More of the private cloud is becoming a shared platform for applications, models, and agents. The useful question is what that changes for the people who build and operate it.
Explore connected a broader Private AI Cloud strategy with concrete platform releases. This guide brings together the major announcements and published VCF 9.1.1 changes, with their technical roles, availability, and the decisions they create for an infrastructure team.
VCF 9.1.1 is generally available. Several prominently announced AI and security enhancements remain future capabilities or previews. Those distinctions matter when an announcement becomes an architecture decision.
AI INFRASTRUCTURE
AI Factory & token economics
AI Factory is the infrastructure and operating foundation within the broader VMware Private AI Cloud portfolio. Token economics describes the cost of delivering useful AI output.
What was announced
AI Factory combines VCF, private AI services, validated hardware, and automation spanning provisioning through operations. Broadcom announced MetalSoft integration for heterogeneous server provisioning and repaving, plus AMD Instinct and ROCm collaboration. OEM participation includes Cisco, Dell, Lenovo, and Supermicro. Treat specific partner integrations as announced work until the applicable configuration and delivery status are confirmed.
Why shared infrastructure matters
GPU pooling and model sharing can reduce duplicated model deployments. The model gallery supports inference and retrieval-augmented generation workflows, with visibility into token throughput, response latency, and resource use. Broadcom describes faster deployment as an intended benefit; the actual result depends on hardware readiness, networking, data, and operating procedures.
How to evaluate token economics
A private deployment still has a cost per result even when the model endpoint has no per-token bill. For a useful comparison, include hardware allocation, software and model licenses, power, support, and operations. Compare the same workload, model quality, concurrency, and response target across options.
| MEASURE | WHY IT MATTERS |
|---|---|
| Cost per successful task | Counts retries and failed attempts instead of rewarding cheap but unusable answers. |
| Tokens per task and latency | Exposes long context, repeated reasoning, and slow completion. |
| GPU utilization and peak capacity | Shows whether shared capacity can serve real demand without excessive idle headroom. |
Where to start: benchmark one repeatable business task. Agree on answer quality, completion rate, peak concurrency, and a monthly cost boundary before selecting infrastructure. These are evaluation criteria, not promised savings.
IDENTITY AND RUNTIME CONTROL
AgentMinder
Generally available at Explore. Its role is to govern what an agent may do when it reaches enterprise tools and resources.
From identity to permission for each action
AgentMinder binds an agent identity to a declared mission, permitted intent, approved tools, and authorized resources. At runtime, its gateway checks tokens and evaluates the current context before allowing a tool invocation to reach an authorized backend. This addresses the gap between granting an agent access once and checking each action as the task evolves.
Evidence and deployment
OpenTelemetry-based tracing records sessions and actions for audit and investigation. AgentMinder integrates with existing authorization systems through AuthZEN and can run beside models on premises, in private cloud, or in public cloud environments. Supported deployment approaches include VKS and other standards-based Kubernetes platforms. It is a distinct solution; VCF ownership alone should not be interpreted as entitlement.
An example to evaluate with your team
Consider a service-desk agent asked to investigate a failed application. A useful policy could permit reading approved logs and checking service health, while denying production configuration changes. A restart could require a separate approval. Test allowed calls, denied calls, expired identity, and missing policy context, then check that the resulting evidence explains the decision.
| DESIGN QUESTION | EVIDENCE TO REQUEST |
|---|---|
| What authority does the agent have? | Mission, tool inventory, resource scope, and owner. |
| Can the control be bypassed? | A test showing tools cannot be reached through an ungoverned path. |
| What happens during failure? | Documented behavior for unavailable policy services, logging, and credential expiry. |
Where to start: bring identity, security, and application owners into the same review. Validate controls on one low-risk workflow before extending agent authority.
MODEL CHOICE AND CONSUMPTION
Models & Private AI Services
Separate the model you want to run from the services that deploy it, share it, and govern its consumption.
Expanded model choice
Broadcom announced validation of NVIDIA Nemotron 3, Google Gemma 4, NEC cotomi, Alibaba Qwen 3.7-Max, and Z.ai GLM 5.2 on VCF. Its release describes a vLLM-based runtime supporting more than 150 open-source models. Validation establishes a deployment option; it does not by itself settle model licensing, hardware sizing, data suitability, or support for every model variant.
