the latest iteration of VMware’s private cloud platform intended to dramatically improve the speed, ease, and cost of deploying private cloud for businesses.

In its latest major overhaul of VCF, Broadcom has lifted the curtain on a raft of private cloud improvements across its cloud deployment, management, and operational layers.

VCF 9 enables native multi-tenancy for customers, allowing different enterprise teams or departments to share infrastructure while maintaining control of their respective privacy controls and access rights.

Customers can also make use of more centralized cybersecurity controls in VCF 9. Through a new centralized information hub, security teams can assess threats across their private cloud and raise insights on misconfigurations.

Broadcom emphasized its intention to help customers future-proof their private cloud via VCF as much as possible, and to this end, customers can also use VCF 9 to deploy generative AI models more easily via VMware Private AI Foundation with Nvidia, with new options such as GPU reservations and a dedicated service for building AI agents.

With its focus on helping businesses to automate their infrastructure and modernize it as much as possible, VCF 9 will combine existing cloud management consoles into just a single point of control for operations and automation, simplifying manual tasks for IT teams and providing them with better control observability.

This focus on automation is mirrored with new native support for VMware vSAN remote snapshots, intended to automatically preserve customer data to be recovered in the event of a ransomware attack, alongside a generative AI security assistant dubbed Project Cypress which can help teams investigate security threats and provide recommendations on remedies.

AI advancements and readiness run throughout the announcements. The new Advanced Memory Tiering with NVMe function will also provide a performance boost to AI workloads within a customer’s environment, alongside data analytics applications and databases.

“Memory is one of the highest growth costs inside a customer’s infrastructure environment,” said Paul Turner, VP of products, VCF Division at Broadcom.

“Up to 50% of the cost of servers today is often in the memory cost, so bringing down that cost is key for us.”

The firm reports up to 40% improvement in memory efficiency among customers using NVMe Tiering, citing the reduced cost of memory and licensing achievable through proper optimization.

Broadcom said that enterprises can use VCF to improve the time to deploy virtual machines (VMs) by as much as 61% and reduce infrastructure costs by 34%, per a whitepaper it produced alongside IDC.

Easing the weight of legacy infrastructure

In a briefing with assembled media, Turner emphasized the major problem that VCF 9 aims to solve:  

“We have a mixed set of environments where customers are running a storage silo, a compute silo, they've probably virtualized the compute silo but haven't done so on the storage, the networking is very much a physically-oriented setup, and security is in there afterward trying to figure out how to govern and control the entire environment.

“So, our traditional legacy architecture is really not working in terms of being able to bring governance, control, and agility to a cloud because you've got different teams managing different environments.”

The announcement was made at VMware Explore 2024 Las Vegas, the company’s annual conference and the first such event since Broadcom closed its acquisition of the firm in November 2023.

Broadcom announced improvements to VCF in June, dropping new features such as VCF Import which lets customers move siloed environments into their private cloud without re-architecting and streamlines patching and identity and access management (IAM).

VCF Import is being expanded in VCF 9, with the intention of making it easier than ever for customers to embrace the platform. With this in mind, businesses will now be able to transfer a business’s existing VMware NSX, vDefend, or Avi Load Balancer environments into VCF. This allows for better-centralized fleet management and automation across their VMware environment, moving closer to achieving what Turner dubbed “a true cloud experience”.

With VCF 9, Broadcom also aims to further meet customer needs while reducing the overall complexity of the platform by bringing services like VMware Cloud Director under the VCF banner and enabling a single point of observability for admins.

This focus on ease of deployment is also reflected in the newly announced VCF Advanced Services, off-the-shelf services across common enterprise tasks like edge orchestration, data management, containers, or disaster recovery.

“To break the infrastructure silos, reclaim control of public cloud sprawl, and capture the opportunity for AI in the enterprise, our customers are shifting from best-of-breed siloed architectures to a modern private cloud platform,” said Krish Prasad, senior vice president and general manager, VCF Division at Broadcom.

“VMware Cloud Foundation 9 will redefine the landscape for private cloud by delivering a modern, integrated platform that will unify operations and automation to deliver a cloud experience that enables businesses to be more innovative, efficient, resilient, and secure.”

A critical flaw in the VMware ESXi hypervisor is being exploited in the wild by ransomware groups, according to research from Microsoft, less than a week after VMWare issued a patch to address the issue.

The vulnerability, discovered by researchers at Microsoft, was introduced with the release of a new patch ESXi 8.0 U3. After being notified, VMware’s parent company Broadcom issued an advisory acknowledging the bug.

CVE-2024-37085, designated as a 6.8 on the CVSS, is an authentication bypass vulnerability which if successfully exploited would allow an attacker to obtain full administrative permissions on domain-joined ESXi hypervisors, Microsoft warned.

“A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESX Admins' by default) after it was deleted from AD,” Broadcom’s advisory outlined.

With full administrative access to the ESXi hypervisors, the hacker could then encrypt the file system of the hypervisor, inhibiting the functionality of any hosted servers. 

Microsoft researchers added that the threat actor would also be able to access any hosted virtual machines (VM) and potentially exfiltrate data or move laterally within the network.

Scott Caveza, staff research engineer at Tenable, cautioned that although its CVSS rating was moderate, successful exploitation of the flaw could be “catastrophic” for businesses.

"While the security advisory for CVE-2024-37085 provided a moderate severity rating, a CVSSv3 score of 6.8 and Tenable Vulnerability Prioritization rating of medium, successful exploitation can be catastrophic for impacted organizations.”

Microsoft outlines a variety of methods attackers can use to compromise VMware ESXI hosts

Microsoft detailed three possible methods to exploit CVE-2024-37085, the first of which involves adding the ‘ESX Admins’ group to the domain and adding a user to it.

“In this method, if the ‘ESX Admins’ group doesn’t exist, any domain user with the ability to create a group can escalate privileges to full administrative access to domain-joined ESXi hypervisors by creating such a group, and then adding themselves, or other users in their control, to the group.”

The second method builds on the first, but requires access to a user with the ability to rename one of the groups to ‘ESX Admins’, allowing them to add a pre-existing user to the group, which immediately escalates their privileges to full access.

Finally, Microsoft added that even if the network administrator assigns a different group to manage the ESXi hypervisor, the full administrative privileges to members of the ‘ESXi Admins’ are not removed, but this approach was not observed in the wild during its research.

Caveza noted that the analysis from Microsoft indicates once the initial exploit is completed, the variety of attack paths available to the attacker are all relatively easy to take advantage of. 

Thankfully, however, he said successful exploitation is dependent on the host having been configured to use an active directory for user management, which poses something of a barrier to entry for the attacker.

“While the complexity is low, an attacker first needs elevated privileges in order to modify the active directory (AD) configuration on the affected host… Despite this significant barrier to entry, we cannot underestimate ransomware groups' abilities and determination to escalate privileges and advance their attack path once they obtain initial access,” he explained

“While a medium severity vulnerability may be a lower priority for patching, this is another example of how attackers will seek out and exploit any unpatched vulnerability they can, often chaining together multiple vulnerabilities in their quest for complete takeover of a breached network."

ESXi hypervisors a “favored target for threat actors”

Microsoft’s report highlighted previous evidence of ransomware operators targeting ESXi hypervisors, noting the popularity of the product in corporate networks has made it a “favored target for threat actors’.

Hypervisors like these are convenient targets for attackers who want to evade detection by security operations centers (SOCs), Microsoft stated, as many security products have limited visibility and protection for an ESXi hypervisor.

Moreover, an EXSi hypervisor allows for the mass encryption of the entire file system with one click, leaving them with more time to focus on lateral movement or credential theft once they are inside the network.

These reasons make them juicy targets for threat actors, the report explained, stating that the number of Microsoft incident response engagements involving ESXi hypervisors has more than doubled in the last three years.

This popularity is reflected by the number of groups which support or sell ESXi encryptors such as Akira or Black Basta, including Storm-0506, Storm-1175, Scattered Spider, and EvilCorp.

To mitigate the threats posed by this flaw, the report recommended any organization that uses domain-joined ESXi hypervisors to apply VMware’s security update as soon as possible, evaluate their credential hygiene to prevent hackers from the privileges they would need to exploit the vulnerability. 

Businesses could start shifting their workloads back into physical servers due to increasing virtualization costs, Gartner has reported as part of its 2024 Hype Cycle for Data Center Infrastructure Technologies report.

Gartner defines this process as ‘devirtualization,’ the act of moving a workload or application from a “hypervisor-based virtualized host” to a physical host that’s formed of server hardware, operating systems, and management tools. 

The initial move to devirtualization may be “triggered” by issues of cost, which are being driven by the movement from perpetual license to capacity consumption models, the consultancy firm stated. 

The ongoing fallout from Broadcom’s acquisition of VMware can be blamed more specifically, with Gartner clients reporting “increased costs” with on-prem virtualization as a result of the move. 

The report provided greater technical detail on the drivers of devirtualization, focusing first on the increasing prominence of new bundling, socket-to-core ratios, and consumption models which drive costs up by between two-and-three times.

Large virtualized workloads do not benefit from the same cost savings as smaller ones, the report added, meaning larger workloads could be ripe for devirtualization in certain cases. 

Gartner clients also do not have access to alternate vendors with the same abilities in virtual machine (VM) migrations, or else they depend on cloud-based services rather than on-prem ones.  

The consultancy predicts that this burgeoning trend of devirtualization will increase business reliance on physical materials as organizations begin investing back into physical hardware.

“As workloads devirtualize and move to physical hardware, the portability functions need replacing in the bare metal physical world of devirtualization. This requires investment in high value and high cost replacement functions and buy-in from the business,” the report said. 

Devirtualization is not a straightforward process

Gartner outlined a few of the obstacles businesses are likely to encounter when undertaking a process of devirtualization, such as the administrative impact of “signoff and renegotiation” with impacted business units.

There are also costs associated with switching that “offset” business exposure to the burden of virtualization contracts, meaning devirtualization might not be as attractive a move in certain situations. 

Gartner recommends that businesses always look at the total cost of devirtualization projects, including resilience dependencies and availability for both planned and unplanned downtime. 

The firm also noted the importance of managing the costs in replacing “live migration and host-based recovery” with physical alternatives, as well as managing the conversations with different departments impacted by devirtualization. 

Crucially, devirtualization could have a knock-on effect for business sustainability metrics. Mark Adams, co-founder at Inevidesk, told ITPro that carbon emissions could go up if organizations turn their attention back to physical servers. 

“Reverting to purchasing more physical servers will be detrimental to the environment, as it leads to additional carbon emissions during the production of physical servers and increased consumption to run them individually,” Adams said.

“Organizations considering a return to using only bare metal must educate themselves about the other virtualization options available in the market,” he added.

Adams didn’t think this process of devirtualization would have a “significant” impact on the industry in the long-term, however. He said that the environmental and financial inefficiency of physical workloads will ultimately turn decision-makers off the process.

VMware has announced an expansion of features for its private cloud platform, VMware Cloud Foundation (VCF), aiming to reduce complexity and meet customer demands on time to deployment and cyber resilience.

VCF is VMware’s private cloud model that brings together its software-defined compute offering vSphere, software-defined storage offering vSAN, software-defined networking offering NSX, and cloud management and automation offering Aria. 

With VCF 5.1, released in November 2023, VMware expanded its support for generative AI workloads with bolstered storage and improved graphics processing unit (GPU) capacity. With VCF 5.2, VMware has focused heavily on infrastructure management and updates, as well as a better experience for developers and security teams on the platform.

In a briefing with assembled media, Prashanth Shenoy, VP for cloud platform, infrastructure, and solutions marketing at VMware, said the firm began an 18-month “tour” of its customers under Hock Tan, CEO at Broadcom, to “truly understand what customers want us to focus on, what are their big pain points and challenges when it comes to cloud infrastructure”.

The results found that customers are focused on private and hybrid cloud strategies for cloud infrastructure modernization and operational efficiency, as they seek to tackle the business challenges of cloud migration.

A newly-announced ‘VCF Import’ feature will allow organizations to import siloed vSphere and vSAN environments they already run into VCF. 

“vSphere is the most widely deployed virtualized compute environment in the world, bar none, so quite a few of our customers have a vSphere-only environment,” said Shenoy, who noted that VCF Import has been the most requested feature among customers “by far”.

“A few customers have software-defined storage environments with vSAN for example and some of them have VMware file service environments, etc. What they wanted now is like, ‘as I want to go to a private cloud, bring these existing, siloed environments seamlessly without me having to re-architect my existing environment’. So that is what VCF import does.”

Shenoy said using VCF Import, customers could perform lifecycle management, patching, automation, or identity and access management (IAM) at a platform rather than a component level.

A new offering, VCF Edge, seeks to empower customers across more of their infrastructure. VMware hopes that by using the product, customers will be able to better manage their edge use cases at scale with a consistent experience across their environment.

VMware eyes platform consistency and resilience as core aims

Shenoy also noted that organizations have a range of applications in their environments, including business-critical apps and services such as Oracle and SAP, on top of modern apps such as generative AI tools. Across this, they seek consistent infrastructure and as easy a platform experience for their developers. 

VCF 5.2 will come with several headline features along these lines, with new support for developers to set up and configure NSX virtual networks using existing virtual LAN (VLAN) environments. 

The hope is that this will speed up and reduce the complexity of network configuration, reducing the strain on development teams facing tasks such as IP address changes and making it easier for enterprise IT to make the shift to VMware.

Tanzu Kubernetes Grid (TKG) will also now be deployable independently within VCF 5.2, to bring it in line with upstream Kubernetes updates rather than tying it to the vSphere release cycle. VMware said this will also allow developers to roll out updates at a pace that suits their internal operations, even as they continue to manage updates through the vSphere services with which they are familiar.

In its conversations with customers, VMware has also heard repeated focus on resilience, with cyber security top of the agenda at the board level. This is particularly true for vital cloud workloads, which organizations must be able to recover quickly in the event of a cyber attack.

One of the main features for cyber security in VCF 5.2 is ESXi Live Patching, through which admins can manage patches for ESXi hosts with no need to evacuate virtual machines (VMs) or place the hosts into maintenance mode. 

VMware says this allows emergency patches to be quickly and simply deployed without causing unwanted downtime, as well as improving the overall complexity of patch and vulnerability management security teams can plot out. It comes after concerns in 2023 over repeated ESXi security issues which Darktrace researchers linked to a lack of security tools for the hypervisor.

The slew of other security announcements include a new Flexible VCF Component feature, which will allow IT teams to apply patches across different VMware components without reboots, better vSAN Data Protection aimed at improved protection and remediation from ransomware attacks and erroneous deletions, and a new VMware vDefend lateral security to project against lateral attacks.

