BlackBerry Cylance AI

Name: BlackBerry Cylance AI
Brand: BlackBerry
Rating: 4.5 (89 reviews)

Leader

BlackBerry helps organizations defend against cyberthreats

Est 1984|Valuation $6.5B|Raised $25M

LinkedIn 325K|Website|Web traffic 200K|FTEs 1,749|HQ Waterloo, Ontario, CA

MarketsCloud-Native Application Protection Platform (CNAPP)Endpoint Security (EPP/EDR)Endpoint Management (UEM)

Published Sep 26, 2026

01Common complaints

- If an organization requires a single consolidated XDR platform that deeply unifies identity, email, cloud app security, and endpoint with a large prebuilt ecosystem—other vendors may provide broader out-of-the-box correlation and response capabilities. - If support quality is a primary decision factor and the buyer cannot validate strong SLAs and escalation paths in the contract; community feedback indicates recurring support dissatisfaction in some cases. - If procurement policies disfavor post-acquisition uncertainty (branding, roadmap, or contract changes). The 2025 transfer of Cylance endpoint assets to Arctic Wolf creates a transition window during which product direction may change. - If the organization requires frequent, transparent, and independently validated efficacy data against current threat techniques. Some commonly cited validations are dated; buyers may prefer vendors with continuing participation in independent lab testing programs.

Deal disqualifiers (poor fit)

A requirement for integrated, best-in-class EDR/XDR hunting and response workflows in a single vendor suite
Low tolerance for support friction or inability to secure strong SLAs and escalation paths in contract
A procurement policy that is sensitive to active post-acquisition transitions and prefers vendors with a long-established, stable roadmap

Known themes from sources

Support responsiveness and incident handling is a recurrent theme in community feedback and should be part of procurement due diligence.
Product naming and packaging related to the Cylance brand are transitional following the Arctic Wolf acquisition, which can create ambiguity in SKU names and support responsibilities.

Roadmap and transition considerations

Following the acquisition, buyers should confirm:

Current product names and branding under Arctic Wolf
Upgrade and migration paths for existing agents
End-of-life timelines for older agents or consoles
Continued availability and procurement routes for government customers via reseller channels

02Why they buy

Characteristics cited in customer sentiment and historical reviews

Low endpoint resource usage and a small agent footprint, as reported in historical reviews and community commentary
Use of pre-execution machine learning models intended to block unknown threats without relying solely on signature-based detection

Claims that require validation

Numeric efficacy figures and broad predictive-performance statements are dependent on specific test methodologies and timeframe. Buyers should request current third-party test results and methodology details to validate these claims in their environment.

Areas where competitors have advantages

Broader telemetry, automated response workflows, threat hunting capabilities, and integrated XDR across multiple telemetry sources are areas where other vendors may have clearer advantages.

03Field reports

Review platforms: signals of satisfaction (and caveats)

- Vendor-published material reported a Gartner Peer Insights Customers’ Choice recognition for an endpoint protection product and summarized reviewer feedback indicating a substantial portion of customers would recommend the product based on a vendor-selected review set. This summary is vendor-presented and reflects aggregated outcomes rather than raw reviews. - TrustRadius hosts reviews for BlackBerry Protect (CylancePROTECT) and contains reviewer write-ups. - Capterra lists a product entry with an overall rating and indicative pricing information. - G2 has product pages for CylancePROTECT; listings and aggregated pros/cons should be treated as indicative and verified for context.

Direct quotes (positive and negative) from accessible sources

#### Reddit (negative/support concerns) - From r/Cylance (Jan 14, 2025) regarding console issues: - “It’s a shame that an excellent product like Blackberry Cylance is going down the drain due to poor support and service.” #### Reddit (mixed: technical reality / bypass is possible) - From r/Cylance (ransomware/bypass discussion): - “I’ve had experience of red teams bypassing CylanceProtect, Defender for Endpoint and Crowdstrike (seperately on different engagements).” #### MalwareTips forum (negative test narrative) - A MalwareTips “App Review” thread (user-generated testing) reports ransomware bypass and concludes: - “The antivirus was infected twice by Ransomware… I wouldn’t recommend it.” #### TechRadar (consumer product perspective; mixed) - TechRadar’s review of a consumer variant concluded it was apparently effective in some tests but criticized feature depth and user experience, noting limited features and an interface that the reviewer found clumsy.

