VMware audit defense under Broadcom. Scope the data, then settle inside the renewal.

A Broadcom VMware audit usually ends as a subscription quote. Control what data leaves, rebuild the core count yourself, and close the finding inside the renewal with a costed exit plan behind you.

Why is Broadcom auditing VMware customers now?

Broadcom audits VMware customers to speed up the switch from perpetual licenses to subscription bundles, mainly VMware Cloud Foundation and vSphere Foundation. The compliance finding is rarely the goal in itself. Broadcom is now the most active software auditor, named by 33 percent of 118 enterprises in our software audit trends survey for 2025 to 2026.

Since the acquisition closed, the VMware portfolio under Broadcom has shrunk to a small set of subscription bundles. Perpetual entitlements remain valid, but support renewals for them have ended, and customers running unsupported perpetual software are the main pool Broadcom audits from.

What triggers a Broadcom VMware audit notice?

Three signals account for most of the outreach we see. Broadcom holds the data behind each of them already.

• Support expiry. Running perpetual licenses past the last support date flags the account for compliance review.
• Download activity. Patches or binaries pulled from the Broadcom support portal without a matching entitlement.
• Renewal refusal. In many of the accounts we advised, declining the first subscription quote moved the customer into the compliance queue.

The download signal carries the most legal weight. The letters Broadcom sent in 2025 to customers with expired support asked them to remove any updates, patches and releases installed after the support end date, with an exception for zero day security patches.

Broadcom's knowledge base currently offers critical security patches (CVSS 9.0 or higher) for vSphere 8.x to perpetual customers with expired support. Anything else applied after expiry is what the letter points to. If you have received one, our note on responding to a Broadcom cease and desist letter covers the timing.

What does the VMware audit clause allow Broadcom to do?

It gives Broadcom the right to audit on short notice and makes list price the cost of any gap it finds. The audit section of the software module in Broadcom's current end user agreement sets the rules, and the VMware agreement terms page is where to find the version you signed. Read your own paper, because older VMware contracts differ.

• Notice. Broadcom or an independent third party may audit on 30 days' prior written notice, remotely or at your site.
• Conduct. Broadcom agrees the audit will be confidential and commercially reasonable in nature and time. You agree to cooperate in good faith.
• Records. You must provide verified reports and records on your use, during the term and for 12 months after it.
• Price of a gap. Unlicensed use must be ordered at Broadcom's then current list price within 30 days of written notification.
• Audit costs. If the underpayment is 10 percent or more of fees owed for the review period, you also pay Broadcom's reasonable audit expenses.

What does the audit actually measure?

The review compares deployed cores per cluster with your entitlement records. Subscription metrics are per core, with a minimum of 16 cores per CPU, so older per CPU entitlements are hard to map cleanly. Whatever gap results is priced at list.

The gap follows from the metric change. From April 2020, one VMware per CPU license covered up to 32 cores. A host with two 32 core CPUs needed 2 CPU licenses then and needs 64 core licenses now. Our core licensing guide covers the counting rule in detail.

Where does VMware audit exposure come from?

Most of it comes from entitlement mapping rather than deliberate overuse. Older per CPU licenses, OEM bundled entitlements and licenses from acquired companies rarely reconcile cleanly with the current per core subscription catalog.

What data does Broadcom already hold?

Assume Broadcom has your support portal download history, your entitlement records and your renewal correspondence. On VCF 9 and later it also receives regular license usage reports from VCF Operations. The one dataset you control is the deployment inventory for older versions, so build it yourself before you answer any data request.

How do you check your own position first?

Use the same sources Broadcom will use, and read them before anyone outside the company does.

• RVTools. The vHost tab lists sockets, cores per CPU and cluster membership for every host a vCenter manages. Export it from every vCenter and keep dated copies.
• Broadcom's counting script. Knowledge base article 313548 links a PowerCLI module, FoundationCoreAndTiBUsage, that reports licensable cores per host with the 16 core minimum applied and vSAN capacity per cluster.
• The support portal. Your entitlement list and your download history, which shows what was pulled after each support end date.
• Your contract file. Original orders, OEM paper and any assignment or novation letters from acquisitions.