VMware is set to release Cloud Foundation 2.5 and vSphere Foundation 5.2 in its fiscal year Q3, which it is currently in.

Cutting products to sharpen focus under Broadcom 

The updates are the first major addition to VMware’s product portfolio since Broadcom acquired the company in November 2023. They represent the first releases under the new, combined approach to VCF sparked by the change of management.

“When we became part of Broadcom, the first thing that I felt was really compelling and critical for us to deliver this was to organize ourselves in a way to deliver that single integrated product,” said Shenoy. 

“So we brought all these different business divisions into a single organization, led by a single GM with a single engineering team, a single product team, a single global support team, a single professional services team all belonging to the same division.”

Since Broadcom acquired VMware, the firm has set about simplifying VMware’s portfolio by cutting products and scrapping its perpetual license model. The moves have prompted unrest among some in the industry, as acknowledged by Tan. 

The Cloud Infrastructure Service Providers in Europe (CISPE), a cloud trade body, has also accused Broadcom of “holding the sector to ransom” and of being “anti-cloud”.

“I'm sure quite a few of you have heard some of the noise in the market saying, ‘Hey, when we became part of Broadcom, we increased the prices and we really cut down on the offers.’ Nothing can be further from the truth when it comes to price increases. 

“We cut the price by half for our VMware Cloud Foundation subscription offer, right? It was $700 per core, per year, we brought it down to $350 per core per year for our VCF offer as a subscription.”

Shenoy also said the firm’s move from its CPU-based perpetual model to a core-based subscription pricing model brought it in line with the rest of the industry. As part of this process, he said, VMware took stock of whether all of its offerings were necessary.

“As we did that, we took a hard look at our product offering and said ‘How can we drastically simplify the product offering so we can truly focus on the minimal critical products that our customers truly look at us to deliver?’”

Prior to the acquisition, VMware had 168 products and bundles with 9,000 stock-keeping units (SKUs), a term that refers to specific configurations of a product. Shenoy said that this made purchases and licensing incredibly difficult for VMware customers to navigate.

In combining products under banners such as VCF, VMware ended the availability of Aria SaaS services.

Shenoy said VMware knows that without proper adoption of its products, its customers will not unlock their true value. With this in mind, VMware is running its professional services at cost to smooth customer adoption journeys.

Enterprise software support provider Rimini Street has announced the launch of Rimini Support, Rimini Protect, and Rimini Consult for VMware.

The new third-party offering aims to enable perpetually licensed VMware customers to continue running systems in the years ahead following the vendor’s switch to a subscription-based licensing model.

Support services include round-the-clock, guaranteed priority support response by an engineer in ten minutes or less.

The firm’s CEO and president, Seth Ravin, said the firm’s new additions will now provide support to businesses facing significant annual fee increases from VMware as a result of its licensing model reshuffle.

Clients will be able to take time to analyze the vendor’s proposed changes, which includes the forced bundling of product licenses, to determine whether they are prepared to accept the new model and fees - or look to alternative approaches such as negotiation of new licensing terms or switching to alternative virtualization platforms.

“These organizations are now looking for an alternative, comprehensive annual support program that can enable them to continue implementing, changing and running their perpetually licensed VMware software infrastructure smoothly and reliably for years into the future,” Ravin said.

“Rimini Street is now offering such a support program for VMware products as an extension of its award-winning, mission-critical global support services utilized successfully by thousands of clients in more than 100 countries over nearly two decades.”

Available now, standard pricing for Rimini Street Support for VMware products is “similar to the current support fees that each perpetual licensee is paying VMware,” the company revealed.

Rimini Street expands support

With Rimini Support for VMware, customers can leverage global support and advisory services, which include dedicated services for configuration, performance, installation, upgrade, and customization. Organizations will also have access to a named primary support engineer with at least 15 years’ experience, with a guaranteed ten-minute response SLA for critical cases.

Rimini Street’s AI technology, Case Assignment Advisor, will recommend the optimal engineer based on more than 40 vectors to help resolve cases faster.

Rimini said its security-focused offering, Rimini Protect for VMware, will work to provide proactive and cost-effective protection against threats and vulnerabilities, which includes guidance on mitigating risk by strengthening the configuration of the VMware ecosystem.

Customers can also leverage Rimini’s self-developed security vulnerability analysis reports (SVARs) that include mitigation options and strategies, as well as zero-day reporting and level one security assessments.

Rimini Consult for VMware rounds off the trio to provide users with access to consultancy services that the company said will help VMware customers plan and align technology strategy with their business objectives.

Services include technical and application roadmapping and strategy, technology assessments, license advisory, interoperability and integration, staff skills and augmentation, as well as cloud migrations.

Commenting on the additions, Craig Mackereth, Rimini Street’s executive vice president of global service delivery, said the company was responding to high demand from customers.

“Our clients have made significant investments in their current VMware infrastructure, and many are seeking advice and counsel from Rimini Street on how to both continue leveraging their mature and proven VMware infrastructure platform and get the premium, mission-critical quality support and services they need at a price point they can afford,” he said.

VMware has issued a security advisory detailing critical flaws in its Workstation and Fusion hypervisor products after making them available to individuals for free.

On 14 May, VMware disclosed a series of security vulnerabilities in the two hypervisor solutions, providing workarounds and warning customers to patch their systems as soon as possible.

The first and most serious of these was CVE-2024-22267, a critical use-after-free vulnerability in the products’ vbluetooth device. The flaw has a CVSS rating of 9.3, the company revealed.

VMware warned that a hacker with local administrative privileges on a virtual machine could exploit the flaw to execute code as the virtual machine’s VMX process running on the host.

The second security issue, CVE-2024-22268, is a heap buffer-overflow vulnerability affecting the Shader functionality in Workstation and Fusion, rated 7.1 on the CVSS. 

If exploited correctly, the flaw could give an unauthorized actor with access to a VM with 3D graphics enabled the ability to force the target system into a denial of service (DoS) condition.

Also rated 7.1 on the CVSS, VMware disclosed another high-severity vulnerability – CVE-2024-22269 – which is an information disclosure flaw in the bluetooth device that could allow an attacker with admin privileges on a VM to read sensitive information contained in the hypervisor memory.

Finally, CVE-2024-22270, is another information disclosure vulnerability with a 7.1 CVSS rating that could give attackers access to information in the hypervisor memory, this time in Workstation and Fusion’s host guest file sharing (HGFS) functionality. 

Not the best timing for VMware

The day before it warned customers of the security problems affecting the two hypervisor products, VMware also announced it would be making Workstation Pro and Fusion Pro free for personal use.

Workstation Pro is VMware’s hypervisor solution for Windows and Linux devices, whereas Fusion covers customers using Mac systems.

They allow users to build ‘local virtual’ environments to install a variety of operating systems (OS) to build and test software.

The move has been touted as a gesture of goodwill by Broadcom amidst continued controversy over changes made since its acquisition of the firm last year. 

The acquisition has received stern criticism from various stakeholders due to Broadcom’s decision to overhaul the licensing structure for many of VMware’s most popular products.

Shortly after the acquisition in November 2023, Broadcom wasted no time announcing it would be axing over 50 standalone cloud services from VMware, including its popular Aria SaaS offering.

With its Workstation Pro and Fusion Pro announcement, VMware said the motivation behind the move was to “simplify how we bring VMware Desktop Hypervisor apps to market”, while ensuring both free and paid users received regular support and maintenance.

Enterprise users will find VMware has reduced its product group offerings down to a single stock keeping unit (SKU) for users who need licensing for commercial use. This simplification will eliminate over 40 other SKUs which VMware hopes will make quoting and purchasing their desktop hypervisor apps easier than ever.

Broadcom’s attempts to quell concerns over VMware subscription changes have fallen flat and prompted a further backlash from industry stakeholders. 

Cloud Infrastructure Providers in Europe (CISPE) recently stated that Broadcom’s change to a subscription-based pricing model was “anti-cloud” in nature, following on from other criticisms the trade body has made about Broadcom.

The comments follow an announcement earlier this month in which CEO Hock Tan made an effort to ease concerns over changes to VMware, which the company acquired in 2023, describing the original strategy as overly costly for customers. 

“It demonstrated that all too often, as innovative companies expand, decisions are made incrementally, not holistically as part of a larger, comprehensive strategy,” Tan said. 

Claiming to be responding to customer concerns, Tan then said that Broadcom would commit to increased levels of research and development, as well as significant price reductions in VMware Cloud Foundation (VCF).

“We have dramatically reduced the price of VCF to promote customer adoption,” Tan said.

Tan gestured to the creation of a simplified portfolio built on two core solutions, VCF and VMware vSphere Foundation (VVF), which come at “half the list price compared to past pricing.”

“Broadcom will continue to create value within the VMware partner ecosystem, because partners are critical to our customers' success and our own success,” Tan said. 

The firm’s CEO was careful to mention, however, that an incorporation of the VMware partner ecosystem in the Broadcom partner ecosystem would “require some adjustments.”

Tan described some of these adjustments, such as the standardization of both pricing metrics and technology stacks across cloud providers, as well as the transition to a subscription-based pricing model.

It is within the terms of this subscription-based model, though, that CISPE takes issue with Broadcom, citing unfair and restrictive licensing practices that undermine choice and prompt vendor lock-in. 

While subscription licensing in its ideal form should allow for flexibility in cost as users scale resources according to demand, CISPE said Broadcom’s new terms act in a different way. 

“Broadcom’s new terms are the opposite and are in essence anti-cloud, forcing partners to commit and pay in advance for virtualization capacity that they may never need,” CISPE said.

By focusing so heavily on the subscription-based pricing model and positioning the move as one likely to “fuel continuous innovation”, CISPE claimed that Broadcom was attempting to “obfuscate” the key issues in the dispute. 

“What threatens the economic viability of many cloud services used by customers in Europe, are the massive and unjustifiable hikes in prices, the re-bundling of products, altered basis of billing and the imposition of unfair software licensing terms that restrict choice and lock-in customers and partners,” CISPE said. 

Others in the industry have also expressed criticism, such as the CEO of Civo, Mark Boost. He told ITPro that Broadcom’s statement offered nothing in the way of remedying rising tensions in the cloud community. 

“The CISPE is absolutely right to reject Broadcom’s changes. They are empty words and confirm what many VMware customers have known for a while,” Boost said.  

“Alongside licensing costs, there’s growing concern Broadcom’s decisions will stifle innovation and harm cloud competition,” he added. 

Broadcom moves “adding insult to injury” 

Not satisfied in calling out the unfair terms of Broadcom’s licensing strategy, CISPE also made note of Broadcom’s more superficial failings.

Tan, for example, announced free access to zero-day security patches for users not wishing to continue using VMware under its updated licensing structure, a move CISPE described as “insulting in its limitations” and tantamount to criminal. 

“Effectively promising no more than to fix critical software flaws that emerge in the product unless the customer decides to move to the new subscription license verges on racketeering,” CISPE said.

Similarly, CISPE called out the tone taken by Broadcom in its “lecturing” of customers and its claims of lowered prices which, according to CISPE, go against “real-world evidence to the contrary.” 

Broadcom CEO Hock Tan says the company is aware of lingering customer unease in the wake of its $69 billion VMware acquisition, but retains a positive outlook for the year ahead. 

In a blog marking 100 days since the acquisition, Tan was largely optimistic about the group’s progress towards building the “world’s leading infrastructure technology company” as the company continues an overhaul of VMware’s business model. 

Since acquiring the cloud computing company in November 2023, Broadcom has made a number of significant changes described as a “simplification” of the VMware product portfolio, reorienting the business towards a subscription based model.

The shift has been previously characterized by Broadcom as bringing VMware in alignment with broader industry standards, and forms part of a wider transition toward subscription licensing. 

Tan claimed the changes were motivated by his desire to meet customer demand more effectively, and to provide better value through their products.

“[A]ll of these moves have been with the goals of innovating faster, meeting our customers’ needs more effectively, and making it easier to do business with us,” he wrote. “We also expect these changes to provide greater profitability and improved market opportunities for our partners.”

Despite this, he admitted being sympathetic to some less enthusiastic responses from customers and partners due to the level of change being undertaken over such a short period.

“We recognize that this level of change has understandably created some unease among our customers and partners,” Tan said. 

Citing Broadcom’s track record following previous acquisitions, a number of customers heavily invested in the VMware ecosystem have voiced concerns about where they stand as the company undergoes a significant transformation.

Broadcom has spared no time in overhauling VMware products

Broadcom’s first move was to cut perpetual licenses in December 2023.  It claimed the move was all about simplification and driven by customer complaints that VMware’s product portfolio and go-to-market strategy were too complex. 

The company announced it would continue to support customers operating under a perpetual license agreement for the period defined in the contract, but after that it would help them exchange these for subscription-based products.

Around this time, Broadcom also revealed it would overhaul the VMware Cloud Foundation and vSphere Foundation platforms, billed as another “portfolio simplification” focussed on distilling the portfolio down to what it views as VMware’s flagship enterprise solutions.

The most significant change here was the decision to halve the subscription list price and the addition of higher support service levels, which includes better support for implementing the solutions as well as lifecycle management.

In January 2024, Broadcom also axed VMware’s multi-cloud software as a service (SaaS) management suite, Aria, making it one of over 50 standalone cloud services that have been taken off the market since the acquisition.

Continuing Broadcom’s general movement away from offering individual SaaS solutions as standalone products, a number of these products including Aria are now only available as a part of the Cloud Foundation package.

Broadcom confirmed it planned to sell VMware’s end user computing (EUC) division to global investment firm Kohl Kravis Roberts & Co (KKR) as part of a $4 billion deal.

Broadcom has ramped up industry partnerships

There have been positive developments for customers since the acquisition, including closer integration with alternative industry offerings. 

For example, February saw Broadcom confirm its intention to further ‘shake up’ VMware’s licensing structure by supporting license portability of VMware Cloud Foundation to the Google Cloud VMware engine. 

This expanded support meant that customers who purchased VMware Cloud Foundation software via Broadcom could use their subscriptions for the Google Cloud VMware engine, and also in their on-prem data centers too.

Broadcom has confirmed plans to sell VMware’s end user computing (EUC) division to global investment firm Kohlberg Kravis Roberts & Co (KKR) as part of a $4 billion deal. 

Under the terms of the deal, the EUC Division, which was originally an arm of VMware prior to Broadcom’s acquisition of the company in November 2023, will now become a standalone company.

KKR confirmed the unit will now have a “greater access to growth capital and a dedicated strategic focus”, allowing for further development of the business. 

