If Broadcom’s first big VMware Explore 2026 announcement was about building AI infrastructure faster, this one is about something arguably harder: figuring out who — or what — gets to touch what, once autonomous agents start running loose inside your enterprise. And Broadcom spent a good chunk of time explaining exactly that problem, headlined by a brand-new product called AgentMinder.
You know what’s interesting? A lot of vendors talk about agent security in terms of prompt filtering or model guardrails. Broadcom’s framing is different, and honestly a bit more unsettling if you think about it too long: treat AI agents like employees. Not chatbots. Not scripts. Digital employees, with authority, access, and the ability to act on your behalf — for better or worse.
Meet AgentMinder: A Traffic Cop for Autonomous Agents
Clayton Donley, vice president and general manager of Broadcom’s Identity Management Security Division, didn’t mince words about why this exists. “AI has moved from the pilot stage to becoming a critical part of enterprises’ daily business operations,” he said. “However, existing security models were designed for human users, not for autonomous ‘digital employees’ that can make decisions and take actions on their own.”
That’s the crux of it. We’ve spent decades figuring out how to manage employee access — separation of duties, least privilege, the whole ERP-style governance playbook. We’ve had maybe 25 years figuring out extranet and customer access controls. Agents? Those rules basically don’t exist yet, and agents are already out there making decisions, calling tools, and occasionally deciding to “fix” a problem they weren’t actually authorized to touch.
AgentMinder works as a control plane that sits in front of the large language models, MCP servers, and tools that agents call. Here’s how it breaks down in practice:
- Identity and intent: every agent gets treated as an enterprise-grade identity, with its authority tied to a declared mission, permitted intents, approved tools, and authorized resources. The agent has to declare what it’s trying to do, not just who it is, before it touches anything.
- Runtime enforcement: a cloud-native AI gateway evaluates real-time context — identity, tool, intent, resource — and enforces least-privilege policy on every single tool call, not just at login.
- Observability and audit: built on OpenTelemetry, giving security and compliance teams full visibility into every agent session, with chain-of-custody tracking and anomaly detection.
The identity piece matters more than it might sound. Donley described a scenario that’s probably already happening quietly in a lot of shops: someone hands an agent an API key, and that agent can now talk directly to an LLM provider, bypassing whatever governance framework IT thought it had in place. AgentMinder is designed to make that impossible by ensuring agents never receive usable API keys for external services directly — every request has to route through the gateway, which becomes the one chokepoint you can actually monitor.
AgentMinder also plugs into the AuthZEN standard, so enterprises can reuse existing authorization infrastructure rather than ripping out their current identity stack. It’s deployable across VMware vSphere Kubernetes Service, Google Cloud Platform, and other standard Kubernetes environments — Broadcom was fairly insistent this isn’t a single-vendor lock-in play.
Broadcom Runs It Internally, and the Numbers Are Big
Broadcom isn’t just selling this — it’s apparently running its own agentic pipeline on it. Alan Davidson, Broadcom’s CIO, shared some scale figures that are, frankly, a lot bigger than most companies will ever need to worry about: nearly 36 million customer-related API calls and 7 million workforce-related API calls every day, supporting over 20 million customer identities and 72,000 workforce identities, all on a multi-region, active-active architecture with zero downtime during upgrades.
“With AgentMinder powering our platform, we’ve achieved massive global scale paired with zero downtime, even during maintenance and upgrades,” Davidson said, adding that it enabled company-wide deployment of Broadcom’s own AI agentic pipeline with “chain of custody” capabilities between developers and agents.
AgentMinder is generally available.
vDefend Gets an Agentic Upgrade
AgentMinder isn’t operating alone, though. Broadcom also detailed a set of enhancements to VMware vDefend, its network security product, aimed squarely at agentic workloads. Umesh Mahajan, vice president and general manager of the Application Networking and Security Division, opened with a fairly blunt assessment of where things stand: attackers are now moving at machine speed, and the gap between initial access and lateral movement has shrunk to minutes, sometimes seconds. Patch cycles measured in weeks, he argued, simply aren’t fast enough anymore.
New vDefend capabilities include automatic discovery of agentic AI components — MCP servers, LLMs, datastores, tools — by continuously watching traffic across VCF, plus shadow AI monitoring to catch unauthorized AI usage before it becomes a bigger problem. Perhaps the cleverer bit is how Broadcom is fighting AI-discovered vulnerabilities with AI of its own: an agentic pipeline generates Intrusion Detection and Prevention signatures at machine speed, providing what the company calls “distributed virtual patching” so workloads get protected within minutes of a signature being available, buying real time for teams to actually roll out a permanent fix across sprawling, multi-datacenter environments.
The performance numbers behind this are worth noting too — distributed firewall throughput jumped 240% to 75 terabits per second per VCF instance, with IDPS performance nearly doubling to 17 terabytes per second. Mahajan also pointed to vDefend’s built-in “1-2-3-4” prescriptive workflow for lateral segmentation, noting one customer used it to protect 4,000 workloads within a few weeks — a process that historically dragged on for months, especially in brownfield environments nobody wanted to touch.