Why does the first response matter most?

The first data submission frames the whole negotiation. Customers who sent raw exports without scoping gave away cluster level detail that priced the settlement against them. Scope the request, agree the metric, then submit.

How much does scoping change a VMware audit bill?

Enough to decide the outcome, because the settlement price is a core count multiplied by a rate. Say a company runs 28 hosts, each with 2 CPUs, across three vCenters. Its entitlement file shows 32 perpetual per CPU licenses of vSphere Enterprise Plus with support lapsed.

• Production. 16 hosts with two 32 core CPUs, so 1,024 cores. The 32 CPU licenses covered them fully under per CPU rules.
• Disaster recovery. 4 hosts with two 16 core CPUs, so 128 cores.
• Lab. 4 hosts with two 10 core CPUs. That is 80 physical cores, counted at the 16 core minimum as 128. The lab was powered off five months before any notice, with a dated change ticket, but the hosts were never removed from vCenter inventory, so every export still lists them.
• Acquired subsidiary. 4 hosts with two 24 core CPUs, so 192 cores, licensed under the subsidiary's own contract, which is outside this review, and already scheduled for migration to another hypervisor.

The difference is $288,000 over the term, about 22 percent, before any discount is discussed. The rate never moved. The saving came from a change ticket that dated the lab shutdown, and from a subsidiary contract and exit plan that were on file before the count was sent.

Note that the production hosts were compliant on the per CPU metric the company actually bought, while Broadcom's analysis will start from cores. Keep both views in your working file, because the per CPU position answers any claim about the past. Our per core subscription calculator sizes the forward cost with your own rate.

What have we seen in Broadcom VMware audits in 2024 and 2025?

Audit and compliance pressure rose sharply once perpetual support lapsed. Morten Andersen advised roughly 30 to 40 Broadcom VMware customers between 2024 and 2025, and three patterns came up again and again.

• Lapsed support was the trigger. In most of the cases we tracked, customers running perpetual vSphere past support expiry heard from Broadcom's compliance team within 6 to 12 months.
• Core counts drifted upward. Virtualization sprawl added 15 to 30 percent more licensable cores than the entitlement record showed. Most of it came from cluster expansions that were never mapped back to a contract.
• The cost landed in the renewal. Broadcom rarely pursued a standalone audit fee. It converted findings into a subscription migration priced at list, and that is where customers paid.

Should you hand over full deployment data to show good faith?

That is the standard advice: respond fast and send everything, so Broadcom sees you have nothing to hide. We disagree. In roughly 25 of those 30 to 40 engagements, early full disclosure removed every scoping option, and settlements landed 40 to 60 percent higher than for comparable customers who agreed scope first.

You show good faith by engaging on process: prompt acknowledgment, a named contact, a proposed scope and timetable. Pair a narrow, metric agreed submission with a separate commercial track on the renewal. Broadcom wants the subscription conversion more than the audit fee, and that works in your favor.

The first data submission frames the whole negotiation, so agree what it covers before anything leaves the building.

How do you run a VMware audit defense from notice to settlement?

Control the data, verify the baseline, then negotiate. Keep the data flow under NDA, check the entitlement baseline independently, and treat the finding as a commercial discussion tied to the renewal rather than a legal admission.

1. Acknowledge without admitting. Confirm receipt, and ask for the scope and the contractual basis under your VMware agreement terms.
2. Freeze internal changes. Run no decommissioning sprint after the notice arrives, because it reads as destroying evidence.
3. Build your own baseline. Combine the deployment inventory with the full entitlement chain, including OEM paper and acquisition documents.
4. Price the alternatives. A costed exit scenario away from VCF is the one thing that changes Broadcom's numbers.
5. Settle through the bundle. Trade audit closure for subscription terms you would have accepted anyway.

