Broadcom / VMware
NSX licensing, after the bundle shake up.
Where NSX lives in the Broadcom bundle world, what the per core math costs, and the levers that move an NSX heavy renewal.
Where NSX lives in the Broadcom bundle world, what the per core math costs, and the levers that move an NSX heavy renewal.
NSX stopped being a standalone product decision and became a bundle and attach decision, so the cost question is now which cores genuinely need network virtualization and security.
NSX ships primarily as the networking layer of VMware Cloud Foundation, with advanced security sold separately as vDefend attach SKUs. The freestanding NSX product line that existed before the Broadcom acquisition has largely folded into this structure.
That packaging decision drives everything else. If you run VCF, you already own core NSX networking; the open question is the security attach. If you run vSphere Foundation, NSX is an upgrade conversation.
NSX cost follows the bundle: you pay VCF per core for the platform, then per core again for each vDefend attach on covered clusters, with a 16 core minimum per CPU. The published structure sits on the Broadcom software portfolio pages, but street pricing is set deal by deal.
The compounding is what surprises buyers. A dense 64 core host pays the attach on all 64 cores even if the firewall policy on it is trivial, which is why attach scoping matters more than rate negotiation.
NSX cost drivers and buyer responses
| Cost driver | Effect on the bill | Buyer response |
|---|---|---|
| Host core density | Attach cost scales with cores, not usage | Scope attaches to security relevant clusters |
| 16 core minimum per CPU | Small hosts pay phantom cores | Consolidate hosts before renewal |
| Enterprise wide attach scope | Pays for features most clusters never run | License by cluster, prove usage |
| Threat prevention tier | Highest rate in the attach family | Reserve for regulated or exposed segments |
| Renewal uplift | Compounds the whole stack annually | Cap increases in the order form |
Pull distributed firewall rule counts, flow statistics, and feature flags from the NSX manager before any commercial conversation. The Broadcom technical documentation describes the operational reporting available; that output is your negotiation evidence.
Rightsize by cluster, not by estate. Map which clusters carry regulated workloads, exposed services, or genuine microsegmentation policy, and license the security attach there only. In our file that scoping cut attach spend 25 to 45 percent.
Treat the rest of the estate as a candidate for native vSphere controls or third party tooling. The point is not to rip NSX out; it is to stop paying advanced security rates on clusters running basic switching.
The standard partner guidance is to license vDefend across the whole estate for consistency, on the theory that uniform coverage simplifies operations and audits. We disagree. In roughly 12 of the 20 to 30 NSX files Morten Andersen reviewed in 2024 to 2025, uniform coverage meant paying advanced security rates on a majority of cores that ran nothing beyond default policy, and the simplification argument never survived contact with the invoice. Cluster scoped licensing with documented flow evidence passed every true up we defended. The buyer side move is to segment the estate by security requirement, license the attach where the requirement is real, and let the usage evidence carry the audit conversation.
Three cuts of our advisory engagement file frame the rightsizing opportunity.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
Three levers move NSX economics: attach scope, core hygiene, and a credible security alternative. Rate discounts follow those levers; they rarely lead.
Ride the VCF renewal. Bundling the attach decision into the platform negotiation gives you a bigger number to trade against, and Broadcom quarter end dynamics apply to the combined deal.
Six moves cut NSX cost before the next renewal.
White Paper · Broadcom / VMware
VMware Bundle Negotiation Landing
Seven buyer side levers cut a VMware VCF or VVF bundle under Broadcom: the core minimum trap, the bundle math, and where the price actually moves. Read it free.
Mostly no. NSX networking ships inside VMware Cloud Foundation, and advanced security sells as per core vDefend attach SKUs on top of the bundle.
Broadcom charges at least 16 cores per CPU across its VMware portfolio. Hosts with smaller processors pay for cores they do not have, on the platform and on every attach.
Yes. Attach SKUs can be scoped by cluster, and cluster scoping with flow evidence cut attach spend 25 to 45 percent across our 2024 to 2025 file.
Not if scope matches deployment. Document which clusters run which features and align the order form to that map before the true up, not after.
Distributed firewall rule counts, flow statistics, and feature flags by cluster. That evidence moved the NSX position in 7 of 10 renewals we supported.
No. Fold it into the VCF renewal so the combined number is on the table, then time the close against a Broadcom fiscal quarter end.
The bundle pricing benchmarks and renewal levers from 40 plus Broadcom VMware negotiations.
Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement leaders running the next renewal cycle.
NSX pricing follows cores, not firewall policy. Scope the attach to the clusters with real security requirements and the bill follows the map.
500+ enterprise clients. 11 vendor practices. Industry recognized. One conversation can change what you pay for the next three years.
One buyer side briefing a week. Pricing moves, audit signals, and the levers that work. No vendor spin.