The EUC Division will continue under its existing management team, though KKR are looking to expand research and development capabilities, as well as pursue “new strategic partnerships.”

Broadcom’s decision to sell the platform marks a significant move, as this segment led the way in terms of its digital workspace offerings. Through a variety of products, the division allows organizations to securely deliver and manage remote-work systems. 

Its key products include Horizon, a desktop and application virtualization platform, and Workspace ONE, a unified endpoint management (UEM) platform designed for enterprise-level use. 

“We see great potential to grow the EUC Division by empowering this talented team and investing in product innovation, delivering excellence for customers and building strategic partnerships,” said Bradley Brown, managing director at KKR. 

Shankar Iyer, SVP & GM for the end user computing division will remain following the deal. Iyer described KKR as an "ideal new strategic partner" for the unit. 

“They are one of the most active investors focused on building leading global technology enterprises,” he said. “Most importantly, KKR believes in the unique value that our technology delivers to our large and loyal customer base, and they are eager to invest in our mission to become an even more innovative and customer-centric organization.”

VMware is not having a good time

The move from Broadcom forms part of a consistent pattern since its acquisition of VMware in late 2023. 

Broadcom first announced plans to acquire the tech company in 2022 as part of a $69 billion deal, which eventually gained regulatory approval in November 2023.

Since then, the floodgates have opened, with Broadcom introducing sweeping changes to a range of products and the way customers interact with the firm. 

Perpetual licenses, for example, were among the first of the major changes unveiled by Broadcom. In December, the firm confirmed plans to cut VMware perpetual licenses as part of what it described as a “simplification” of the VMware product portfolio. 

This has since been followed by a host of other product and service cuts. January saw VMware’s Aria SaaS offering become the latest victim of Broadcom’s relentless campaign of product “simplification”. 

Over 50 standalone cloud services were confirmed for the chopping block at the time and this has since grown.

Broadcom and Google Cloud have announced plans to support license portability of VMware Cloud Foundation to Google Cloud VMware engine, marking a move towards increased flexibility for customers. 

Customers who have purchased VMware Cloud Foundation software through Broadcom will soon be able to use their subscriptions on both the Google Cloud VMware Engine, as well as within their own on-premises data centers.

On top of the ability to bring pre-purchased VMware licenses to Google Cloud, new customers will also have the option to purchase a fully-integrated Google Cloud VMware Engine environment directly from Google.

“VMware by Broadcom is adding new levels of flexibility, investment protection and lower TCO for VMware Cloud Foundation with support for license portability,” said Krish Prasad, the general manager of the VMware Cloud Foundation division.

“By running VMware Cloud Foundation on Google Cloud VMware Engine, customers benefit from a highly efficient cloud operating model that provides the scale and agility of public cloud with the security and performance of private cloud,” he added.

The move is set to bolster the channel and improve customer experience in a few key areas.

A simplification of infrastructure will allow customers to migrate virtual machines and workloads to Google cloud without much hassle, in turn, increasing access to Google’s networking architecture.

Customers can continue managing cloud-based resources with familiar VMware tools and resources while, at the same time, gaining access to native containerized applications.

This will help to streamline operations through a unified Google Cloud experience that offers integrated identity and access management (IAM) and speedy self-service provisions.

By scaling workloads into Google Cloud and only paying for utilized resources, businesses could also benefit from a reduction in operational costs, while the collaboration will also allow customers to leverage improved security and reliability.

As with most announcements at the moment, there’s also a nod to artificial intelligence (AI). Google Cloud will provide access to its data insight capabilities, bolstered by AI and machine learning applications.

“As the first public cloud partner to announce plans to support VMware Cloud Foundation license portability, Google Cloud remains committed to improving the simplicity and cost-effectiveness of our customers’ cloud migration and digital transformation initiatives,” said Mark Lohmeyer, vice president and general manager, Compute and ML Infrastructure at Google Cloud.

“Through this model, our customers can realize the unique benefits of Google Cloud VMware Engine, such as four 9’s cluster-level uptime, deeply integrated networking and a unified Google experience along with the full portfolio of Google Cloud services across AI/ML, data analytics, security, and more,” he added.

The collaboration is set to be made publicly available in the second quarter of 2024.

VMware has announced its Aria SaaS offering is the latest victim of efforts to simplify its product lineup and boost subscription rates, and will be one of many SaaS solutions no longer offered as standalone products moving forward.

Over 50 other standalone cloud services from VMWare will no longer be available as individual licenses as parent company Broadcom pushes for a subscription-only, bundle-based business model.

Some of these products will be integrated into two new bundle packages, VMware Cloud Foundation, and VMware vSphere Foundation.

Cloud Foundation is billed as VMware’s flagship enterprise hybrid-cloud solution targeting large businesses, whereas vSphere Foundation is aimed at providing intelligent operations management solutions for their mid-sized to smaller customers.

But a number of VMware's services will not be carried over or replaced in either of VMware’s new Cloud Foundation and VSphere Foundation offerings, such as VMware Sphere+, vCentre Foundation, and the Cloud Director Service. 

In December 2023,  VMware announced it would be transitioning from a perpetual license to a subscription model, following its acquisition by Broadcom.

Customers will still be able to use the perpetual licenses they have purchased for products but will not be able purchase additional licenses once the product reaches end of availability. 

Touted as a “dramatic simplification of our product portfolio”, VMware claimed this shift was in line with customer and partner feedback calling for the company to reduce the complexity of its offers and go-to-market strategies.

VMware customers “anxious about where they stand”

Some analysts have claimed enterprise customers feel there has been a lack of clarity around the significant shift in operating models. 

Speaking to ITPro, senior vice president EMEA at cloud computing company Nutanix, Sammy Zoghlami said Broadcom’s previous actions after acquiring companies has given customers cause for concern.

“What we’re hearing from many customers and prospects, especially among enterprises heavily invested in complex VMware environments, is that they are anxious about where they stand, given Broadcom’s track record in the wake of earlier takeovers”, he explained.

Zoghlami recounted two examples of the tech giant stripping recent acquisitions to the detriment of existing customers.

“Among customers, the fear that history is repeating itself is intense. Many will remember that, in 2018, Broadcom bought CA Technologies for $18.9 billion and immediately set about reducing its workforce. Chunks of the company were sold off to private equity, including its application security testing platform, Veracode” he said.

“Only a year later, customers saw a repeat performance following Broadcom’s purchase of Symantec’s enterprise security business for $10.7 billion. Bits of that business were also broken off and sold on. In line with that pattern, it has already been made clear that VMware End-User Computing (EUC) and Carbon Black business units will be divested.”

Another concern among VMware customers is changes to the company’s pricing model, with one executive at an investment management firm telling Zoghlami the change in business models will lead to a 2-5x price hike.

“One VMware customer, Phil Matuszak, technology services director of Kinship Trust Company LLC, has already bemoaned a switch away from perpetual licensing to annual subscriptions, leading to a 2-5x price hike”, Zoghlami told ITPro.

“We are being told that VMware customers want a level of choice, value and pricing certainty that they are no longer confident of getting.”

A critical vulnerability in the VMware vCenter Server management software platform has been actively exploited months after the flaw was initially disclosed and security patches were released.

The critical vCentre Server security flaw allows attackers to leverage remote code execution (RCE) attacks on exposed servers. 

Tracked as CVE-2023-34048, the flaw involves an out-of-bounds write vulnerability in the vCentre Server system’s implementation of the DCE/RPC protocol, and was given the maximum CVSS base score of 9.8 in the National Vulnerability Database (NVD).

vCentre Server is VMware’s advanced server management software that provides customers with a centralized platform where they can manage virtual machines, ESXi hosts, and other VMware products.

VMware initially disclosed the vulnerability in a security advisory issued in October 2023, stating there was no evidence the RCE flaw was currently being exploited. 

The Broadcom-owned cloud computing specialist released a security patch alongside the advisory encouraging customers to patch their servers as soon as possible, with the latest vCentre 9.0U2 available now.

The severity of the vulnerability was underscored by VMware’s decisions to release patches for versions of its products that have reached their end-of-life (EoL) status. These security patches are available via VMware’s vCentre Server update system.

In an update made to its initial security advisory issued in October 2023, VMware confirmed the vulnerability was being actively exploited by threat actors in the wild.

VMware vCenter Server: A Chinese-linked group has been exploiting since late 2021

Research from Google’s cyber security subsidiary Mandiant revealed a Chinese espionage group called UNC3886 has been exploiting CVE-2023-34048 since late 2021.

UNC3886 have been previously recorded targeting VMWare products, with Mandiant revealing a novel malware system affecting ESXi hosts, vCentre servers, and Windows virtual machines. 

Mandiant’s report notes the similarity in the group's attacks, targeting systems lacking in endpoint detection and response solutions.

The attack paths usually focus “on technologies that are unable to have EDR deployed to them”.

“UNC3886 has a track record of utilizing zero-day vulnerabilities to complete their mission without being detected, and this latest example further demonstrates their capabilities,” the report added.

Researchers at Mandiant observed a similarity between affected vCenter systems where a certain “vmdird” service crashed just before the attackers deployed backdoors onto the server.

Both Manidant and VMware’s Product Security team were able to demonstrate that this crash process was linked to the exploitation of CVE-2023-34048.

These crashes were observed across cyber incidents attributed to the UNC3886 group between late 2021 and early 2022, providing the threat actors with an 18-month window in which to exploit the vulnerability.

As well as applying the latest security patches, VMware warned customers to tighten their network perimeter access control, acknowledging there are no workarounds that remove the vulnerability entirely.

“VMware strongly recommends strict network perimeter access control to all management components and interfaces in vSphere and related components, such as storage and network components, as part of an overall effective security posture.”

Broadcom has announced plans to stop VMware perpetual licenses as part of a series of changes to the firm’s product range in the wake of its recent acquisition.

Perpetual license contracts will be shuttered in a move which Broadcom said forms part of a “simplification” of the VMware product portfolio that aims to enable customers to “gain more value for their investments”.

Broadcom said efforts to shake up its portfolio is based on customer complaints that its offers and go-to-market are “too complex”.

Broadcom will instead usher customers toward a subscription model in alignment with broader industry standards. This means product offerings will now be solely available as subscriptions, or as term licenses and Support and Subscription (SnS) renewals.

In pursuing a subscription model, the firm said it will deliver a range of benefits to customers, including “continuous innovation”, “faster time to value”, and more predictable investments.

Broadcom did provide clarification for customers operating under a perpetual license agreement, however.

The tech giant said it will continue to provide support “as defined in contractual commitments”, but advised customers to “review their inventory” to establish renewal and expiration dates.

“Broadcom will work with customers to help them ‘trade in’ their perpetual products in exchange for the new subscription products, with upgrade pricing incentives,” the firm added.

VMware perpetual licenses aren’t the only changes afoot

Changes to VMware perpetual licenses aren’t the only amendments announced by Broadcom this week. The firm will also overhaul its VMware Cloud Foundation and VMware vSphere Foundation portfolio. 

The first of these changes includes a subscription price reduction for VMware Cloud Foundation. The company will cut the subscription list price “by half” and aims to provide “higher support service levels”.

This includes enhanced support for solution activation, as well as improved lifecycle management services.

The new VMware vSphere Foundation will also offer customers a “more simplified” workload platform aimed specifically at small-to-medium sized businesses, Broadcom said.

Changes to the offering will include integration of vSphere with the firm’s intelligent operations management system to provide streamlined performance and availability, as well as improved efficiency.

Both of these offerings will also include optional advanced add-ons. This includes integration with its storage offering, ransomware and disaster recovery service, and application platform services.

An add-on for its Private AI service will be made available soon.

It's a deal that has been in the works for almost a year and a half, having fallen on the desks of all major regulators before spending an uncomfortable amount of time lingering at the behest of Chinese regulators.

At long last, Broadcom has acquired VMware for $61 billion. The delay has been more political than economic, and it’s no coincidence that confirmation has come at a time of new thawing relations between the PRC and the US. But for partners and customers caught up in the delay, the long wait is finally over.

Since Broadcom confirmed it would acquire VMware, its plan has been sketched out in stages. The chip and software giant has big plans for VMware, which for its own part has maintained a steady course of self-improvement.

A tale of two conferences

This year’s VMware Explore Barcelona saw the company present a united front and clear vision, while also forced to limit discussion around subjects pertaining to Broadcom almost altogether.

On the one hand, VMware is going from strength to strength, with announcements for cloud data management and the addition of IBM and Intel to its private AI offering. Partners and customers alike seemed pleased with the efforts the firm is making, especially when it comes to the unification of its formerly sprawling stack under more uniform titles.

On the other hand, the shadow of the Broadcom acquisition loomed large over the event and there was a pronounced sense of anticipation for the deal to go through.

ITPro saw VMware prove itself as a firm with a vision for its future, grounded in a methodical strategy and strong partners such as Nvidia and Intel. Innovation and digital transformation with customers like Audi through its use of computer vision in the logistics and retail sector only strengthened this view.

But this all hinged on the specifics of Broadcom’s plan for VMware. With the acquisition now successful, Broadcom has made clear that it wants to invest heavily in VMware Cloud Foundation while pushing the benefits of products like Tanzu, software-defined edge, and VMware’s private AI offering.

In the opening keynote, VMware CEO Raghu Raghuram acknowledged the 17 months of work that have gone into preparing VMware for integration into Broadcom for the acquisition and welcomed Hock Tan, CEO of Broadcom, to the stage to say a few words on the future.

Tan made three commitments to attendees, informed by conversations the executive has had with customers since Broadcom first announced its acquisition of VMware.

“First, if anything else we will not only continue but accelerate the pace of innovation through stepped up R&D investments,” Tan said.

“Next, we intend to invest much more in the VMware ecosystem with our partners, value added resellers, distributors, OEMs, managed service providers and of course global system integrators, in order to make our products more available and much easier to deploy and consume.

“Finally, we will make ourselves and our products easier to deal with.”

Tan was on stage for two minutes, but one couldn’t help but wonder if his appearance had been scheduled with the hope that the acquisition would have been approved by the time of the conference. 

He made no similar appearance at VMware Explore Barcelona 2022. and his words of reassurance and encouragement served to calm a nervy crowd.

Throughout the rest of the conference, there was minimal reference to Broadcom. Experts and customers were understandably unable to offer much insight into the deal, with strict regulatory processes underway and a $1.5 billion egress fee hanging over them.

Last year, Raghuram told the assembled press that although Broadcom would call the shots for VMware once the deal had gone through, it would also restructure its business to make VMware its official software arm. It is still not clear whether this would shunt Broadcom’s existing software subsidiaries under the VMware umbrella, or if another arrangement would be made.

