LAS VEGAS – VMware’s Tanzu division is heading back to its roots as an application development platform that unlike many of its stablemates can operate outside of the VMware Cloud Foundation (VCF) ecosystem, though it’s also angling that platform diversity toward data and Mythos-derived AI security anxiety.

The most recent round of Tanzu updates focused the Pivotal-based platform on bolstering enterprise trust and adoption of open-source systems and the integration of data resources, updates that Tanzu VP and GM Purnima Padmanabhan told SDxCentral during an interview at this week's VMware Explore 2026 event more clearly positions Tanzu as the VCF platform-as-a-service (PaaS) layer.

Tanzu is Broadcom’s pre-engineered PaaS designed to run on top of VCP or any infrastructure-as-a-service (IaaS) platform. It stands apart from the VMware Kubernetes Service (VKS), which is a Kubernetes runtime and orchestration service that is included in VCF.

Padmanabhan explained that the latest Tanzu updates are a “doubling down” on Tanzu’s “original role” to “supply the ingredients to the application developer, namely Spring and Java,” the former being an open-source application framework for the latter, and also under the stewardship of Tanzu that sprang from VMware’s acquisition of Pivotal.

“Being able to then easily take that application, scan it, secure it, put it into a container, then be able to understand the deployment characteristics of an application based on the outcomes it needs,” Padmanabhan said, adding that it can then provision that application to underlying VMware Kubernetes Service (VKS) layer for deployment. “That is the value: code to production.”

That value has been updated with a more tightly integrated Data Services product that leveraged the previously released Tanzu Data Intelligence product and acts as Padmanabhan described as “our big data solution.”

Padmanabhan said that the Data Services component has a specific focus and competitor set in mind, noting that “Databricks is trying to come at this from ‘I already have data, let me do agents.’ We are coming at it as ‘I've already got agents and I've got data, let me put it in one platform’ so that you can move fast.”

And while the Tanzu platform and Tanzu agentic platform can run on any cloud, Padmanabhan noted that with Data Services “my primary focus is to keep it on VCF, mainly because data is different from the runtime. Data already has a locality and a gravity in your current data set.”

“I'm going after the budget of Snowflake and Databricks, where they are spending gobs and gobs of money just to take the data, put it there, and just give storage fees … and then pay for each time I query. it's like a crazy business model,” Padmanabhan continued. “So what I'm saying is, you've already got machinery, so what I can do is let me optimize the storage. Let me optimize how I store it. Let me optimize the difference between what I store in a cache versus what I store in a disk versus what I store in a flash versus in a disk. All those decision making I can do for you and give you the best value for your data [on-premises]. So for the data piece, the biggest value proposition we drive is on front line.”

Battling Mythos anxiety

Combined, those platforms now form the core components of the newly launched TrueSource by Broadcom offering that is “one brand for everything that we do to give customers secure, clean, open-source libraries and images,” Padmanabhan explained. And it's one neck to choke. So before they start building an application, they make sure when you're cooking this recipe, you're making sure the ingredients into that recipe are clean.”

That meal is likely most appealing to enterprises increasingly concerned by AI-derived security challenges. This has been a long-simmering issue that gained substantial steam earlier this year following Anthropic’s release of its Claude Mythos Preview.

“If the customer has Mythos, their anxiety is up there. The customers [that have] not seen it, they still don't realize the insane power of what this can do. Insane power. I was scared,” Padmanabhan said, semi-jokingly adding that she went home and told her spouse that they needed to empty their bank account and put the money into gold. “And it is the kind of vulnerabilities, the network accessible vulnerabilities, the kind of exploits, even changing kernel modules, we are scared, but anybody who has not seen Mythos doesn't understand.”

Padmanabhan explained that the Tanzu team tapped Mythos to scan for 2,000 vulnerabilities across nine microservices-based applications, each of which were running in a virtual machine (VM) environment, a containerized environment, and in a Tanzu environment. The results showed those applications running in the Tanzu environment were able to cut 60% of the exploits.

That result also provided Padmanabhan with confidence in moving all of the Tanzu software development life cycle itself to run on the Tanzu platform. This includes more than 20 agents tasked with requirements planning and management, writing and testing code, and writing architectural documents, with those agents integrated into engineering pods that have doubled their development feature velocity.

That structure does mean that Tanzu keeps a human-in-the-loop, something that Padmanabhan said remains critical.

“Let me not overstate it: The human in the loop is not only important, we found that AI just goes completely off track,” Padmanabhan said. “The problem with AI is it writes beautifully formatted code. It has got lipstick on. It's got its hair combed, etc., so you think it's perfect, and it's full of flaws. But for a human brain, an engineer who's doing quality assurance or an architect who's used to doing code reviews, they get tricked. So we found actually escape defects starting to increase.”

The Tanzu team is countering this by using a “board structure” where they have a “skeptic role” in every pod, with that person rotated within each pod. That person is tasked with starting their role thinking that AI has done something wrong and then reviewing that process.

“AI is dangerous,” Padmanabhan added. “This whole structure, I didn't just go and adopt it right away. I'm first of all running it on Tanzu platforms. Everything is sandboxed. I control the data it is given, and I change my organizational structure to say we don't fall into this, ‘oh, AI did a fix and AI is going to patch.’ We never create a patch with only AI. Never. Human-in-the-loop always.”