Common reasons customers choose the product (from themes across sources)

Low resource usage at endpoints as reported by historical reviews and community comments
Use of pre-execution machine learning models designed to block unknown threats without relying strictly on signatures
Ability to provide some prevention functionality when endpoints have intermittent connectivity

Common reasons customers consider leaving / churn drivers (from community & context)

Support quality concerns (multiple community anecdotes)
Perception of slower product investment under prior ownership
Market shift toward EDR/XDR and managed services, where buyers prefer consolidated platforms with broad telemetry and managed detection capabilities

Forrester TEI (vendor-commissioned)

A Forrester Total Economic Impact (TEI) study exists for the CylancePROTECT and CylanceOPTICS bundle. TEI studies are typically commissioned by vendors and model a composite organization. Critical evaluation: - TEI results can be useful for building an ROI hypothesis but are not independent proof of outcomes for all environments. - Validate the study assumptions against the prospective buyer’s endpoint count, staffing model, incident rates, and expected tool consolidation savings.

Vendor-authored technical posts on specific protections

Vendor blog posts describe protection techniques and examples (for example, claims about blocking specific tools or techniques). These posts can be technically informative but are vendor-authored. Buyers should request reproducible test artifacts, detection identifiers, and details on how those protections are validated over time.

04Best fit

Company size

Typical adoption patterns suggest a focus on:

Mid-market to enterprise organizations (several hundred to many thousands of endpoints)
Public sector and government procurement channels may also be applicable through resellers and specialized distributors

Industries / verticals

Likely fits include healthcare, government, education, and other regulated environments where predictable endpoint performance is important and where procurement channels for government customers exist.

Roles and personas

Economic buyer: CISO / VP Security / Head of IT
Champions: Security engineering, endpoint engineering, IT operations
Daily users: SOC analysts and incident responders

Pain points addressed

Need to limit endpoint CPU and memory impact
Need for automated prevention approaches that do not rely solely on signature updates
Desire to simplify endpoint tooling if the product is adopted as primary EPP

Qualification criteria (good fit)

The organization can validate prevention efficacy in an appropriate test harness
SOC workflows and escalation procedures are defined and can ingest alerts from the product
Procurement teams are comfortable with post-acquisition governance and contractual clarity

05The pitch

What the product does (core value proposition)

BlackBerry Cylance AI refers to the machine-learning–driven endpoint security technology originally developed by Cylance and marketed by BlackBerry as part of its Cylance endpoint portfolio (commonly including CylancePROTECT for prevention and CylanceOPTICS for EDR-like visibility/analytics, plus related modules depending on packaging). The product uses pre-execution machine learning models for malware prevention, designed to minimize endpoint resource usage and to provide offline-capable detection when cloud connectivity is limited. BlackBerry documentation also describes CylanceINFINITY, a cloud-based AI/ML service used across certain BlackBerry Protect/UEM features (for example, URL and software risk decisions). The documentation includes statements about privacy practices for uploaded APKs and the use of TLS-encrypted connectivity.

Target market and market positioning

Historically, Cylance positioned its offering as a prevention-focused endpoint protection platform (EPP) based on machine learning, later broadening into enterprise endpoint security suites under BlackBerry (often sold to mid-market and enterprise customers, including regulated industries and government). Vendor marketing materials have emphasized predictive performance and AI-centric positioning. Since late 2024/early 2025, the market context changed materially: BlackBerry sold its Cylance endpoint security assets to Arctic Wolf (deal announced in late 2024; completion referenced by BlackBerry in early 2025). This creates buyer uncertainty around product roadmap, support continuity, branding, packaging, and long-term investment, although both BlackBerry and Arctic Wolf publicly emphasized continuity.

Get a comprehensive analysis of BlackBerry Cylance AI including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Sep 26, 2026

01Common complaints

If an organization requires a single consolidated XDR platform that deeply unifies identity, email, cloud app security, and endpoint with a large prebuilt ecosystem—other vendors may provide broader out-of-the-box correlation and response capabilities.
If support quality is a primary decision factor and the buyer cannot validate strong SLAs and escalation paths in the contract; community feedback indicates recurring support dissatisfaction in some cases.
If procurement policies disfavor post-acquisition uncertainty (branding, roadmap, or contract changes). The 2025 transfer of Cylance endpoint assets to Arctic Wolf creates a transition window during which product direction may change.
If the organization requires frequent, transparent, and independently validated efficacy data against current threat techniques. Some commonly cited validations are dated; buyers may prefer vendors with continuing participation in independent lab testing programs.