What is clear is that VMware is set to enjoy an unprecedented level of identity under the Broadcom banner, a decision perhaps informed by the chip maker’s previous acquisitions. Raghuram told a press conference that VMware is not working with Broadcom on AI processor projects.

VMware customer confidence 

How does this translate to customer confidence? It seems the promise of retained identity under a parent company that wants to continue on VMware’s path of innovation and consolidation has gone down well.

“The promise to simplify solution offerings and make it easier for VMware customers to procure and operate with VMware under Broadcom is a positive indication of what’s to come and a key driver aligned to Xtravirt’s strategic purpose to simplify the technology journeys of our clients” says Gavin Jolliffe, CEO at Xtravirt.

Xtravirt is a leading UK partner of VMware and helped the University of Bristol deliver its new network environment to empower academics and support its work on the Isambard-AI supercomputer.

“Broadcom’s promise to invest in the partner ecosystem, and simplify offerings aims to make it easier for customers to engage with, procure, and operate VMware solutions going forwards. We are pleased to see the acquisition close and remain committed to providing insights and feedback that will shape the new partnership model and drive customer success across the whole VMware portfolio” Jolliffe adds.

“Over the last few months we have seen VMware double down on innovation and consolidate features and capabilities across its core platforms. Post-acquisition, we anticipate VMware customers will benefit further as Broadcom make their promises a reality.”

Customer continuity

Above all else, the statements of Tan and Raghuram speak to extended efforts by both firms to retain VMware’s company identity. 

In a tweet announcing the news, Broadcom said the acquisition marks “another important step forward in our efforts to build the world’s leading infrastructure technology company”. This signals what we already knew about the deal - namely that Broadcom recognizes the value of VMware’s infrastructure and virtualization offerings in their current, united, form.

The name ‘VMware by Broadcom’ also speaks to this. Under Raghuram’s eye, the firm has become a powerful end-to-end cloud offering in its own right, aiming to fight ‘cloud chaos’ through a more cohesive approach. Broadcom, it seems, aims to pour money in and watch it grow, rather than break it apart for its valuable elements.

Broadcom has confirmed it plans to close its $69 billion acquisition of VMware on Wednesday after securing all necessary regulatory approvals. 

Chinese regulators approved the merger between the two firms, bringing to a close months’ worth of intense regulatory scrutiny.

The approval from China comes with limited “restrictive conditions”, the firm noted. Chinese regulators demanded Broadcom must not use the merger to abuse its market position and retain interoperability between VMware servers and alternative third-party hardware providers.

“Broadcom has received legal merger clearance in Australia, Brazil, Canada, China, the European Union, Israel, Japan, South Africa, South Korea, Taiwan, the United Kingdom, and foreign investment control clearance in all necessary jurisdictions,” Broadcom said in a statement.

The chipmaker added there is now “no legal impediment” to closing the deal under US merger regulations.

Following the acquisition, Broadcom will now operate under the VMware brand.

Broadcom VMware merger: Key talking points

Broadcom’s merger with VMware rapidly became a regulatory flashpoint after it announced its intention to acquire the cloud computing giant in 2022. 

Key concerns focused on the merged entity being able to prevent products from Broadcom competitors working with VMware services, such as its server virtualization software.

Some industry stakeholders also warned the deal could harm innovation and stifle competition.

EU regulators granted permission for the merger in July after Broadcom offered European rivals interoperability commitments. In August, the UK’s Competition and Markets Authority (CMA) also cleared the merger.

A CMA review concluded that the deal “does not substantially reduce competition”.

In recent months, geopolitical tensions between the US and China have created an additional layer of complexity and uncertainty.

Investors feared for the outcome of the deal after the Biden administration introduced more stringent controls on the export of high-end chips to China in October 2023.

Speculation began circulating that Chinese regulators could look to scupper the deal in response to the US administration’s aggressive stance on chip exports.

The University of Bristol is at the center of a wave of investment and innovation. The institution has already begun to roll out a new digital environment for students and staff and unveiled supercomputers that will boost UK computing power by an order of magnitude.

Bristol is a civic university, and so it offers an array of multidisciplinary courses with an intense focus on research. It maintains a 50/50 balance between research and education, which presents unique challenges for its IT environment.

For years the university has aimed to achieve digital equity, in which every student and academic has access to relevant materials, resources, and the wider university community, regardless of location or the limitations of their device.

This contrasts against years of siloed networks, with students who could physically attend the university more easily able to access key resources. Staff also found it difficult to source devices through the IT department that met the budget set out by their grants. 

To realize its goals, the organization sought a multi-cloud approach. This allows the university to blend and extend its network for freer access while empowering its IT teams to maintain security controls through new operations layers. It also allows for scalable expansion into future projects.

Bristol also worked with partners to create the ideal environment for growth and invested in cutting-edge technologies such as its growing cluster of supercomputers. This has required a radical overhaul of the university’s cloud platform via a multi-cloud approach – something that public cloud providers weren’t offering.

Breaking down research barriers

Speaking to ITPro at VMware Explore Barcelona 2023, Keith Woolley, CIO at the University of Bristol, explained how he has worked since 2019 to enable a “boundaryless education and research strategy” through digital transformation. The vision is a self-service environment that is free at the point of entry, to cut out the complexity and costs of the current system.

“The challenge that the vendors were doing, at the time, was ‘please give us all your workloads, please let us stick it in a cloud,’ and I needed all clouds,” Woolley tells ITPro.

“There was only one platform that we could see and that was the VMware Cloud Foundation. It was embryonic in what it was trying to do, but very clear in the fact that it was looking to create a multi-cloud environment that could be built upon.”

VMware paired the University of Bristol with Xtravirt, one of its accredited partners. Xtravirt had already worked with Woolley and his team on its virtualization efforts and expanded its partnership to provide a proof-of-concept for this equitable VCF environment.

“By using a partner like Xtravirt that was looking more at the value of what we were trying to create, rather than the technology stack of trying to create it, we were able to work in partnership on the overall business outcomes we required,” he says.

Academics had frequently complained about inaccessible pricing and long delays when trying to obtain devices through the university’s IT services. This is principally what drove the need for a self-service environment that would be free at the point of entry for all academics at the University of Bristol.

To keep the service accessible and affordable, Woolley worked with Xtravirt to put certain limitations in place, such as constrained processor, memory, and storage allowance per user. The finished system has been well-received by researchers and has already been cited positively in academic papers.

Woolley’s team can maintain cyber security, data governance, and custom firewall rules via an onion layer.

Supercomputing integration

The University of Bristol will host Isambard-AI, the UK’s most powerful supercomputer from Spring 2024. This will form part of the UK government’s Artificial Intelligence Research Resource (AIRR), a supercomputer cluster that will also include the Dawn supercomputer at the University of Cambridge.

HPE announced its work on Isambard-AI in early November, having received £225 million to produce the supercomputer in collaboration with Woolley’s team and Nvidia. Once complete, Isambard-AI will support 200 quadrillion calculations per second and will be made accessible to University of Bristol academics.

While highlighting the fundamental paradigm shift that Isambard-AI represents – the supercomputer will be approximately ten times more powerful than ARCHER2, the UK’s current top dog in the high-performance computing (HPC) space – Woolley also emphasized how the work with Xtravirt and VMware formed the foundation for this innovation.

“It’s an absolutely state-of-the-art machine that we’re doing, but the underlying technology in it is very similar to what we’re doing with containerizing through Tanzu, the way in which we’re using VCF cloud financial services.”

Woolley has also overseen work on two more supercomputers at the University of Bristol. The first of these is Isambard 3, a supercomputer originally intended to enhance the Met Office’s weather and climate modeling that has subsequently been used to conduct research for the healthcare sector such as work on COVID-19 vaccines and simulations on the cause of Parkinson’s disease.

The second is Reality Emulator, a digital twin intended for use across sectors including finance, logistics, and manufacturing.

Supercomputer results will be made accessible through the university’s VCF environment and down the line, the University of Bristol will work with companies such as VMware for advanced machine learning (ML), as well as AI ethics and other AI research.

“This solution that we're bringing in now is going to change the way we think about biochemistry, radiography science, fusion power, fission power. It's going to change the way in which we can move the landscape of research.”

The University of Bristol will also seek out closer collaboration with other organizations. Woolley says a good starting point will be to enrich its relationship with research hospitals to share information and use learnings and innovations to reduce costs.

Internationalization and identity controls

Woolley tells ITPro that in time the network will also be driven by identity, with zero trust network access (ZTNA) allowing academics to assign specific resources to certain student groups without overextending privileges. To this end, the university is working on identity management programs.

“It’s vitally important to me, especially as we are trying to think about where we're taking our international business, our internationalization, and the way we're thinking about the university moving internationally, to be able to make sure that we cannot only attract international students to our campus but we can support international students in their home country,” Woolley tells ITPro.

“I want to make sure that I can truly say, ‘we are an equitable company, when you want to come and work with us you can have an equal opportunity to educational research and an equal experience’, and that's our ambition in the way we're moving forward with our technology.”

In the near future, the university will integrate virtual desktop environments and graphics processing unit (GPU) capabilities for deep learning and high-volume research. Through a £52 million investment in network infrastructure, he aims to ensure the network can securely segment itself and pull in all the remote users it needs to meet Woolley’s original vision of an equitable academic environment.

“[To make that] enterprise-ready, across the whole piece, what’s left to do is a lot of scaling up,” says Woolley.

“What’s also left to do is expand to the edge, getting the software edge right to ensure we can really start to open the boundaries of where we operate and get that edge a lot wider, a flexible global edge.”

A key figure at Audi has expressed the hope that the firm's VMware partnership will successfully lead to hyperconverged infrastructure (HCI) in its production environment and lead other figures in the sector to follow in its footsteps.

Henning Loeser, head of Audi Production Lab, spoke at VMware Explore Barcelona about his team’s aim to virtualize programmable logic control (PLC) through HCI to make its production environment more scalable and efficient.

VMware has championed Audi as one of its partners at this year’s conference and dedicated a section of the keynote to the strides the firm has made in its production environment to date, as well as VMware’s growing efforts on operational technology (OT).

“We needed to have HCI that is real-time capable, that is deterministic, and that has the availability that we need for automation to work,” said Loeser. 

As Audi embraces the challenge of switching to manufacturing all-electric vehicles, with the goal of only selling electric vehicles from 2026, the firm has looked at how to use the moment to improve its manufacturing and automation.

Loeser’s team began looking into industry 4.0 and data analytics principles for its production environment seven years ago but only began discussions with VMware two years ago. It was seeking HCI to reduce downtime on specialized production devices, which led Audi to adopt ESXi, VMware’s bare metal hypervisor. 

Audi has already used the hypervisor to implement three processes: a manufacturing execution system (MES), a quality control system, and an application for regulating the torque of screwdrivers.

The main aim is to have a fourth system, the PLC, up and running in the next two years Loeser described the PLC as the “heart and brain” of the automation operation.

“Then we can really tap into what’s doable with today’s IT technology and utilize that for automation and production,” said Loeser.

Once the virtualized PLC is in place, Loeser said that Audi will be able to scale its edge hardware much more intelligently, cut costs, and more easily integrate advanced systems such as computer vision in the future.

Loeser said that HCI will not only allow IT managers to have oversight of all these systems but also to address the “maintenance nightmare” of all the added compute.

The journey to this goal is ongoing, and Audi and VMware have already run into issues that they have had to overcome together.

For example, while the MES operates at a maximum latency of 100ms — the limit at which humans begin to notice a delay — the PLCs will need to operate with no more than 8ms latency. This necessitated the use of cables for the system, and even then each network firewall adds 1-2ms of latency.

Loeser added that this extreme low latency requirement would also prevent Audi from using private 5G for any of these systems.

“Why would you need a radio network instead of a cable? Cable is always more reliable than a radio network, so if it doesn’t move, we don’t need it,” he noted.

“It’s a different story for AGVs, and we have that in mind, but we’re looking for which use cases will require a 5G network.”

Audi also has to wait for the virtualized PLC to be CE-certified before it can be rolled out on a larger scale, or it would risk negating the safety certification of its entire automation zone.

Loeser held up other challenges as learning points from which other automotive manufacturers could benefit. 

At an earlier stage of testing Loeser’s team couldn’t figure out why some IPCs froze seemingly at random and had to be rebooted. This was eventually traced to a graphics driver that was causing memory leakage and is now a known issue to look out for.

Through HCI, IT managers could track whether the memory or the hard drive was unexpectedly filling up. Errors such as this could be far easier to detect through these centralized health metrics.

“If it’s only Audi that does this or only the VW Group, it’s no use to change these things,” said Loeser.

“One of the big purposes for me being here is to evangelize, spread the word that separating your computing from your hardware is sensible.”

VMware has announced three expanded partnerships for its private AI service, with IBM Consulting and Intel all set for long-term collaboration on generative AI.

The partnership with Intel will bring Intel hardware and its software suite to VMware Cloud Foundation as well as fourth-generation Intel Xeon processors, which the firm stated could provide inference response times as low as 100m/s.

Through its IBM partnership, VMware will bring the IBM watsonx data and AI platform to VMware Cloud Foundation, in conjunction with Red Hat’s OpenShift container program. 

“This is an important use case we’ve seen from a number of customers where they like what they have seen so far with watsonx, but they have this desire to bring the AI services available through watsonx to their data on-premises or wherever they do business.”

VMware aims to improve the availability of GPUs and CPU capacity for customer applications, and in a presentation highlighted the ability of its platform to intelligently provision compute resources to applications as and when they are needed as one of the benefits of running Intel’s offerings on its platform.

“Oftentimes organizations are having real challenges with being able to intelligently manage access to compute and the result for that is often cost overruns. So this is an area in which we can really shine.”

The announcement was made at VMware Explore Barcelona, the firm’s annual EU conference. It came alongside sweeping new commitments for data management to empower customers who want to implement new generative AI workloads.

VMware announced its new Private AI service in August at VMware Explore in , Las Vegas. The event saw VMware CEO Raghu Raghuram joined onstage by Jensen Huang, CEO at Nvidia, who explained that Nvidia, Dell, Lenovo, and HPE would provide 100 dedicated servers for VMware Private AI.

At the time, Raghuram stated that firms such as Hugging Face and Anyscale would work with it on generative AI to expand options for customers and enable more secure operations.

Since then, the firm says that it has been able to realize lower AI running costs than alternatives and that performance on its hypervisor has ranged from at the level of bare metal to 5% better than this option.

While private AI workloads could help to alleviate c-suite concerns over data leaks connected to generative AI, leading voices in the space have warned that the cost of implementing AI models on-prem could be ‘eye watering’.

