Most of what gets written about a new AOS release is a feature list. That’s useful once, when you’re deciding whether to care. It’s much less useful when you’re the person who has to schedule the maintenance window, tell the customer what breaks, and justify why the cluster needs touching at all this quarter.
So this is NCI 7.5 read the other way round — from the upgrade plan backwards. These are the changes I’ve found myself actually pointing at in customer conversations over the last few weeks, plus where 7.5 now sits given that 7.6 has already shipped.
The release cadence is the real story
Before any feature, this: the way Nutanix ships has changed, and it changes how you plan.
The old three-branch model — LTS, STS and Extended STS — is retired. There’s now a single unified NCI stream, with AOS, AHV and the rest versioned and released together, and a feature release landing every six to nine months.
Each release carries roughly 15 months of active maintenance, then about 9 months of security-only fixes. Around 24 months in total. Practically, that means an upgrade every 12 to 18 months instead of settling onto an LTS build and leaving it alone for three or four years.
For a lot of the environments I work in, that’s a genuine shift in operating rhythm. Teams that were used to one big upgrade per hardware refresh now need a standing upgrade slot in the calendar. If you take one thing from 7.5, take that — and go map your current versions against their maintenance windows before you evaluate a single feature.
Security got the deepest investment
If you look at where the engineering effort went in 7.5, it went here. Two themes: containers, and key management under compliance pressure.
Flow now covers Kubernetes. The Flow Container Network Interface (CNI) plugin extends Nutanix Flow to Kubernetes workloads, with VPC-based networking spanning VMs and pods, including pod-to-VM traffic. If you’ve been running containers next to VMs with two disconnected security models, this is what joins them up. In my view it’s the single most significant feature in the release.
Traffic inspection without sitting inline. Service Insertion supports a virtual TAP mode, mirroring traffic out for deep packet inspection, analytics or threat detection — no appliance in the data path, which removes the usual objection to deploying one at all.
Policies are less painful to maintain. Exception groups let you exclude specific IP addresses inside an entity definition, which you’ll want the first time you deal with overlapping ranges. Removing intra-tier rules lets inbound and outbound rules take precedence, which cuts down the rule sprawl that accumulates in any policy set more than a year old. And policies now replicate across sites through the Entity Sync framework, up to 1,000 synced policies between Prism Central instances.
Keys can finally live somewhere else. vTPM on AHV integrates with external KMIP-based key management systems, so the keys sit in your KMS rather than inside the platform. On NC2 in Azure, Azure Key Vault is supported for encrypted clusters. Prism Central and Nutanix Key Manager can also be backed up together in one process — which quietly removes an ugly failure mode I’ve seen bite people: a restored Prism Central without the keys that belong to it.
Authenticated NTP. Small, and disproportionately useful if you’re audited. Clusters can authenticate their time source, closing off time-based manipulation. It comes up in almost every finance and defence conversation I have.
Resilience: denser nodes, smarter restarts
The number that changes designs is capacity — up to 185TB of all-flash per node, double the previous ceiling, while still holding a one-hour RPO. Fewer, denser nodes shifts the sizing conversation more than a spec bump normally would.
On the DR side, two changes are worth building a plan around:
- Mixed replication in a single Protection Policy. Sync, NearSync and Async can now coexist in one policy. Previously you split workloads across policies to get different RPOs; now the policy matches the application instead of the other way round.
- Recovery Plan Staging. You can pause automatic reverse replication — exactly what you want during a planned failover test, when the last thing you need is the platform helpfully replicating back over your source.
Scale ceilings moved as well: DR is certified to 10,000 VMs across all RPO types and 2,000 Volume Groups for synchronous replication, and Prism Central itself is certified for 10,000 VMs, 2,000 hosts and 25,000 categories per instance.
There’s also a VM startup policy for defining dependency chains, so a database comes up before the application server that depends on it. Anyone who has sat through a cluster restart powering VMs on by hand in the right order will understand why I’m listing it.
Running NCI on someone else’s array
NCI with External Storage was the one I didn’t see coming. NCI can now front Pure Storage FlashArray //X and //XL over NVMe-oF/TCP, with native asynchronous DR for the integration.
That matters commercially more than technically. A lot of the migration conversations I have stall on the same point — the customer bought an array two years ago and isn’t ready to write it off. Being able to bring Nutanix compute and management in without discarding that investment changes what those projects look like.
Day-2 work that gets shorter
- LCM Dark Site Orchestrator runs full-stack upgrades in air-gapped environments with no internet access. If you work in government or defence, you already know how many manual steps this replaces.
- Cisco multi-vNIC configuration can be applied during initial cluster creation through Foundation Central, instead of being corrected afterwards.
- Guest Customization Profiles automate sysprep, domain joins and IP configuration as part of provisioning.
Before you plan anything: 7.6 is out
AOS 7.6 was released on 27 July 2026, so 7.5 is no longer the newest build. 7.6 raises all-flash capacity to 307TB per node across up to 40 EDSFF NVMe drives, adds a 1 node / 2 disk fault tolerance mode, and lets two-node AHV clusters expand to three. External storage management moves into Prism Central with native Dell PowerStore support and DR alongside it. RHEL 9 support, the new Secure Access controls, and automatic upgrades to Autonomous NearSync for protection domains round it out.
Which makes the real question not “should we go to 7.5” but “which target do we pick, and when does our current build leave active maintenance.” Given the 15-month window, that second half is where I’d start.
What I’d build the case on
If I had to justify a 7.5 upgrade on three things: the Flow CNI plugin if there’s any Kubernetes near your Nutanix estate, external KMS for vTPM if compliance is setting your roadmap, and the dark site orchestrator if you run air-gapped. Those change what’s possible. The rest is welcome, but it changes what’s convenient — and convenience rarely wins a maintenance window on its own.
If you’re planning a move to 7.5 or 7.6 and want a second pair of eyes on the sequencing, get in touch — it’s most of what I do.
1 thought on “Nutanix NCI 7.5 updates”