The perpetual right survived, the safety net did not
Perpetual license owners hold a permanent right to run the licensed version, and that right survived the Broadcom transition: ESXi hosts and vCenter keep operating normally with every licensed feature intact. What closed is the portal, no new patches, no severity tickets, no upgrade rights, and the four options, run unsupported, third party support, subscription conversion, and migration, are not mutually exclusive: the right answer is usually a portfolio split by workload criticality.
Prepared by Redress Compliance · August 8, 2026 · Broadcom advisory. Based on 25 to 35 Broadcom VMware engagements advised 2024 to 2025.
Executive summary
The conversion quotes ran 2 to 5 times prior support spend, on bundles nobody fully deployed. Renewal quotes after the subscription transition ran 2 to 5 times the prior support spend, and estates converting everything to VCF paid for components they never used, 30 to 50 percent of the bundle sitting idle: per core pricing makes hardware density the cost driver, so the conversion decision is a density and scope decision before it is a rate negotiation. Broadcom's intended path is conversion; the buyer's job is converting only the strategic, growing core.
Running frozen is viable for the right clusters, with a real clock attached. The frozen estate is usable indefinitely on existing hardware, frozen at its version with no patches, exposed as CVEs accumulate, and capped, unable to add hosts or cross major versions without entitlement. Most stable clusters can run 2 to 4 years frozen before hardware refresh or CVE accumulation forces a move, and hardware sets the harder boundary, since a frozen compatibility list strands the estate on uncertified silicon at the next server refresh: plan the exit around the refresh cycle, not the license paper. The zero day carve out is narrow, CVSS 9.0 and above on vSphere 8.x only, and the 7.0 to 8.9 band where most exploitable hypervisor CVEs land stays unpatched.
Third party support prices the middle path at 40 to 70 percent below the quote. Stable clusters ran safely unsupported or on third party support at 40 to 70 percent below the subscription quote, buying severity response and security advisories without Broadcom, the fit for stable production that needs a safety net but not a roadmap. The timeline since the acquisition argues for skepticism about any static plan: terms changed every few months, the 72 core order minimum circulated and was walked back, the free ESXi tier died and returned, and most restrictive changes arrived through channel communications rather than contract amendments, so any quote older than a quarter is stale.
Migrations started under pressure cost more than migrations started with runway. Moving off takes 12 to 24 months at enterprise scale, and the engagements that started with 18 months of runway beat the ones that started under renewal pressure on every dimension, which is why the mixed strategy dominates: convert the strategic core, ring fence the stable edge with an exit date, and migrate the workloads with credible alternatives. The 2025 cease and desist letters to expired estates changed nothing about the perpetual right, but they show Broadcom watches, so the frozen posture needs its paperwork, entitlements documented and the patch boundary respected.
The four options, compared
| Option | Relative cost | Risk profile | Fits |
|---|---|---|---|
| Run unsupported | Near zero | CVE exposure grows over time | Stable, ring fenced clusters with exit dates |
| Third party support | 40 to 70 percent below subscription | No new versions; advisory based patching | Stable production needing a safety net |
| Convert to VCF or VVF | 2 to 5 times prior support spend | Full support; per core subscription lock | The strategic, growing virtualization core |
| Migrate off | Project cost now, lower run rate later | 12 to 24 month execution risk | Workloads with credible alternatives |
The Broadcom timeline, and why plans go stale
- Nov to Dec 2023: the acquisition closes and within three weeks perpetual license and support renewal sales end; the portfolio collapses into VCF and VVF subscriptions.
- Early 2024: end of availability takes effect and the free ESXi tier is discontinued; the zero day patch policy for expired 8.x support publishes in spring.
- Mar 2025: VMSA-2025-0004 discloses three ESXi zero days exploited in the wild, and unsupported 7.x estates had no vendor patch path at all.
- 2025, both directions: a 72 core order minimum and late renewal surcharges circulate through channel communications, then walk back under pushback; a free ESXi edition returns with 8.0 Update 3e; VCF 9.0 ships with vSphere 9 subscription only.
- The lesson: most restrictive changes arrived through the channel rather than contract amendments, at least one reversed under pressure, so treat any quote older than a quarter as stale.
The Broadcom renewal response strategy
The four option portfolio method, the conversion scoping discipline, and the negotiation sequence worked on a representative estate.