VMware’s proposition, which includes the data safety and fine-tuning benefits of running models on-prem using virtualized GPUs, could also help customers embrace a hybrid cloud approach to AI.

“A core challenge that we have seen has been centered around privacy and that's privacy and control of organizations, intellectual property, wanting data to remain oftentimes where it is created, processed, or consumed and having the ability to bring AI to their choice of where they would like to see data,” said Chris Wolf, VP, VMware AI Labs

“That also includes access controls, not just to the AI models but to the data that might be used for inferencing with the model or the data that's being used to train the model.”

VMware has announced a large expansion of its cloud data services, with an update for its Data Service Manager and expanded compatibility for databasing alongside new protections against ransomware and services for data recovery.

Data Services Manager 2.0 is now natively available within VMware Cloud Foundation, providing IT managers with full control over policies for data and infrastructure. VMware stated it could cut the time spent on provisioning database services from hours to minutes.

The release of VMware Cloud Foundation 5.1 will also bring new capabilities to support the data needs of customers seeking to implement generative AI workloads. VMware said the updated system will deliver double the GPU capacity and four times the storage performance boost, as well as improved policy enforcement.

Another new feature is Intelligent Threat Detection, which uses artificial intelligence (AI) and machine learning (ML) to detect hidden ransomware in customer workloads via an isolated VMware Cloud environment.

When attacks do happen, Intelligent Threat Detection scans offline snapshots for anomalies in metadata or data exchange to identify encrypted data. It will pair with VMware Live Recovery, now available as a single unified solution for data remediation in the wake of an attack. 

VMware announced the updates at VMware Explore Barcelona 2023, its annual EU event that complements the yearly VMware Explore conference in the US. 

“The challenge statement that we're trying to address with our data services manager and data service strategies is how can we provide our customers a consistent and unified operational model and ensure their service level objectives for all of these modern databases and data services,” said Prashanth Shenoy, VP marketing, Cloud Infrastructure Business Group at VMware.

VMware said that 85 million workloads now run on VMware Cloud Infrastructure, with the firm having recorded a 31% year-over-year growth in consumption for VCI workloads.

The PostgreSQL database Google Cloud AlloyDB Omni will also be added to VMware Cloud Foundation as the first native third-party integration of its kind. 

Run on VMware’s hyper-converged vSAN infrastructure, AlloyDB Omni is capable of up to 100x performance of competing PostreSQL solutions.

It will be joined by the third-party object storage MinIO Object Store, which VMware described as a resilient object store ideal for mission-critical production environments such as for AI and ML.

“Whether residing on-premises, across hybrid clouds, or in a sovereign cloud environment, data is the fuel for digital transformation,” said Krish Prasad, senior vice president and general manager of cloud infrastructure business unit, VMware.

“Through our new data services innovations and partnerships, we are making VMware Cloud Foundation the best platform to power the traditional, modern, and AI and ML applications that are central to business.” 

Leaps for Sovereign Cloud 

While Sovereign Cloud demand is still largely being driven by data residency requirements, Bhardwaj stated that local regulations such as the EU AI Act and Data Act are driving greater needs for sovereign cloud architecture.

Brewing legislation on AI has also driven VMware customers to implement measures that ensure data sovereignty is respected by models they are using, in the cloud or on-premise via VMware Private AI.

VMware said that as customers need to manage their Kubernetes clusters, they need centralized policy management.

To help deliver this VMware will deliver its SaaS service Tanzu Mission Control, which is used for multi-cloud Kubernetes management, as a self-service solution for air-gapped environments.

MongoDB, Kafka, and Greenplum will also be made accessible through new ‘as-a-service’ offerings, for added options on real-time and data analytics, as well as flexible and fast data transactions.

VMware additionally announced expanded partnerships with NetApp and Thales. NetApp will provide its StorageGRID Object Storage directly within Sovereign Cloud, while Thales is set to provide Bring Your Own Key (BYOK) services for Sovereign Cloud through its CipherTrust service.

“We are seeing increased adoption of our Sovereign Cloud solutions, which we announced last year in Barcelona,” said Rajeev Bhardwaj, vice president, cloud provider platform at VMware.

“I’m happy to report that we now have 55 cloud service providers who are part of the VMware Sovereign Cloud program.”

Innovations at the edge

In addition to its cloud announcements, VMware unveiled a range of advancements for its Software-Defined Edge ecosystem, such as Intelligent Assist for VMware Software-Defined Edge. 

This builds on the other VMware services containing its generative AI Intelligent Assist solutions which already serve Tanzu, Workspace ONE, and NSX+.

It is hoped that the tool will help customers to perform smoother rollouts across VMware’s SDE and secure access service edge (SASE) products. The firm cited Gartner research that indicated that by 2026, 50% of all edge computing deployments will involve machine learning (ML) at some level.

VMware is also rolling out Microsoft Security Copilot for its SASE customers as a trial, with the intention of expanding the generative AI tool’s scope to include data on network perimeter security.

Welcome to ITPro's live coverage of the 2023 VMware Explore conference in Barcelona. 

We've got an exciting couple of days ahead of us here in Catalonia, with the opening keynote session about to begin shortly. 

In this morning's session, we can expect a raft of new announcements from VMware, as well as an update on the company's strategy and all things multi-cloud. 

Make sure to follow our live coverage to stay on top of all the latest news. 

Good morning from Fira Barcelona. It's busy here in the keynote stage, with just five minutes to go until the event officially kicks off.

We're expecting to hear from Raghu Raghuram, CEO at VMware, alongside a host of executives. Some special guests are no doubt on the way as well, from throughout VMware's extensive partner and customer ecosystem and we'll be bringing you the latest as it comes.

And we're off, with a video on the use cases for generative AI, featuring testimony from executives at AWS, Hugging Face, and Google as well as Hock Tan, CEO at Broadcom.

"For any meaningful enterprise, their data lives in all types of locations, distributed computing and multi-cloud will be at the very foundation of AI," says Raghu Raghuram, CEO at VMware.

It's been 25 years of milestones and accomplishments for VMware, but Raghuram says that there may have been "no milestone as important as the one that happened last May, when we announced we were joining forces with Broadcom".

To explain more, he welcomes Hock Tan, CEO at Broadcom, on stage.

Tan is making three commitments to VMware customers.

1. To maintain and accelerate the speed of innovation and step up R&D investments.

2. Invest more in the VMware ecosystem.

3. Make itself and its products much easier to deal with.

With that, it's back to Raghuram, who is setting out the 'cloud smart' approach to multi-cloud.

"More than 3/4 of people are using two or more public clouds," he says, adding that VMware's push for cloud smart goes hand in hand with its AI strand.

We’re now being shown a video of a VMware vcustomer that is using multi-cloud for backing AI expansion: Siemens Healthineers.

The firm uses multi-cloud through VMware to access data for AI model learning without the need to move data, ensuring privacy is protected while empowering their systems to push the boundaries of medicine.

Now on stage is Purnima Padmanabhan, GM and SVP, Modern Applicactions and Management Business Group, to talk more about VMware's new cloud innovations.

Padmanabhan says that VMware has charted a 31% year-on-year growth for its cloud, but that there is always work to be done and innovations to be unveiled.

New releases are "anchored by VMware Cloud Foundation, delivered as software but also through out partners and hyperscalers," Padmanabhan says.

VCF 5.1 has just been announced, and this will come with 2x GPU capacity and 4x storage performance. Padmanabhan says this is perfect for more complex workloads.

VMware's partners have doubled in the past year to 57, in a rapid expansion for its Sovereign Cloud capabilities, Padmanabhan says. 

We've had a tease for our first generative AI announcement, in the form of more partners to be announced for its Private AI service, in addition to Nvidia as announced in August.

Moving at pace, Padmanabhan is highlighting the advancements VMware has made in the space of protecting against ransomware attacks and remediating them when they happen.

"We have automated all of this with VMware Live Recovery, and because we have access to all snapshots we have a tech preview where we can use ML to analyze these snapshots and give you early warning."

Padmanabhan takes a moment to emphasize the nightmarish mix projects that platform teams have to wrangle.

"Tanzu simplifies that process," Padmanabhan says.

"We provide your ability for developers so that they can operate and optimize your applications at scale and make sure that you're always optimizing your applications at scale and for best possible performance."

The new Tanzu Application Engine will be able to automatically package and secure code, and lay down networking so that developers no longer need to worry about clusters and configuring infrastructure.

It will be made available in testing next month.

Padmanabhan has moved on to consider the edge.

"Whether it's healthcare, retail, or manufacturing, edge is becoming more required, and that's where our Software Defined Edge comes in."

VMware Edge Cloud Orchestrator is VMware's solution for managing edge endpoints at scale. It can automate policy for each endpoint, and update them intelligently.

To hear more about edge, we're welcoming Sumit Dhawan, president at VMware, and Dr Henning Loeser, head of production at Audi Production Lab, Audi AG.

Loeser says that the switch to electric vehicles is both a challenge and an opportunity.

"It's a big opportunity for us, because it gives us the opportunity to put in new production lines and leapfrog our technology," he says.

Automating manufacturing more means adding lots more sensors, Loeser says, and understanding more about your process. This has meant adopting hyperconverged infrastructure with real-time capabilities, and that has the deterministic ability to make automation work.

In the future Loeser says that there will be even more sensors, requiring more compiute, and that this will lead to a "maintenance nightmare" without proper planning in collaboration with VMware.

"It's about using software to drive your production and being ablr to tap into the innovation cycle using the speed of software innovation," says Loeser.

Dhawan questions what Audi has found most helpful about its partnership with VMware.

Loeser says that it's been a learning journey for him, as someone with a manufacturing but not an IT background. Right now, he says, Audi is at the point where its small factory for certain models of Audi is already running on hyperconverged infrastructure.

In the coming years, Audi will deploy virtual PLCs on the same infrastructure, at which point the technology will be able to pull everything through.

"This will open the door to a new world of software-defined automation," he adds.

Both speakers acknowledge that AI has grown in importance. Loeser says that Audi has been using an AI algorithm for quality-checks on spot welds, and that next it will figure out how to scale more joining technologies and that this may necessitate more GPUs down the line.

"Here again, the hyperconverged infrastructure is a huge benefit because it's scalable," Loeser says.

"If in a couple of years, or even months, down the road we figure we need more compute it's much easier to add this with hyperconverged infrastructure."

On the topic of AI, we're now welcoming Chris Wolf, VP VMware AI Labs, onto the stage.

Wolf begins by acknowledging that AI is already widely-used, such as in predictive models and computer vision. But of course, he adds, the last year has seen rapid growth of large language models (LLMs).

"The surprise we've seen at VMware is that the total amount of resources you need for these use cases is often less than a typical organization might think," Wolf says.

He's giving the example of Hugging Face SafeCoder, which VMware built using the base of a model called starcoder. The pair programmer model was built with secure data in mind.

"Making sure that our source code stayed between our firewalls, that defines who we are as a business," Wolf says.

A core challenge, Wolf says, is privacy, which led it to announce its Private AI offering.

"What goes into an AI platform? Certainly, privacy needs to be at the center, but so does choice," he says.

"We can't assume that we can bet on a single vertical stack in terms of software and hardware, and it's going to solve the problems for all of our businesses."

There are also concerns around performance and cost. Wolf says that VMware that VMware Private AI has seen cost reductions of around two-thirds compared to public models, and can perform 5% better than bare metal.

We're getting a flashback to VMware Explore US now, with a clip of Jensen Huang, CEO at Nvidia, on stage with Raghu Raghuram to explain how Nvidia and VMware joined forces for VMware Private AI.

"Nvidia's GPUs are on every cloud, and VMware is everywhere," Huang had said.

"So for the first time, companies will be able to do private AI on the cloud at scale, and on multi-cloud."

Reference Architecture for VMware Private AI will help VMware customers to bring AI to their data centers more easily. It's a layer built on top of the Cloud Foundation, that comes with Ray, PyTorch, and Kubeflow as standard.

Wolf says Ray can provision a 100-node cluster in around three seconds - what he calls "an average Tuesday" for VMware.

In addition to infrastructure, Wolf says that VMware is focused on bringing a wide range of models to its customers. To do this, it continues to widen its partnerships and now boasts models such as Llama 2, Falcon, and StarCoder.

Intel and IBM have also announced expanded partnerships with VMware today, with new hardware and software for VMware Private AI. Read more here.

Wolf has announced that from today, Google AlloyDB and MiniIO will be available through Data Services Manager in tech preview. To learn more about this announcement, read our coverage here.

We're now hearing from Thomas Kurian, CEO at Google Cloud, via a pre-recorded video.

Kurian says AlloyDB Omni will help businesses to modernize legacy databases and expand new transformative generative AI applications.

"You'll be able to run PostgreSQL with superior performance and scale, with integrated AI capabilities and integration with our Vertex AI platform," Kurian says.

Wolf highlights announcements around Intel and IBM again, with the latter bringing watsonx AI to on-premises deployments. He promises much more on this soon, with workshops to take place at the conference. We'll be bringing you all of that and more soon.

And with that, the keynote is finished. Thanks for joining us, and stick around for more on the latest announcements, interviews, and insights from VMware Explore Barcelona.

CISA has urged VMware users to immediately apply patches for Aria Operations for Networks following the discovery of “multiple” critical vulnerabilities in the network management tool.

The first vulnerability, tracked as CVE-2023-34039, is an SSH authentication bypass flaw discovered by security experts at ProjectDiscovery Research and reported to the firm last week.

VMware said the vulnerability emerged due to a “lack of unique cryptographic key generation”, and would enable threat actors to bypass SSH authentication to access the Aria tool’s command line.

“A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI,” VMware said in its advisory.

“VMware has evaluated the severity of this issue to be in the critical severity range with a maximum CVSSv3 base score of 9.8.”

VMware confirmed on Friday that exploit code for CVE-2023-34039 has been published, and advised customers to apply patches for versions 6.2 through to 6.10.

A second flaw, tracked as CVE-2023-20890, was revealed as an arbitrary file write vulnerability with a CVSSv3 score of 7.2, marking it as “important”.

This flaw would allow an unauthenticated user with administrative access to Aria Operations for Networks to “write files to arbitrary locations” and enable remote code execution.

VMware “forgot to regenerate keys”

Analysis of CVE-2023-34039 from researchers at Summoning Team found that the cause of the vulnerability was due to the fact that VMware “forgot” to regenerate SSH authentication keys.

“VMware has named this issue “Networks Authentication Bypass”, but in my opinion, nothing is getting bypassed,” Sina Kheirkhah wrote in a blog post.

“There is SSH authentication in place; however, VMware forgot to regenerate the keys.”