Delivered now and planned next
| CAPABILITY | STATUS AND BEHAVIOR |
|---|---|
| Multi-tenant model sharing | GA with VCF 9.1.1. Separate tenant namespaces consume a shared Model Runtime, reducing redundant model copies. |
| VCF AI Gateway | Future release. Planned routing across local and cloud models, user token limits, and application authorization using OIDC. |
| Secure Agent Framework | Future release. Planned isolated execution for generated code and a harness controlling tools, communication, and output validation. |
| Model autoscaling | Future release. Planned expansion and contraction using latency and session thresholds. |
Keep similarly named controls distinct
The planned VCF AI Gateway focuses on model consumption. AgentMinder provides agent identity and runtime action control. Tanzu also describes gateway and agent-governance capabilities. Their names overlap, but they have different product scopes and release commitments. Map each control to the actual product and version in the proposed architecture.
What to test
Choose a model using a small, representative evaluation set with expected answers and known failure cases. Include authorization boundaries, sensitive-data handling, peak load, and rollback to the previous model version. Record model, runtime, prompt, and retrieval configuration so results can be reproduced.
Where to start: nominate the first model owner and consuming application. Establish a quality baseline before optimizing token volume or changing accelerators.
DAY TWO OPERATIONS
VCF 9.1.1 operations
The September 3 release adds practical capabilities for administrators, including teams whose immediate priorities remain reliability and fleet management.
| CHANGE | WHAT IS NEW |
|---|---|
| AI Assistant | Optional local-model integration in VCF Operations for conversational diagnostics and management-pack creation; supports Private AI Services or a private Gemini instance. |
| Kubernetes visibility | OpenTelemetry-based observability improves visibility across Kubernetes and infrastructure. |
| Directory access | Active Directory and OpenLDAP group membership can be evaluated at login instead of pre-provisioning every user. |
| Passwords | Expanded application-account coverage includes vCenter, Automation, fleet management, and network collectors. |
| Certificates | Expanded lifecycle coverage includes NSX Edges, Supervisors, License Servers, cloud proxies, and network collectors; non-TLS certificates are supported. |
| Configuration APIs | VMware Salt for VCF Component APIs expose more than 300 configuration settings. |
| Compact deployment | A two-node HA form factor reduces required CPU and memory by up to 40%, according to Broadcom; brownfield vCenter import avoids portgroup reconfiguration. |
| Licensing operations | IPv6 license-server support, health dashboards, and licensing alerts. |
Translate the release into operating value
Select a recurring incident, an expiring-certificate workflow, or a configuration task with measurable manual effort. Record the current steps, ownership, time spent, and failure modes. Then evaluate the matching capability using the same scenario. A compact form factor is a sizing option to assess against your environment, not an automatic reduction for every existing deployment.
For the AI Assistant, include the model endpoint, data access, response quality, and operator review in the assessment. For identity changes, test group removal and temporary access. For certificate workflows, include both renewal and failure notification. For Salt APIs, prove detection and remediation on a narrowly scoped setting before expanding automation.
Where to start: produce a short operational acceptance checklist with the platform team and select the first capability to validate.
VCF 9.1.1 PLATFORM SERVICES
Networking, Kubernetes & storage
The release also changes how infrastructure and platform teams connect, deliver, and operate services.
EVPN connectivity
VCF 9.1.1 optimizes east-west paths with direct VXLAN tunnels between transit gateways and physical leaf switches. EVPN VXLAN distributed connectivity also gains NAT, NSX and Avi load balancing, and DHCP relay services. Review the exact topology and service placement before assuming an existing fabric design will benefit.
VKS 3.7 add-on management
The add-on management framework defines support ownership for Kubernetes ecosystem tools and makes their lifecycle easier to manage. The useful follow-up is an inventory of required add-ons, versions, upgrade order, and the support party for each integration.
Native GitOps integration in tech preview
VCF Automation organization users can provision Argo CD instances into namespaces, use integrated OIDC authentication, and attach namespace or VKS targets. Provider administrators can manage operators across regions. The new organization self-service experience is a preview. The underlying Argo CD Supervisor service deployed through vCenter remains supported for production; it predates this release.
Native S3 object storage in tech preview
vSAN adds a native S3-compatible service alongside block and file storage. VCF Automation and Supervisor provide tenant provisioning, quotas, and bucket access. The design supports logical tenant separation or separate clusters where physical isolation is required. It was introduced in the May 9.1 discussion and identified as a tech preview in the September 9.1.1 announcement.
What this means for your team
A useful evaluation connects one application to its deployment pipeline, network services, and storage requirements. Test a real client against the S3 APIs it needs; do not assume all S3-compatible implementations behave identically. For GitOps, demonstrate rollback, tenant boundaries, and repository credential ownership. Preview features belong in evaluation plans until their production support status changes.