Avi Load Balancer Joins the Fight
Rounding out the network layer, VMware Avi Load Balancer picked up new agentic-specific defenses too. Avi’s web application firewall and API protection capabilities now extend to restricting agents from calling unauthorized MCP tools, inspecting transaction content to block things like remote code execution, and establishing behavioral baselines across agents, LLMs, and tools so anomalous activity gets flagged in real time as a possible zero-day attack. There’s also new tooling for preventing sensitive data — credentials, PII, financial data — from leaking out through an agent’s actions, whether that’s accidental or the result of a compromised tool.
Tanzu Platform’s Deny-by-Default Playbook
Meanwhile, over on the Tanzu side, Purnima Padmanabhan, VP and GM of the Tanzu Division, laid out how VMware Tanzu Platform is becoming the “official agent platform” for VMware Private AI Cloud, with a set of new AI-ready data foundations as the centerpiece.
The problem Padmanabhan described is one a lot of enterprises are quietly wrestling with: agents are only as good as the data you feed them, and getting that data ready — cleaned, structured, governed — is usually a slow, manual slog. Tanzu’s answer is to let data owners build pipelines across structured and unstructured data that produce “data products” — curated, access-controlled packages that get published to a marketplace where agents and developers can discover them without the underlying source data ever leaving the enterprise boundary.
Everything runs inside a deny-by-default sandbox model: agents get zero access to APIs, networks, MCP servers, or the internet unless explicitly granted, and credentials are stored in an isolated vault the agent itself can’t see. “Agents can’t leak or misuse what they can’t see,” as Broadcom put it — closing off a whole category of credential theft and prompt injection risk before it starts.
Padmanabhan summed up the underlying philosophy this way: “Enterprises do not have an AI ambition problem. They have an agent trust problem. You cannot let software make decisions on data you do not govern, running on infrastructure you do not control.”
That framing got some outside validation too. Rachel Stephens, research director at RedMonk, described the risk in terms that feel pretty accurate to anyone who’s sat through an agentic AI planning meeting: “Enterprises aren’t hesitant about agents because of what they know can go wrong; it’s the unknown unknowns, the unintended consequences nobody can enumerate in advance.” Platforms that make data access governed and auditable by default, she added, turn that fear into something manageable.
There’s a real-world reference point behind this too. Marie-Claude Potvin, Assistant Vice President of Infrastructure Services at Business Development Bank of Canada, described using Tanzu Platform since 2019 to standardize how internal applications get deployed and managed, which she said reduced day-to-day operational overhead as the bank’s data and AI use expanded — a decent proof point that this isn’t purely theoretical.
The AI-ready data foundations, along with the rest of the Tanzu Platform agent capabilities, are slated for general availability in Fall 2026.
TrueSource Tackles the Open Source Problem
One more piece rounds out the security story, and it’s arguably the least flashy but most foundational: TrueSource by Broadcom. This brings together Broadcom’s various open source security efforts — Spring, Bitnami, and a handful of data services — under a single umbrella with a consistent set of principles for vulnerability scanning, remediation, and clean-room builds.
Spring Enterprise gets simultaneous patch access across current and long-term-support versions, with Salsa 3-compliant clean-room builds covering the entire dependency tree, not just Spring itself — Broadcom noted this now spans more than 5,000 dependencies. TrueSource Trusted Artifacts extends that same treatment beyond Java into Python and Node.js libraries, folding in the Bitnami Secure Images catalog along the way. TrueSource Data Services applies the standard to PostgreSQL, MySQL, RabbitMQ, and Valkey.
The guiding idea, as described in the briefing, is that Broadcom remediates vulnerabilities with open source maintainers rather than around them — a distinction that matters if you’ve ever watched a vendor fork a project and quietly abandon the upstream community.
Don’t Forget the Humans
It would be easy to read all this and assume Broadcom thinks security is purely a product problem. It doesn’t, at least not entirely. The company also introduced a Frontier AI Security Readiness Program, structured around four stages — assess, architect, implement, and upskill — designed to help customers benchmark their exposure and build a private cloud security posture around it. That last stage includes a new certification, VMware AI Resilient Infrastructure Expert (AI-RISE), aimed at turning traditional VI admins into people who actually understand how to defend against frontier AI-driven threats.
Because at the end of the day, the smartest agent governance framework in the world still needs a human who knows what a suspicious log entry looks like.
The Bottom Line
Between AgentMinder, the vDefend and Avi upgrades, Tanzu’s deny-by-default sandboxing, and TrueSource’s open source cleanup effort, Broadcom is making a fairly loud statement this week: agentic AI isn’t just a productivity story, it’s a security story that most enterprises haven’t fully reckoned with yet. Whether customers actually adopt this full stack — or cherry-pick the pieces that fit their existing tools — is the question worth watching as these capabilities roll out through the rest of 2026.
##