Kheirkhah said an underlying factor in the flaw was that Aria Operations for Networks had “hardcoded” authentication keys across multiple versions spanning from 6.0 to 6.10.

Repeated vulnerability disclosures

This latest vulnerability disclosure from VMware marks the third in as many months for the company.

The firm revealed that exploit code has been exposed online for a critical remote code execution flaw affecting Aria Operations for Logs in July.

Meanwhile, in June CISA urged US government agencies to issue a patch for an actively-exploited command injection vulnerability in the network monitoring platform. Tracked as CVE-2023-20887, the flaw would enable threat actors to perform remote code execution.

“A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution,” the firm said at the time.

VMware has unveiled a brace of new Private AI solutions which it says will help drive enterprise adoption of generative artificial intelligence (AI).

The offerings include VMware Private AI Foundation with Nvidia, a new platform designed to help prepare enterprises running VMware’s cloud infrastructure for the next era of generative AI, and VMware Private AI Reference Architecture for Open Source, which aims to help customers achieve their desired AI outcomes through open source software (OSS) technologies.

At VMware Explore 2023 conference in Las Vegas, the company said these new solutions, along with its multi-cloud approach, will provide customers with the flexibility and control required to power a new generation of AI-enabled applications.

“With the introduction of these new VMware Private AI offerings, VMware is making the future of AI serve everyone in the enterprise by bringing the choice of compute and AI models closer to the data,” said Chris Wolf, vice president of VMware AI Labs.  

“Our Private AI approach benefits enterprise use cases ranging from software development and marketing content generation to customer service tasks and pulling insights from legal documents.”

Integrated AI tools

Comprised of a set of integrated AI tools, VMware’s Private AI Foundation offering has been designed to help enterprises run proven models trained on their private data, whether deployed on public clouds, data centers, or at the edge. 

The solution will integrate VMware’s Private AI architecture, which is built on VMware Cloud Foundation, with Nvidia’s AI Enterprise software to help customers customize models and run generative AI applications such as chatbots, assistants, search, and summarization.

VMware Private AI Foundation with Nvidia will be supported by Dell Technologies, Hewlett Packard Enterprise (HPE) and Lenovo.

Open source ecosystem

The company’s second offering, VMware Private AI Reference Architecture for Open Source, integrates OSS technologies to provide an open reference architecture for building and serving OSS models on top of VMware Cloud Foundation. 

At its Explore event, VMware said this interconnected and open ecosystem will feature collaborations from across the value chain to support customers’ AI strategies.

The firm is partnering with Anyscale to bring its open source Ray unified compute framework to VMware Cloud environments, as well as Domino Data Lab to provide unified a unified analytics, data science, and infrastructure platform purpose-built for AI/ML deployments in the financial services industry.

VMware said it is working with global systems integrators such as Wipro and HCL to help customers build and deliver turnkey solutions that combine VMware Cloud with AI partner ecosystem solutions.

The company is also collaborating with Hugging Face to launch commercial code assistant SafeCoder for the enterprise, while its partnership with Intel means VMware vSphere/vSAN 8 and Tanzu can leverage the chip-maker’s new built-in AI accelerators on its latest 4th-Gen Intel Xeon Scalable processors.

Additionally, VMware is introducing a new AI Ready program, designed to connect ISV’s with tools and resources that will validate and certify their products on WMware Private AI Reference Architecture. The initiative is expected to be live “by the end of the year,” the firm said.

Intelligent Assist

Elsewhere, VMware also revealed it is introducing Intelligent Assist, a family of generative AI-based solutions trained on its proprietary data to simplify and automate all aspects of enterprise IT. 

Built upon VMware Private AI, the company said the offering’s features will be “seamless extensions” of the investments enterprises have made in the VMware Cross-Cloud Services. VMware products with Intelligent Assist are expected to include VMware Tanzu, Workspace ONE, as well as NSX+.

“With VMware Private AI, we are empowering our customers to tap into their trusted data so they can build and run AI models quickly and more securely in their multi-cloud environment,” said Raghu Raghuram, VMware CEO.

Lenovo and VMware have expanded their partnership to bring new Nvidia-powered turnkey generative AI solutions and multi-cloud solutions to business customers. 

Announcing the move at VMware Explore 2023, the companies said the new offerings will provide businesses with an accelerated path to digital transformation through integrated edge-to-edge cloud offerings that simplify the development of next-generation AI and data intelligence.

Lenovo also unveiled its newest Reference Design for Generative AI, a new and fully integrated ThinkSystem solution that features Nvidia-accelerated computing and software to help businesses implement AI.

“This expanded collaboration with VMware is a pivotal next step in enabling more businesses to seamlessly leverage modern edge, AI, and hybrid cloud capabilities powered by NVIDIA in order to harness data for accelerated business outcomes,” said Kirk Skaugen, president of Lenovo’s Infrastructure Solutions Group.

The aim is to help customers benefit from more predictable outcomes through Nvidia’s AI Enterprise platform, which includes Nvidia NeMo software designed to boost the development and deployment of production-ready large language models (LLMs).

Lenovo’s newest Reference Design for Generative AI based on LLMs will show businesses how to deploy and commercialize powerful generative AI tools and foundation models, using a pre-validated, fully integrated solution for data centers running on VMware vSphere.

The offering features Nvidia GPU-dense platforms that are purpose-built for AI workloads, including the Lenovo ThinkSystem SR675 V3 and ThinkSystem SR670 V2, offering up to eight GPUs in a compact 3U or smaller footprint.

The Lenovo computing platforms offer three server configurations in one, including support for Nvidia HGX A100 4-GPU systems with Nvidia NVLink technology and Lenovo Neptune hybrid liquid cooling. They also provide four or eight GPU configurations featuring Nvidia L40S and 80GB Nvidia H100 Tensor Core GPUs, or Nvidia H100 NVL servers.

By combining Lenovo and Nvidia technologies with VMware, the companies say these servers will help professionals take generative AI applications like intelligent chatbots, search, and summarization tools to users across industries.

“VMware and Lenovo are partnering to help clients of all sizes become digital companies by investing in the infrastructure required to power a new generation of modern applications, such as Generative AI,” commented Krish Prasad, senior vice president and general manager of VMware’s Cloud Infrastructure Business Group. 

“Together we’re helping mid-market and enterprise customers manage their changing IT landscape, deliver faster innovation, and improve business outcomes.”

Lenovo said it is also adding Nvidia’s latest Spectrum-X networking technology to its AI portfolio, using Nvidia BlueField-3 data processing units (DPUs) and Nvidia Spectrum-4 switches in its generative AI reference design.

“Together, we’re helping enterprises create custom models using their valuable business data that will enable them to run intelligent generative AI applications, including intelligent chatbots, assistants, search and summarization,” said Manuvir Das, vice president of Enterprise Computing at Nvidia.

Additionally, new ThinkAgile VX Integrated Systems with VMware aim to help mid-market businesses enter the next wave of AI and machine learning with IT that is easier to deploy across hybrid, multi-cloud and edge environments.

Lenovo’s ThinkAgile VX with VMware Cloud Foundation provides integrated multi-cloud infrastructure for building and managing private and hybrid clouds, leveraging VMware’s tools for automating the deployment and management of infrastructure and applications.

The company is also offering an on-demand model with Lenovo TruScale Hybrid Cloud for VMware, a new private cloud infrastructure as a service offering designed to enable IT admins and developers to tackle next-generation applications and scale hybrid cloud workloads on demand. The solution is available through a single, pay-as-you-grow model for total cost of ownership savings, the company said.

Welcome to our live day-one coverage of VMware Explore 2023. Today's event, due to kick off at 9:00 PDT, will feature speeches from Raghu Raghuram, CEO at VMware, as well as VMware President Sumit Dhawan.

The keynote's theme is 'Taking a Cloud-Smart Approach to Harnessing the Power of Generative AI', with announcements expected on the headline-grabbing tech.

Hello and welcome to today's coverage. We'll be bringing you the latest keynote announcements as they are made, with events set to kick off in just a few short minutes.

And we're off, with a video montage featuring talking heads from some of the world's largest tech companies including Google, Microsoft, and Hugging Face talking about how important AI is, but also how it has to be ethical.

"For any meaningful enterprise, their data lives in all types of locations," says Rangarajan Raghuram, CEO at VMware.

"Distributed computing and multi-cloud will be at the very foundation of AI. There's no way to separate these two."

"What this is going to do in the long term is enable us to understand global scale problems in a much deeper fashion, and therefore create new solutions that we can hardly even imagine today."

Raghu Raghuram has entered the stage to hopeful music. He notes that it's been 25 years since the VMware community first came together, and has acknowledged the company's future under Broadcom's acquisition.

Time for some words from Broadcom CEO Hock Tan, who has just committed to an additional $2 billion investment in VMware, with half of this focused on R&D.

"The potential of what Broadcom and VMware can do together for customers is simply enormous," he says.

He says that the other half of the investment is to be invested into deployment of VMware solutions through VMware and partner professional services.

"We're highly confident this transaction will close within Broadcom's fiscal 2023."

Hock Tan is in the crowd, and stands up to applause as Raghuram pays tribute to him.

Now onto two of the core topics of the conference: multi-cloud and generative AI.

Starting with multi-cloud, Raghuram notes that just a few years ago very few customers were using multi-cloud. Today, he notes, 75% of customers are using two or more public clouds, alongside edge buildout and a private cloud. In recognition of this "multi-cloud journey", VMware has worked hard to offer its customers a 'cloud smart' approach.

It's not just keeping one's cloud operating or secure, Raghuram notes. Modernizing infrastructure and delivering apps efficiently have also been major victories of a proper multi-cloud approach.

Here to talk about modernization more is Sumit Dhawan, president at VMware, who says that VMware cloud foundation technologies may be the "fastest growing" cloud around right now.

There's no mystery behind this popularity, Dhawan claims.

"Simple. Lower cost, better security, higher resiliency. In fact, we did a study with some of you and over found 170% ROI in three years, and 66% reduction in network and security operations."

Quickly onto five key announcements, with just a brief joke about blackjack tables on the way.

First, vSAN Max which brings the capability of petabytes of disaggregated storage. 

Next, vSphere+ for upgrading an entire ESXi fleet from a central point. He promises VMware Cloud Foundation customers will also no longer have to do any more migrations, with "seamless upgrades" that are three times faster than earlier versions.

"Infrastructure management can sometimes feel like painting the Golden Gate Bridge; by the time you're done, you have to restart. We're changing that."

Third, NSX+ for true multi-cloud networking. First announced at last year's conference as Project Northstar, this is a long-awaited policy control tool.

"You get to define your policies once, and apply them across any cloud, which means you get deep visibility for all your networking policies in one place.

Fourth, the ability for customers to create VPCs for DevOps teams using API, "just like they're used to doing in a public cloud".

Fifth, VMware has announced improved ransomware recovery that lets customers run workloads in the public cloud while primary infrastructure is being fixed 75% faster than before.

Next up, some detail on the overhaul that VMware is announcing today for Tanzu.

Developers that use Tanzu already find they deliver projects up to 40% faster, and Dhawan states that the new additions laid out today are set to reduce developer burden and give platform engineering teams "peace of mind".

Automatically provisioned apps, that work across Kubernetes clusters, are just a taste of the improvements VMware has brought to Tanzu today. If you think you know the product, Dhawan says, think again.

For more detail on today's Tanzu announcements, read our detailed breakdown.

Next up, Anywhere Workspace. Dhawan notes that customers want apps to be available fast and problems resolved quickly.

Anywhere Workspace steps in here, Dhawan says, because it combines virtual apps, endpoint management, and digital experience management.

Dhawan calls it a "single hub" for applications, including persistent Azure Virtual Desktop.

Edge computing is fast becoming a customer demand, and VMware's next big announcement today is its Software Defined Edge.

Customers like Audi are already using VMware's edge portfolio to improve operations at such as manufacturing, Dhawan says, such as using VMware for its E-tron industrial control systems.

Today's announcement on edge also includes a commitment to managed private connectivity for enterprises, be that private 5G or integration of devices on the edge.

Dhawan welcomes Rajeev Khanna, CTO at Aon onto the stage to talk a bit about how VMware has helped his firm in their years-long partnership.

Generative AI is sparking imaginative new solutions, says Khanna, who expresses hope that the future is bright for the technology.

"We want that openness, we want the choice to run these workloads" he says in reference to new demand for AI models, and suggests that VMware has a core role to play in this space in the coming years.

Raghuram back on stage now to talk about generative AI in more detail.

"The promise is, there is potentially 100x improvement in the economics of creativity, of creating content of all types," he says, linking this into how it will improve application development too. 

The technology also enables applications that were previously thought impossible through natural language input, he states.

Amy Olli, VMware general counsel has just walked onto stage mid-speech.

"I heard you talking about legal implications and I thought I'd just jump on stage," she quips.

On a serious note, Olli is laying out the legal complications with AI including IP theft, data protection, and privacy.

VMware AI Labs was formed to tackle these issues, Raghuram says. And apparently it has a solution: private AI.

"Ask yourself the question: where is your private data?" he asks. This isn't a question with a simple answer as data is generated second-by-second at the edge.

"Instead of taking all your data to the cloud, you've got to take your AI and your compute to where the data is."

VMware has spent months working on the solution to this, and Raghuram says they've now cracked it in partnership with Nvidia.

He's announced VMware Private AI Foundation with Nvidia, and Jensen Huang, CEO of Nvidia has joined Raghuram to reveal more.

"VMware is the operating system of how the world's companies are run. Today we're reinventing enterprise computing after a quarter of a century

"Instead of virtualizing applications to run on GPUs, we virtualize the GPU. We made it possible for VMware to run bare metal performance with all of its security and all of its manageability across multiple CPUs."

Together, the companies are promising the first-ever private AI at scale, secured within a company's multi-cloud estate.

Nvidia has leveraged the help of Dell, Lenovo, HPE, to produce a suite of around 100 servers that will be dedicated for VMware Private AI.

They're available starting this month, featuring brand new GPUs tailored specifically for large language models (LLMs).

This is a reference to the Nvidia L40S, which leverages up to 1.7x more performance for generative AI training than the Nvidia A100. For reference, the A100 is what the original ChatGPT model was partly trained on.

With frameworks such as Nvidia AI Workbench and NeMo, the firm will provide customers with the ability to pull together data for AI in the cloud and fine-tune it for specific use cases.

Confused? "It's easy peasy" Huang says, with the confidence of the CEO of oen of the world's largest AI hardware provider.

To emphasize the importance of the moment, Huang has promised five lucky winners within the audience a 4090 founders edition GPU signed by both him and Raghuram.