VCF 9.1 CONTEXT AND MIGRATION
Modernization & migration
Explore deep dives also covered capabilities introduced before the event. These are relevant to adoption, but should not be presented as new 9.1.1 features.
The vSphere 9.1 foundation from May
| AREA | CAPABILITY TO REVISIT |
|---|---|
| Patching | vCenter quick patch updates changed components with downtime depending on the affected service. ESX live patch covers more components and supports TPM; ineligible patches can still require maintenance mode and reboot. |
| Deployment and desired state | UEFI HTTP/S zero-touch provisioning and Configuration Profiles reduce manual host setup. Profile-driven memory tiering supports an optional mirrored NVMe device. |
| Maintenance and performance | DRS evacuation can account for destination capacity. vMotion scheduling, Intel QAT encrypted-vMotion offload, and topology-aware CPU placement address performance and resource use. |
| Accelerators | Enhanced DirectPath I/O and GPU sharing broaden hardware options; validate device-specific support and constraints. |
Cloud Director 10.6.2
Released during Explore, Cloud Director 10.6.2 provides a supported, documented, UI-assisted path toward VCF Automation 9.1. Preparation includes an Environment Assessment Tool report and the migration documentation. Extension compatibility needs explicit review; the announcement lists some extensions as request-for-product-qualification only and does not support every historical integration.
Edge workloads
VCF Edge remained part of the technical program for distributed infrastructure and local inference. Edge 9.1 and its zero-touch provisioning were announced earlier in the year. Evaluate local capacity, connectivity loss, fleet operations, and data placement when deciding whether an edge design fits a workload.
Where to start: compare upgrade, convergence, import, and rebuild options using your actual versions, integrations, recovery design, hardware compatibility, and change windows. The release documentation is linked in Availability & adoption; this recap does not establish a supported upgrade path for your environment.
APPLICATIONS DATA AND TRUESOURCE
Tanzu & TrueSource
Reliable agents need controlled execution, usable enterprise data, and maintained software dependencies.
Tanzu agent and data foundations
New Tanzu Platform capabilities target general availability in fall 2026. The announcement describes deny-by-default agent sandboxes with isolated credentials; structured and unstructured data preparation with access controls, context, and lineage; a developer harness with approved skills, memory, and human review; and a curated marketplace of models, tools, and data products. Gateway controls monitor, limit, and log agent activity.
The customer implication is broader than deploying a model: someone must own the data pipeline, approve tool access, and keep the agent’s source material current. Well-prepared context is intended to improve answer quality and reduce unnecessary token consumption.
TrueSource by Broadcom
TrueSource is available through tiered site licensing. It brings together Spring Enterprise, TrueSource Trusted Artifacts, and TrueSource Data Services. Trusted Artifacts covers verified builds across Java, Python, and Node.js and includes Bitnami Secure Images. Data Services covers PostgreSQL, RabbitMQ, MySQL, and Valkey, with related deployment assets and support.
Spring Enterprise emphasizes maintainer-led remediation, human-verified patches, managed dependencies, and CVE-only fixes. Repository scanning and remediation tooling aim to make patch status visible and reduce the work needed to apply changes. Confirm the relevant catalog and commercial coverage for your application estate.
A practical application-team discussion
Choose one agent or application. Trace its dependency chain from container image and libraries through data services to the model endpoint. Identify the owner for each layer, its patch source, its supported version, and its rollback procedure. Then test one data refresh and one dependency update with the application team before setting a recurring maintenance process.
IDENTITY NETWORK AND APPLICATION DEFENSE
Agentic security
The security announcements address complementary layers. A single gateway does not replace workload segmentation, application protection, and an auditable authorization design.
| LAYER | ROLE AND ANNOUNCED CHANGE |
|---|---|
| AgentMinder | Agent identity, declared intent, and authorization of tool actions. Generally available. |
| VMware vDefend | Lateral workload protection. Planned additions discover MCP servers, models, data stores, and tools; monitor shadow AI; and generate IDPS signatures for distributed virtual patching. |
| VMware Avi Load Balancer | Application and API protection. Planned additions inspect agent-tool traffic, restrict unauthorized MCP use, identify anomalous behavior, and protect sensitive data from exfiltration. |
What is available versus announced
The agentic extensions to vDefend and Avi are described in future tense in the release. Treat them as announced enhancements pending product-specific release confirmation. Existing network and application security functions continue to matter, but the announcement is not evidence that every new agentic control is present in your current version.
