Broadcom VMware Cloud Foundation 9 Spotlight: Security Modernization

Broadcom commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study and examine the potential return on investment (ROI) enterprises may realize by deploying VMware Cloud Foundation (VCF) 9.¹ This abstract will focus on security modernization using Broadcom VCF 9 and its value to interviewees’ and survey respondents’ organizations.

Interviewees and survey respondents for this Spotlight include:

• Global head of cloud at a global financial services organization with $78 billion in annual revenue and 200,000 employees.

• Vice president of platform cloud at a North American telecommunications organization with $16.6 billion in annual revenue and 25,000 employees.

• Service owner of virtualization at a global manufacturing organization with $5.5 billion in annual revenue and 9,300 employees.

• Chief information officer at a North American financial services organization.

• Fifty-five survey respondents with experience using VCF 9.

Interviewees and survey respondents described operating in highly regulated environments that faced increasing challenges related to cyberthreats, ransomware risk, compliance requirements, infrastructure sprawl, and fragmented security architectures. Many said their organization relied on multiple point solutions and manually intensive security processes that limited visibility, increased operational complexity, and made it difficult to consistently enforce security policies across environments.

VCF 9 enabled interviewees’ and survey respondents’ organizations to modernize security operations through integrated networking and security capabilities, automated lifecycle management, microsegmentation, centralized policy enforcement, and improved infrastructure visibility. Interviewees and survey respondents reported stronger security postures, improved compliance readiness, reduced operational risk, and faster remediation processes while creating a scalable security foundation capable of supporting hybrid cloud, AI, and future modernization initiatives.

Investment Drivers For Security Modernization

The interviewees’ and survey respondents’ organizations adopted VCF 9 to strengthen security posture, improve compliance readiness, and reduce operational risk.

• Increasing cyberthreats required stronger security controls. The organizations operated in environments supporting critical business services, financial transactions, customer data, and highly regulated workloads. Interviewees and survey respondents said they sought to reduce lateral movement risk, strengthen infrastructure security, and improve the ability to prevent and contain ransomware and other cyberthreats through more granular security architectures.

• Fragmented security environments increased operational complexity. The organizations frequently managed multiple networking, firewall, monitoring, security, and compliance tools. Interviewees and survey respondents reported challenges maintaining consistent security policies, achieving end-to-end visibility, and coordinating remediation activities across infrastructure teams.

• Manual compliance and security processes consumed significant resources. Security and infrastructure teams spent substantial time preparing audits, validating configurations, applying patches, generating compliance reports, and maintaining security controls. Interviewees and survey respondents said their organizations wanted to automate these activities and improve consistency while reducing administrative effort.

Solution Requirements

The interviewees’ and survey respondents’ organizations searched for a solution that could:

• Unify fragmented infrastructure into a single, integrated platform. Interviewees and survey respondents said their organizations sought to replace siloed point tools across compute, networking, storage, security, and recovery with a more cohesive approach, and that they needed to simplify operations while improving consistency across environments.

• Enable automation and reduce reliance on manual processes. The organizations wanted to streamline provisioning, configuration, and lifecycle management. They believed that reducing manual effort would be critical to improving speed, scalability, and operational efficiency.

• Standardize operations across environments. Interviewees and survey respondents noted their organizations prioritized a consistent operating model that could be applied across on-premises and public cloud environments. They wanted the ability to enforce best practices, reduce variability, and improve governance and control.

• Simplify lifecycle management and ongoing maintenance. Interviewees and survey respondents said their organizations sought to centralize and streamline patching, upgrades, and infrastructure updates, and to reduce the complexity and coordination associated with managing these systems.

• Improve visibility, resiliency, and security posture. Interviewees and survey respondents said their organizations required stronger insight into infrastructure performance and risks, along with built‑in capabilities to support compliance and resilience while better managing outages, enforcing policies, and protecting critical workloads.

Key Results For Security Modernization

The results of the investment for the interviewees’ and survey respondents’ organizations include:

• Strengthening security posture through hardened infrastructure, microsegmentation, and Zero Trust principles. Interviewees and survey respondents said their organizations significantly improved their security controls and reduced organizational exposure to cyberthreats.

  • Reduced lateral movement risk through microsegmentation. Interviewees and survey respondents consistently cited microsegmentation as one of the most valuable capabilities delivered by VCF 9. The chief information officer at a financial services organization described microsegmentation as one of the most important outcomes of the platform and said it reduced the likelihood that a security event would become a larger business incident: “The risk of lateral movement is significantly narrowed.”
  • Improved security architecture and cyber resilience. The vice president of platform cloud in telecommunications said VCF 9 provided strong segmentation, built-in controls, and integrated cyber recovery that reduced business risk associated with running critical telecom and enterprise workloads on large, shared infrastructure foundations.

• Optimizing security, compliance, and resilience operations. Interviewees and survey respondents said their organizations reduced manual effort associated with security administration, compliance management, vulnerability remediation, and cyber recovery.

  • Accelerated patching and vulnerability response. The service owner of virtualization at a manufacturer said, “If I patch the whole environment [with VCF 9], I would say [it’s] 30% faster.” They also said the process requires fewer manual steps and provides a quicker path to closing vulnerabilities across the infrastructure.
  • Improved remediation and recovery efficiency. Survey respondents also reported improved security posture, reduced downtime in the event of a cyberattack or operational disruption, and more efficient operations across infrastructure, security, and compliance teams. These findings suggest that organizations may benefit not only from stronger security controls, but also from a more efficient remediation and recovery process.

• Improving resilience and reducing organizational risk. Interviewees and survey respondents said their organizations strengthened their business continuity, security response capabilities, and overall operational resilience.

  • Improved threat detection and incident response. The head of global IT and security in healthcare connected the platform to reductions in the impact of security incidents. They also associated the security and compliance improvements with approximately $1 million in compliance-related value, highlighting the business value of stronger controls and improved resiliency.
  • Improved security and operational resilience to security incidents. Interviewees and survey respondents said their organizations strengthened infrastructure security and reduced administrative overhead by leveraging microsegmentation, centralized policy management, automated compliance processes, built-in security capabilities, and automated cyber recovery. The director of architecture and infrastructure at an insurance organization commented: “We segmented our entire system, and when you create some resource, it knows where it belongs to attach. That’s also easy to manage in VCF 9 with [VMware] NSX.” The same interviewee said network changes that previously took up to a full day require 1 to 2 hours.