Raghuram announces that there's a whole host of partners waiting to collaborate on private AI with VMware including Hugging Face, Intel, and Anyscale.

Here to talk about more AI announcements is Amanda Blevins, VP and CTO, Americas at VMware. She begins by highlighting the importance of the audience - without them, there would be no AI users.

Intelligent Assist for VMware Tanzu is key to the company's AI strategy, she says, and the firm is confident it will change its customers' lives for the better. The system can provide intelligent recommendations to users which can be implemented "at the click of a button".

"Our vision is to help all IT operators through Intelligent Assist," she says.

"For all of you network engineers and security analysts, I think you'll really dig NSX plus Intelligent Assist. Instead of taking multiple days to find attacks and malicious in your environment, we can help you take it down to minutes."

With a wrap-up of the biggest announcements of the day, she brings the keynote to a close. A final word to those seeking the prize GPU: it's only available to those who can physically attend two of the solution keynotes in addition to today's - sorry remote attendees!

And with that, the keynote comes to a close. It's been a blur, with announcement after key announcement, but a core focus on the marrying of generative AI and multi-cloud.

VMware has announced a series of expansions for its Tanzu platform, with the aim of accelerating application development and assisting customers with intelligent insight.

Its application platform Tanzu Hub will now act as a converged platform for multi-cloud environments, providing customers with oversight of all their applications regardless of where they are located through an API-based data fabric and artificial intelligence (AI).

The firm also announced a number of updates to Tanzu Application Platform, its end-to-end platform for the building and deployment of software, and the release of the brand-new Tanzu Intelligent Services for processing data and troubleshooting.

First and foremost among the new features for Tanzu Application Platform is the Application Engine, a runtime that brings container networking and container computing together and can scale and perform processes such as mutual authentication automatically.

Purnima Padmanabhan, SVP and GM of Modern Apps & Management Business Group at VMware, said that the new updates for the platform would help firms to “develop the golden path to production”.

Through Tanzu Intelligent Services, the firm businesses will also be able to derive insights from their data using machine learning (ML).

This comes bundled with features such as ML forecasting for cloud costs, currently in beta, as well as automatic aggregation of applications logs, metrics, and other data through intelligent automation and a conversational AI interface.

The hope is that through Tanzu Intelligent services, customers will be able to troubleshoot easily across their cloud environment. In addition to its investigatory abilities, it also comes with a function to enforce policy across environments, as well as one for app migration.

VMware underlined the announcement of Intelligent Assist, its new chatbot based in generative AI  that allows customers to interact with their data using natural language processing (NLP). It is hoped it will allow customers to get to the single source of truth faster and more efficiently.

The intent for Tanzu Hub is to allow customers to operate applications at scale on any cloud or environment, including Kubernetes, and also give businesses the freedom to update underlying infrastructure without any downtime.

“Tanzu Application Platform is for building modern applications - today that’s Kubernetes and over time it’ll be any modern applications with an expanded application runtime,” said Padmanabhan.

Additional updates for Tanzu Application Platform will include an improved Developer Portal, which comes with support for open source plugins, as well as lifecycle management for Azure Kubernetes Service (AKS), and support for .NET Spring Framework 6 and Spring Boot 3. 

“The Hub itself is able to provide information and data about both your brownfield environment and existing apps, all types of apps whether they are modern, at the edge, monolithic, distributed - it doesn’t matter,” Padmanabhan added.

“By bringing all that application and environment information together, because as I mentioned it’s taking the power of the entire Aria management portfolio, you can analyze all your applications, you do the cost performance and security management for those applications, and you can do remediation for those applications. Over time you can also transform and modernize them.”

Tanzu Hub is grounded in the same knowledge graph as VMware Aria, which was announced in August 2022 at VMware Explore US. This provides near real-time access to data across a multi-cloud platform.

Through the updates, VMware has aimed to improve the software agility of its customers. The firm said that 91% of CIOs it speaks to have identified app strategy as their top priority, encompassing modernization, migration, and speed to market.

Many companies have grasped modernization with both hands, moving to technology such as multi-cloud architecture, Kubernetes, and a wide range of open-source tools. 

At VMware Explore Europe 2022 VMware vowed to fight ‘cloud chaos’, in which businesses become overwhelmed by multi-cloud environments and siloed workloads that have arisen as a result of this mass migration and modernization.

Tanzu Hub is a fully federated platform, which will enable customers to plug in information from third-party solutions, and VMware described it as a unified platform for both cloud ops and platform engineering.

Broadcom’s multi-billion dollar takeover of VMware has cleared another hurdle, having been given the nod by the UK Competition and Markets Authority (CMA) following an in-depth investigation.

The clearance follows approval in the EU, as well as Australia, Brazil, Canada, Israel, South Africa, and Taiwan. The company also stated it had foreign investment control clearance in all necessary jurisdictions.

The deal is valued at $69 billion and consists of $61 billion in equity and the assumption of $8 billion of debt, based on the price of Broadcom’s stock as of May 25, 2022. It is also the largest acquisition investigated by the CMA.

The authority opted to refer the deal to a Phase 2 inquiry, having identified competition concerns in an initial Phase 1 investigation that it felt warranted a more detailed review.

These concerns centered on the merged company being able to prevent products from Broadcoms’ competitors from working correctly with VMware’s server virtualization software. Another concern was if the deal might harm innovation as the competition withheld commercially sensitive information from a potential competitor.

In both cases, the review concluded that - on balance - there wasn’t an issue and “the deal does not substantially reduce competition”.

The review reported that the financial cost in terms of lost business outweighed the benefit to Broadcom and VMware of making rival products work less well. The potential for reduced innovation was also unlikely to be a concern since any information shared with VMware was unlikely to occur at a point when Broadcom could commercially benefit from it.

However, there remains work to do in closing the deal. Broadcom described its progress toward securing regulatory approval in other regions as “advanced” and said it believed that all remaining approvals would have been secured by October 30, 2023.

According to Broadcom: "In the U.S., the Hart-Scott-Rodino pre-merger waiting periods have expired, and there is no legal impediment to closing under U.S. merger regulations."

A more significant obstacle is possible, however, in the form of authorities within China.

Broadcom generates enough revenue from China to trigger a review from regulators. Last week, Intel called off its $5.4 billion Tower Semiconductor deal after failing to secure approval from Chinese regulators. 

However, while the Intel deal was all about semiconductors, Broadcom’s is outside of that industry. China’s regulatory authorities have also approved other non-semiconductor acquisitions in recent months, an example being Microsoft’s acquisition of Activision.

This means that there remains every chance that Broadcom’s acquisition of VMware could be approved by Chinese regulators and the company’s October 30 target for receiving all remaining approvals achieved.

Security experts have issued a warning over a new ransomware as a service (RaaS) gang that has been observed targeting VMware ESXi servers.  

Researchers at CrowdStrike said the new group, dubbed ‘MichaelKors’, was first identified operating in the wild in April this year. 

The group was observed providing affiliate groups with ransomware binaries specifically targeting Windows and ESXi/Linux systems. 

The discovery comes amid a period of rising concern over threat actors increasingly targeting ESXi interfaces due to a pervasive lack of security tools, researchers said. 

“More and more threat actors are recognizing that the lack of security tools, lack of adequate network segmentation of ESXi interfaces, and in-the-wild vulnerabilities for ESXi create a target-rich environment,” they said. 

CrowdStrike said it has “increasingly observed big game hunting threat actors” deploying Linux versions of ransomware tools to target VMware’s ESXi vSphere hypervisors. 

This trend escalated significantly in the first quarter of 2023, the company added.

“RaaS platforms including ALPHV, LockBit and Defray – tracked by CrowdStrike Intelligence as ALPHA SPIDER, BITWISE SPIDER and SPRITE SPIDER, respectively – have been leveraged to target ESXi,” researchers at the firm said. 

ESXi vulnerabilities

According to CrowdStrike, the emergence of an aggressive new RaaS group could pose significant risks for organizations leveraging VMware’s hypervisor. 

ESXi by design, researchers said, “does not support third-party agents or antivirus software and VMware states in its documentation that antivirus software is not required”. 

This inherent vulnerability, combined with the popularity of ESXi, makes it a “highly attractive target” for threat actors. 

ESXi is a Type-1 hypervisor developed by VMware that is used extensively by businesses worldwide to run and manage virtual machines (VMs).

“VMware virtual infrastructure products are highly attractive targets for attackers due to the predominance of this vendor in the virtualization field and because VMware’s product line is often a crucial component of an organization's IT infrastructure virtualization and management system,” researchers said. 

ESXIArgs concerns

Earlier this year, organizations globally scrambled to mitigate risks associated with ESXi after vulnerabilities were actively exploited by threat actors. 

In February, the French Computer Emergency Response Team (CERT-FR) issued a warning over the ESXiArgs ransomware campaign. 

Tracked as CVE-2021-21974, the security vulnerability was caused by a heap overflow issue in the OpenSLP service, and enabled an attacker to remotely execute arbitrary code. 

Threat actors were able to target unpatched ESXi servers due to a two-year-old remote code execution (RCE) vulnerability. 

Within days of the disclosure from CERT-FR, thousands of organizations spanning both the public and private sectors were impacted by the vulnerability. 

Data compiled by Censys and Shodan revealed that, within two days of the disclosure, more than 2,800 organizations had been affected and were experiencing an onslaught of attacks. 

Hundreds of organisations worldwide have been targeted by a hacking campaign exploiting VMware’s ESXi servers to deploy the new ESXiArgs ransomware variant.

French and Italian cyber security agencies issued an urgent warning last week after attackers were found to be actively targeting servers left unpatched against a two-year-old remote code execution (RCE) vulnerability.

Tracked as CVE-2021-21974, the security flaw is caused by a heap overflow issue in the OpenSLP service and can enable an attacker to remotely execute arbitrary code.

VMware confirmed it is aware of exploit reports, adding that it issued a patch in February 2021 upon discovery of the vulnerability. However, the vendor urged customers to immediately apply the patch if the ESXi hypervisor has not yet been updated.

Widespread exploitation

Analysis from ransomware monitoring service Darkfeed found that the spread of the ESXiArgs ransomware is “extensive” and could have affected at least 327 organisations worldwide.

“The most targeted system is from France on OVH cloud and Hetzner hosting,” the service said on Twitter. “But they have hit other hosting and cloud companies around that world.”

In a statement on 3 February, OVH confirmed it was responding to the wave of attacks, adding that its managed cloud service had not been impacted.

“A wave of attacks is currently targeting ESXi servers,” the company said. “No OVHcloud managed services are impacted by this attack however, since a lot of customers are using this operating system on their own servers, we provide this post as a reference in support to help them in their remediation.”

Royal ransomware

Initial speculation from OVH suggested that this campaign was related to the new Nevada ransomware strain, which first emerged in December last year.

However, reports over the weekend pointed towards the Royal Ransomware strain as a key driver behind the wave of attacks against ESXi virtual machines.

Royal Ransomware started launching attacks in early 2022, with the group made up of previous veterans of the infamous Conti ransomware gang.

The group has accelerated operations in recent months, focusing attacks on US-based healthcare organisations and specifically targeting Linux systems more recently.

Stefan van der Wal, consulting solutions engineer at Barracuda Networks said that the current campaign highlights the critical risk for organisations failing to update software.

“The reported widespread ransomware attacks against unpatched VMware ESXi systems in Europe and elsewhere appear to have exploited a vulnerability for which a patch was made available in 2021,” he said.

“This highlights how important it is to update key software infrastructure systems as quickly as possible.

“It isn’t always easy for organisations to update software. In the case of this patch, for example, organisations need to disable temporarily essential parts of their IT infrastructure. But it is far better to face that than to be hit by a potentially damaging attack.”

Van der Wal added that virtual machines are becoming an increasingly attractive target for ransomware gangs due to their use in running business-critical services and functions.

“Securing virtual infrastructure is vital,” he said. “It is particularly important to ensure that access to a virtual system’s management console is secured and can’t be easily accessed through a compromised account on the corporate network, for example.”

VMware will be in a "fine position" should its proposed acquisition by Broadcom fall through, according to one industry analyst.

VMware's portfolio and current business strategy has put it in a strong position to attract other prospective buyers, according to Bola Rotibi, chief of enterprise research at CCS Insight, speaking to IT Pro.

“Certainly, it would signify that it was still potentially on the market for being sold, but VMware can certainly run on its own,” she explained.

The comments follow news that chip giant Broadcom could face an EU investigation into its proposed acquisition of VMware, putting the future of the cloud giant in uncertain waters.

Reuters cited people close to the situation who stated that EU regulators could open a full-scale investigation into Broadcom’s $61 billion deal, to determine whether it would constitute an unfair consolidation of power in the sector.

“If you think about VMware Explore, it showed good strategy and a good portfolio," added Rotibi. "VMware has found a way to align its virtualisation market share with supplying its client base with multi-cloud support, and is also doing a lot around providing sovereign cloud solutions, with strong operational support for multi-cloud services and strong partnerships.”

“I would expect all the authorities to do their due diligence, and to make sure that this is a deal that makes sense. Personally, I think it will go through, because VMware is not the only multi-cloud player in the market and Broadcom is not different from the other large players that bring together software, hardware and semiconductors.”

The deal is hoped to improve Broadcom’s standing in the software market, but faces a number of regulatory hurdles before VMware can join the former’s subsidiaries, which includes Gen Digital (formerly Symantec and NortonLifeLock).

Regulators in Canada, South Africa, and Brazil have already given the deal their seal of approval, but those in the US, EU, and UK have not yet made their decisions public. In the UK, the Competition and Markets Authority is in the process of investigating the deal, and has invited interested parties to offer comments with a deadline of 6 December. No date has been set for its phase 1 decision.

Talk of the deal dominated the conference on day one of this year’s VMware Explore Europe, the company’s first annual conference in the region since becoming an independent entity.

Raghu Raghuram, CEO at VMware, addressed the deal at the very beginning of his keynote, noting that “once the acquisition is completed, VMware will become the software arm of Broadcom”.

Broadcom has made efforts to allay fears that VMware could face cuts as part of the deal, or change for the worse under Broadcom management. Hock Tan, president and CEO at Broadcom, denied rumours that Broadcom would seek to raise VMware’s prices as a result of the deal in a November blog post.

“VMware has a robust partner ecosystem that we will build upon to help us serve even the smallest companies. In short, we plan to take a “no customer left behind” approach,” Tan wrote.

“As workloads continue to grow rapidly across environments and multi-cloud options expand, a combined Broadcom and VMware will be focused on giving customers greater choice and flexibility over where and how they run their critical operations.