Get the white paper →The portfolio split, workload by workload
The mixed strategy that most enterprises land on assigns each tier its own option: the strategic, growing virtualization core converts, scoped to the components actually deployed rather than the full VCF bundle whose 30 to 50 percent idle share the wholesale converters paid for; the stable edge, clusters with defined exit dates and low change rates, ring fences on frozen licenses or third party support at 40 to 70 percent below the quote, with the CVE boundary and the hardware refresh date written into the plan; and the workloads with credible alternatives migrate, started with runway rather than under renewal pressure, because the 12 to 24 month execution window does not compress just because the quote arrived. The conversion pricing mechanics and the walkaway construction run in the Broadcom audit defense guide, the platform comparison feeding the migration tier in the Hyper-V comparison and the Nutanix comparison, and the bundle anatomy in the VCF components guide.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across VMware engagements, 2024 to 2025
Across roughly 25 to 35 Broadcom VMware engagements Fredrik Filipsson advised between 2024 and 2025, renewal quotes after the subscription transition ran 2 to 5 times the prior support spend:
Of VCF components never deployed by estates that converted everything wholesale.
Migrations started with runway beat migrations started under renewal pressure on every dimension.
The cease and desist letters of 2025, sent to enterprises after support expired with off limits patch reminders and audit rights reserved, deserve a calm reading: they change nothing about the perpetual right itself, and they confirm Broadcom watches expired estates, which means the frozen posture is a documented posture or a liability. The entitlements archived, the patch boundary respected, the zero day carve out's limits understood, and the exit date planned around the hardware refresh: run that way, the frozen tier is a legitimate 2 to 4 year bridge, and run casually, it is an audit finding accumulating interest.
Your first five moves
- Split the estate by criticality before answering any quote, because the four options are a portfolio, not a choice.
- Scope any conversion to deployed components, against the 30 to 50 percent of the bundle wholesale converters never used.
- Price third party support for the stable tier, the 40 to 70 percent saving with a safety net attached.
- Plan frozen cluster exits around the hardware refresh, the clock that binds harder than the license paper.
- Start any migration with 18 months of runway, and refresh quotes quarterly because terms move. The Broadcom practice runs the strategy with you.
Frequently asked questions
Can you still use perpetual VMware licenses?
Yes: the perpetual right survived the Broadcom transition, and Broadcom's own knowledge base confirms ESXi hosts and vCenter keep operating normally with vMotion, snapshots, and every licensed feature intact after support expires. What ended is new support, no patch downloads, no service requests, no upgrade rights, and no new perpetual sales.
How long can a VMware estate run unsupported?
Most stable clusters run 2 to 4 years frozen before something forces a move, and hardware sets the harder boundary: a frozen vSphere 8 build carries a frozen compatibility list, so the next server refresh can strand it on uncertified silicon. CVE accumulation sets the other clock, so the frozen tier needs a written exit date planned around the refresh cycle.
Does Broadcom patch expired VMware estates?
Only narrowly: the zero day carve out covers vSphere 8.x with expired support for fixes scoring 9.0 or higher on CVSS, and nothing else. Version 7.x and earlier get nothing, as the March 2025 in the wild zero days demonstrated, and the 7.0 to 8.9 severity band where most exploitable hypervisor CVEs land stays unpatched, which is the honest boundary of the frozen posture.
What does converting to VCF or VVF cost?
Quotes ran 2 to 5 times prior support spend in our engagements, priced per core with a per CPU minimum so hardware density drives the bill, and estates that converted everything paid for components they never deployed, 30 to 50 percent of the VCF bundle sitting unused. The conversion belongs on the strategic, growing core only, scoped to deployed components, not on the whole estate.
Is third party support viable for VMware?
For stable production, yes: it prices 40 to 70 percent below the subscription quote and covers severity response and security advisories without new versions, the middle path between running frozen and converting. It fits clusters that need a safety net but not a roadmap, and it keeps the renewal leverage alive because the credible alternative is running, not theoretical.
What did the Broadcom cease and desist letters mean?
Enterprises reported letters in 2025 after support expired, reminding them patches were off limits and reserving audit rights: they change nothing about the perpetual right to run the licensed version, and they confirm Broadcom monitors expired estates. The response is documentation, entitlements archived, the patch boundary respected, and the frozen posture run as a documented bridge rather than a casual default.