Build an evidence-based control review
Start with an application flow: user request, agent identity, model call, tool invocation, data access, and response. At each step, identify who can authorize it, where policy is enforced, and how a denied action appears in logs. Include direct access paths that bypass the intended gateway.
| TEST SCENARIO | EXPECTED EVIDENCE |
|---|---|
| Agent asks for an unapproved tool | A denied request with the responsible identity and policy reason. |
| Tool returns sensitive information | An agreed handling rule and a test of what reaches the final response. |
| Application or model is compromised | A documented containment path and proof of relevant network boundaries. |
| Investigator reconstructs an incident | A correlated record across identity, application, network, and agent activity. |
Where to start: schedule a joint review with IAM, security operations, networking, and the application owner. Agree on a small set of demonstrable controls rather than treating product deployment alone as proof of protection.
AS OF SEPTEMBER 10 2026
Availability & adoption
Use the release status to decide what can enter an adoption review, what needs a lab evaluation, and what belongs in roadmap planning.
| STATUS | CAPABILITIES | NEXT STEP |
|---|---|---|
| Available | VCF 9.1.1; model sharing; AgentMinder; TrueSource offerings; Cloud Director 10.6.2 | Check product scope, entitlement, compatibility, and operational readiness. |
| Tech preview | VCF Automation organization GitOps integration; native vSAN S3 object storage | Use a bounded evaluation with explicit support expectations. |
| Targeting fall 2026 | New Tanzu agent and AI-ready data foundations | Plan a review when the applicable release is available. |
| Future or announced | VCF AI Gateway, Secure Agent Framework, model autoscaling; new vDefend and Avi agentic enhancements | Track release delivery and avoid dependent production commitments. |
| Configuration dependent | AI Factory hardware, accelerator, and automation partner integrations | Confirm the specific supported stack and delivery status. |
A practical adoption plan
First establish the baseline
Document the deployed products and versions, integrations, operating constraints, and responsible owners. Select the two most relevant tracks: platform reliability, private AI economics, agent governance, application supply chain, or developer services.
Then run one bounded evaluation
For operations, reproduce a recurring issue. For AI, choose a repeatable task with a quality target. For governance, prove that an out-of-scope action is blocked. Record the baseline and results so the next discussion can reach a decision.
Before an upgrade or rollout, validate the current component release notes, known issues, interoperability, hardware support, and recovery plan. Use the official release documentation for the complete fix list and environment-specific upgrade restrictions.
CONTINUE AFTER EXPLORE
Recordings & learning
Choose recordings around the work you plan to do. The selections below use published session descriptions; the recordings have not been reviewed in full.
Plenary and overall directionShaping the Future of Private AI Cloud and Agentic Innovation • PLE1837LV
VCF strategy and investmentVCF State of the Union: Optimizing Costs and Closing Security Gaps in the AI Era • CLOB1276LV / 56:16
Choosing a modernization pathChoosing the Right Path to VMware Cloud Foundation 9: Upgrade, Converge, Import, or Rebuild • CLOB1257LV / 44:43
Lifecycle managementLifecycle Management in VMware Cloud Foundation 9.1 for VMware vSphere Admins • CLOB1568LV / 44:47
Full-stack troubleshootingFull-Stack Troubleshooting with VMware Cloud Foundation Operations • CLOB1224LV / 45:16
Deploying and governing Private AIDeploy and govern AI models and agents with VMware Cloud Foundation Private AI Services • CLOB1229LV / 48:43
Agentic AI security risksThe Top 10 Agentic AI Security Risks and Threats Every IT Admin Should Know • CMTYQT1710LV / 16:33
Open-source supply-chain defenseDefending the Open Source Software Supply Chain in the Era of Frontier AI • APPB1860LV / 45:17
AI inference at the edgeAI at the Edge: Running Inference and Agentic Workflows with VCF Edge • CLOB1272LV / 41:27
Full session recording catalogExplore HubtheCUBE Explore coverageLabs and certification
Explore included a Claude-focused hackathon, VCF 9.1 deep dives, Hands-on Labs, and the Certification Center. Use Learning@Broadcom to explore training paths and confirm availability of the relevant labs.
Explore 2027
The next Las Vegas event is May 3–6, 2027 at Resorts World. Pre-register before September 30, 2026 for an additional $100 off the Full Event Pass. Use the same email address for official registration, which opens January 12, 2027.
Based on published announcements and session descriptions, as of September 10, 2026. Recordings have not been reviewed in full. Component release notes remain the reference for exhaustive fixes and upgrade restrictions.