"We will invest in and innovate VMware’s products to create the next generation of technology that solves customers’ most complex IT challenges.”

When VMware left Dell’s control in 2021, much was made of its potential as an independent entity, and its strong standing as a leader in the sector, but just six months after this, Broadcom formally confirmed it would acquire VMware for $61 billion.

“Today’s move will strengthen our mission to be the Switzerland of the cloud industry, uniquely positioned to provide our customers with the best combination of options as we grow our robust ecosystem of partners,” wrote Raghuram at the time.

Regulatory investigations have put into question, or directly curtailed, several high-profile deals in the past year. In January, it was announced that Nvidia would walk away from its proposed acquisition of Arm, following moves by the Federal Trade Commission (FTC) to block the deal, and longstanding concerns over the deal in the UK, specifically aimed at what the deal might mean for domestic jobs.

IT Pro has approached Broadcom for comment.

In order to future-proof your business, an essential part of longer term success today is in embracing the cloud. And what will help you stay ahead of the competition is a cloud strategy that’s agile enough to meet ever-changing needs.

This whitepaper shares expert advice on how to build your multi-cloud strategy, from assessing needs to evaluating ops, and considerations for both private and public cloud.

Download now to learn how to make the most of multi-cloud without the complex workflows, and discover the solutions offered by VMware and CDW that can meet your organisation’s needs today, and in the future.

Provided by

The central theme running through VMware Explore Europe 2022 was delivering 'cloud smart' by fighting ‘cloud chaos’. Talk to someone from the firm, and they’ll tell you this is simply the next step in the company’s evolution.

In the seemingly distant past, companies contended with procurement sprawl; after this, it was server sprawl. Today, the company seeks to tackle the burden of cloud silos, and its big bet on managing this crucial struggle is as much a call for a cultural shift as it is for the adoption of its trademark solutions, with a greater emphasis on data insights to drive strategy.

For every solution, there's a problem

The mission permeates any number of VMware’s big announcements, from advances in its Sovereign Cloud — a headache especially for European customers — to the challenge businesses have in lowering energy costs. A cultural shift is also leaking in through the firm's expansion of its hybrid cloud partnership with HPE, with a 'pay-as-you-go' unified cloud solution available through a consumption model. It's the kind of flexibility that VMware promises, and the move to consumption echoes the intelligent automation firm Laiye's predictions that the subscription model has five years left.

As far as sustainability goes, the company hopes to empower customers to measure their energy consumption through the new Green Score feature in Aria Cloud, and includes its use of machine learning (ML) at data centres to optimise workload in a list of measures that have helped it save around 1.2 billion tons of carbon since 2002.

On several metrics, VMware appears to be indicating the ball is firmly in the court of its customers. There’s a tool for (almost) every problem, but, of course, these can be only solved if there’s an equal desire among users to fix these problems in the first place.

Framed in this way, VMware’s calls for improvements in areas such as sustainability at least appear destined for success. Evidence repeatedly shows that many companies in the sector consider reducing their energy consumption a top priority, such as recent Gartner research which showed sustainability is the key strategic trend for 2023. The drive comes amidst VMware’s prediction of a 200% increase in energy usage in the near future, accelerated by the adoption of the likes of 5G.

Other VMware solutions such as VMware Carbon Black XDR, which the company has unveiled to fight the threat of lateral attacks facilitated by an overbearing focus on endpoint security over observability between silos, seem to be progressing slower than desired.

Joe Baguely tells IT Pro that lateral security, effectively the same concept as ‘east-west’ security, is a problem over which VMware has been banging the drum for more than a decade. The failure of the sector to progress much in this space in the years since its

The problem with having the solution to a problem that your customers don’t see as a problem is the struggle can’t be solved through the quality of a product. Let there be no doubt: the overriding sense among customers at VMware Explore Europe was the company is always willing to address their concerns. But the success of many new products may hinge on communication. As VMware's VP of marketing tells IT Pro, the company, internally, is extremely pleased with the work its product teams have done, with success now hinging on convincing customers they have problems that need to be addressed.

Change in the name, change in the game

A much-repeated phrase throughout the conference was “we’ve changed”, mostly delivered light-heartedly in reference to the conference's branding change from VMworld to VMware Explore. Delving beneath the surface, though, it’s clear there's been a more profound shift in the company’s strategy.

“Ten years ago, we were taught that VMware’s focus is, we abstract, pull, and automate,” Ed Hoppitt, senior director apps and cloud platforms at VMware, tells IT Pro. “So we abstract away from physical hardware, we pull the abstracted resources together, we automate their deployment. Nothing’s really changed. We're abstracting from across multiple clouds, as opposed to multiple servers, we're able to pull the resources of the servers, and the XPUs, and the chassis, and we're able to automate their deployment.

“I'll be honest, sending the ESX wasn't hard, right? It was a mono-product company, and it was ‘for every dollar you invest with us, you’re going to save ten.’ What’s happened is our portfolio has got bigger, and our nuanced relationship with customers has changed. We're now getting to spend much more time with customers, understanding our customers much more intimately.”

Hoppitt directly aligned adopting a software as a service (SasS) model with allowing the company to more directly cater to customer needs. There's no doubt that, among customers, the mood is high but, remarkably, this buoyancy is also mirrored externally.

“I think overall, VMware’s portfolio is now much better segmented and over the course of this year they've done a lot to reposition the products into much more sensible settings and categories,” says Bola Rotibi, chief of enterprise research at CCS Insight, in conversation with IT Pro. “I think it's a much more structured portfolio and I think, actually, it does address a lot of the issues that organisations, especially particular enterprise organisations across the market landscape, are concerning themselves with.”

What does the Broadcom acquisition mean for VMware's future?

Infrastructure giant Broadcom’s $61 billion acquisition of VMware has been approved by shareholders, and news of this broke on the first proper day of VMware Explore Europe. The deal had been confirmed by both companies in May, with questions raised around what this meant for company strategy going forward.

Any whispers of the deal on the conference floor were matched by an immediate, if brief, reference to the acquisition at the start of the keynote by Raghu Raghuram, VMware CEO: “Once the acquisition is completed, VMware will become the software arm of Broadcom.”

For the assembled press, this opened the sluice gates for a series of Broadcom questions at the press conference, all directed at Raghuram. “It’s up to Broadcom to structure its company once closed,” replied Raghuram.

“Ultimately, they will have the final word on it. What [Tan Hock Eng, CEO at Broadcom] said at the time the acquisition was announced, is what I spoke about today, which is Broadcom will broadly have two businesses. A microconductor business, which they historically have, and a software business, and all the software businesses will be under the VMware brand.”

Having broken away from Dell in 2021, Raghuram said VMware was uniquely positioned to become “the Switzerland of the cloud industry,” maintaining an independent and close relationship with its customers and partners. Now, after around a year, VMware is falling back into the ownership of another company; how ‘hands-off’ Broadcom will be with the company remains to be seen.

VMware becoming a brand that encompasses all Broadcom software offerings could make or break the company. If it’s simply the sum of its parts, a provider of siloed tools for business use cases, the deal should matter little to customers and partners alike. But, having fought so hard to ‘change’, and acquire the positive reputation it enjoys today, VMware may well fight to keep its brand from diluting as it takes charge of assets like Symantec and CA.

In the same way that its solutions rely on communication as much as technical ability these days, its commitment to maintaining customer relationships and holding the lead on clear product messaging will be the real measure of its success in the years to come.

VMware has revealed an addition to its network detection and visibility solutions in the form of Carbon Black XDR, seeking to address the very significant threat posed by lateral attacks and empower companies to combat threat actors that have already breached their networks.

Whereas endpoint detection and response (EDR) reacts to endpoint data, extended detection and response attempts to provide environment-wide, comprehensive visibility on threats. In this way, VMware Carbon Black XDR adds to and extends the capabilities of VMware Carbon Black Enterprise, the threat hunting and response solution already available for VMware customers.

VMware identifies this as crucial in drawing attention to the danger of threat actors performing lateral attacks once gaining access to a system, with historical focus having been placed almost exclusively on endpoint tools to prevent malicious access altogether.

The service leverages data within VMware Contexa, the firm’s threat intelligence solution that provides observability across VMware’s network, as well as endpoint and user technologies. The company claims it processes over 1.5 trillion endpoint events daily, using machine learning (ML) to contextualise this information in parallel with the input of more than 500 VMware Threat Analysis Unit partners and researchers. VMware Carbon Black XDR can then use this data to prompt action by security teams, and inform policy changes.

In August, VMware research suggested cyber attacks were on the rise following Russia's invasion of Ukraine, with 25% of attacks seeing lateral movement by attackers once systems had been compromised.

"Lateral security is the new battleground," said Tom Gillis, SVP and general manager, networking and advanced security business group at VMware.

“By bringing VMware Carbon Black XDR to market, we’re improving threat detection and prevention across endpoints and networks to address the need from our customers to limit the lateral movement of attackers inside their environment.

"Our XDR solution is not replacing SIEM, rather it’s helping to paint a broader picture of the threat landscape for customers. We are correlating high-fidelity, process-level data from the endpoint with packet-level data on the network to create super high-fidelity and actionable alerts that can also be fed into a larger SIEM. That data is pulled from VMware Contexa, our threat intelligence cloud that combines the telemetry of Carbon Black and NSX."

VMware has been quick to note the uptake in demand for XDR solutions within the current threat environment, citing a Forrester study it commissioned which indicated that although 75% of responding organisations have not implemented XDR, 27% are planning to in the next 12 months. Data from the same study suggested that ROI increased following early adoption of the technology, bringing the boons of automation and adding another feather to the cap of existing security stacks.

Carbon Black was acquired by VMware in 2019, in the interest of boosting security oversight across VMware’s cloud offerings. Since then, its offerings have been expanded and are now part of VMware’s array of network and endpoint security options. These include Contexa and the upcoming Project Northstar, a SaaS-based tool for network security for applying multi-cloud security policies through a central cloud console, which is currently in tech preview.

Joe Baguely, VP & CTO EMEA at VMware, spoke to IT Pro about how VMware Carbon Black XDR expands upon past efforts by VMware:

"We've actually been talking about these threats for over 10 years. When we first acquired Nicira, which became NSX, we talked about east to west security and what we're talking about now with natural security is pretty much the same thing. But what we're doing in that space is when we talk about it back in the past, we were literally introducing the concept of having micro firewalls per workload. But it was pretty basic, pretty manual.

"What we're doing with Carbon Black and the XDR technologies and EDR, is we're making that much more intelligent. We're bringing artificial intelligence (AI) and ML to that. And we're bringing all the intelligence we've got around threat analysis to what's going on in the data centre, to make it much more responsive."

VMware’s NSX security solutions aim to provide consistent, zero trust, multi-cloud security policies alongside granular protection such as network segmentation. The firm also states that NSX is uniquely able to combat lateral attacks, as it sits alongside a hypervisor to protect individual virtual machines within a VMware vSphere environment, and alongside Kubernetes to protect native clouds.

VMware Carbon Black XDR is available for certain customers in early access, with the security specialist team handling sign up requests.

Carbon Black in action

"Carbon black is an absolute godsend for us," said Ed Higgs, group director of IT Shared Services at Rentokil Initial, speaking to IT Pro.

"We're very acquisitive. We acquire just over one company a week and we've just done one for $6.1 billion - we just acquired Terminix in the US. It’s massive for us, and obviously all those acquisitions bring relative complexities, but whenever we've got an acquisition, the first thing they do is install Carbon Black, because that gives us visibility from day one."

Referring to the threat posed by lateral security, Higgs praised Carbon Black for the security insight it provides:

"We've been pretty good over years in managing the perimeter," added Higgs. "We pay companies, like everyone else, to hack us and see where they get and, of course, they're still finding things. When they first started doing it, there were massive gaping holes, and over the years we’ve matured and matured.

"Carbon Black and NSX have significantly reduced [a threat actor's] capability to do anything - because as soon as anyone elevates a role, on any of our systems, we immediately get a notification and they can go on and delete the account, segregate the environment, whatever they need to do. The last time we paid someone to hack into our systems, we had to tell the [Carbon Black team] to ignore the test, because we don't want them to stop the testers straight away, otherwise they wouldn't get to anything else that they might find."

Equinix and VMware have announced VMware Cloud on Equinix Metal, a new distributed cloud service that combines VMware’s cloud infrastructure-as-a-service with Equinix’s Bare Metal-as-a-service.

The offering has been designed to extend customers’ cloud environments into distributed metro locations to meet business-critical demands at the edge, while also enabling them to preserve the integrity of enterprise workloads.

VMware Cloud on Equinix Metal targets distributed cloud use cases, including smart cities, video analytics, game development, real-time financial market trading, retail POS, as well as various IoT and ML/Inference uses.

The service combines VMware Cloud’s multi-cloud infrastructure and Equinix Metal, an automated bare metal and interconnection offering that is delivered as-a-service across Equinix’s global International Business Exchange (IBX) footprint. Users will gain private, low-latency access to both private and public cloud services - as well as thousands of IT and network providers - via Equinix Fabric interconnection.

“We are pleased to partner with VMware to provide an on-demand, dedicated cloud infrastructure solution that can be deployed globally,” said Zachary Smith, global head of Edge Infrastructure Services at Equinix. “Customers benefit from secure connections to their critical private or on-prem environments and also to the thousands of clouds, networks and other ecosystem participants that come together at Equinix.”

The collaboration builds on Equinix and VMware’s existing long-standing relationship, which has seen the pair deliver multi-cloud infrastructure solutions together for almost a decade.

Narayan Bharadwaj, vice president of Cloud Solutions at VMware, said businesses across industries are now “seeking to become cloud smart by matching enterprise application needs to the best cloud environments”.

“This approach will enable them to benefit from high performance and consistent infrastructure with low TCO,” he explained. “VMware and Equinix are uniquely positioned to co-innovate on a distributed cloud service that extends VMware Cloud to new locations to provide application choice and flexibility and accelerate cloud transformation for all enterprises.”

Dave McCarthy, research vice president of Cloud and Edge Infrastructure Services at IDC, said customers have so far lacked a suitable cloud option that combines on-premises security and control with high performance, data locality, and low overall TCO.

“For mission-critical applications that rely on low latency and high-performance network bandwidth, the default has been to retain workloads on-premises or perform real-time needs, such as data processing, at branch office or metro locations,” he said.

“With their combined strengths, Equinix and VMware are well positioned to deliver a distributed cloud service that will address the demands of enterprise applications where latency, performance, security, and data locality are key drivers.”

Customers will be able to purchase the VMware Cloud software as a service from VMware, and the Bare Metal as a Service capacity from Equinix.