What should happen in each week of a VMware audit?

Use the notice period to settle process questions, because every later step depends on them. Nothing about the environment should change in that window.

What will Broadcom say during a VMware audit, and how should you answer?

Expect requests for raw data, tight deadlines and a suggestion that a larger subscription makes the problem go away. These are the lines we hear most, with the replies that have held up.

• "Send us the full RVTools export for all vCenters." Reply that you will provide a dated summary for the contracts and period in scope once scope and the counting metric are agreed in writing.
• "Run our script and send the output." Say you will run it, review it, and send a summary. The raw output includes hosts outside the review.
• "The unlicensed use has to be ordered at list within 30 days." Ask for the written notification that starts that clock. Propose that any agreed gap be closed at your contracted subscription rate as part of the renewal.
• "Moving everything to VCF closes the audit." Answer that you will settle the counted gap and discuss the renewal scope separately, with your exit costing on the table for the tiers you may move.

What gives you bargaining power in a Broadcom VMware audit?

A credible exit and the timing of your renewal. Broadcom models churn risk, and a customer with a funded migration plan to an alternative gets very different numbers from one that cannot leave.

• A credible exit plan. A board approved migration budget changes quotes more than any procurement tactic. Our VMware exit plan guide shows how to cost one workload tier.
• Renewal timing. Closing the audit inside the renewal gives both sides a clean trade.
• Scope discipline. Every workload you take out of the licensed pool shrinks the baseline for good.

The general method for audits across publishers is in our multi vendor audit response guide, which covers controlling scope and building your own license position.

Which contract terms should the settlement include?

Ask for these when the audit closes into a renewal. Broadcom does not grant them by default, and our note on Broadcom contract red lines covers which to hold out for.

• A release for the review period. Written confirmation that the settlement closes all claims for the products and dates audited.
• Contracted rate for gaps. Any future shortfall priced at your subscription rate, replacing the then current list price in the standard clause.
• Audit cost waiver. Removal of the audit expense reimbursement, or a higher underpayment threshold before it applies.
• Audit frequency. No more than one audit in any 12 months, so reviews cannot be stacked around a renewal.
• Customer produced data. The right to supply your own dated inventory instead of giving direct access to vCenter.
• Reduction rights. The ability to lower core quantities at renewal when you retire or migrate hosts.

Which mistakes make a VMware audit more expensive?

Each of these raises the settlement without any change in what you actually ran.

• Treating the notice as an IT ticket. An administrator answering a data request directly can send a full export before legal or procurement has seen it.
• Leaving retired hosts registered. Hardware that is powered off but still in vCenter inventory appears in every export, and you then have to argue it out with change records.
• Counting sockets. Teams used to per CPU licenses still report sockets, which hides the per core gap until the auditor finds it.
• Forgetting the per CPU minimum. Small CPUs on edge and lab hosts are counted up to the minimum, so a physical core count understates the licensable one.
• Paying the audit and the renewal separately. A standalone settlement followed by a subscription quote means paying for the same cores twice.

For the audit checks to run before a notice, see our VMware audit checklist.

What to do next

The Broadcom VMware practice runs this defense as a managed engagement, and Vendor Shield keeps your position maintained all year. The Broadcom VMware hub holds the full resource set.

1. This week. Export host and core data from every vCenter with RVTools, before any notice arrives, and repeat the export monthly.
2. This month. Assemble the entitlement chain: original orders, OEM paper and acquisition novations.
3. Quantify the gap. Map per CPU entitlements to per core equivalents and calculate the shortfall yourself.
4. Cost an exit. Price a real migration scenario for at least one workload tier.
5. If a notice arrives. Respond on process and scope, never with raw data.
6. At settlement. Tie any payment to renewal terms you would have accepted anyway.

Frequently asked questions