Deal disqualifiers (poor fit)

A requirement for integrated, best-in-class EDR/XDR hunting and response workflows in a single vendor suite
Low tolerance for support friction or inability to secure strong SLAs and escalation paths in contract
A procurement policy that is sensitive to active post-acquisition transitions and prefers vendors with a long-established, stable roadmap

Known themes from sources

Support responsiveness and incident handling is a recurrent theme in community feedback and should be part of procurement due diligence.
Product naming and packaging related to the Cylance brand are transitional following the Arctic Wolf acquisition, which can create ambiguity in SKU names and support responsibilities.

Roadmap and transition considerations

Following the acquisition, buyers should confirm:

Current product names and branding under Arctic Wolf
Upgrade and migration paths for existing agents
End-of-life timelines for older agents or consoles
Continued availability and procurement routes for government customers via reseller channels

02Why they buy

Characteristics cited in customer sentiment and historical reviews

Low endpoint resource usage and a small agent footprint, as reported in historical reviews and community commentary
Use of pre-execution machine learning models intended to block unknown threats without relying solely on signature-based detection

Claims that require validation

Numeric efficacy figures and broad predictive-performance statements are dependent on specific test methodologies and timeframe. Buyers should request current third-party test results and methodology details to validate these claims in their environment.

Areas where competitors have advantages

Broader telemetry, automated response workflows, threat hunting capabilities, and integrated XDR across multiple telemetry sources are areas where other vendors may have clearer advantages.

03Field reports

Review platforms: signals of satisfaction (and caveats)

Vendor-published material reported a Gartner Peer Insights Customers’ Choice recognition for an endpoint protection product and summarized reviewer feedback indicating a substantial portion of customers would recommend the product based on a vendor-selected review set. This summary is vendor-presented and reflects aggregated outcomes rather than raw reviews.
TrustRadius hosts reviews for BlackBerry Protect (CylancePROTECT) and contains reviewer write-ups.
Capterra lists a product entry with an overall rating and indicative pricing information.
G2 has product pages for CylancePROTECT; listings and aggregated pros/cons should be treated as indicative and verified for context.

Direct quotes (positive and negative) from accessible sources

Reddit (negative/support concerns)

From r/Cylance (Jan 14, 2025) regarding console issues:
- “It’s a shame that an excellent product like Blackberry Cylance is going down the drain due to poor support and service.”

Reddit (mixed: technical reality / bypass is possible)

From r/Cylance (ransomware/bypass discussion):
- “I’ve had experience of red teams bypassing CylanceProtect, Defender for Endpoint and Crowdstrike (seperately on different engagements).”

MalwareTips forum (negative test narrative)

A MalwareTips “App Review” thread (user-generated testing) reports ransomware bypass and concludes:
- “The antivirus was infected twice by Ransomware… I wouldn’t recommend it.”

TechRadar (consumer product perspective; mixed)

TechRadar’s review of a consumer variant concluded it was apparently effective in some tests but criticized feature depth and user experience, noting limited features and an interface that the reviewer found clumsy.

Common reasons customers choose the product (from themes across sources)

Low resource usage at endpoints as reported by historical reviews and community comments
Use of pre-execution machine learning models designed to block unknown threats without relying strictly on signatures
Ability to provide some prevention functionality when endpoints have intermittent connectivity

Common reasons customers consider leaving / churn drivers (from community & context)

Support quality concerns (multiple community anecdotes)
Perception of slower product investment under prior ownership
Market shift toward EDR/XDR and managed services, where buyers prefer consolidated platforms with broad telemetry and managed detection capabilities

Forrester TEI (vendor-commissioned)

A Forrester Total Economic Impact (TEI) study exists for the CylancePROTECT and CylanceOPTICS bundle. TEI studies are typically commissioned by vendors and model a composite organization.

Critical evaluation:

TEI results can be useful for building an ROI hypothesis but are not independent proof of outcomes for all environments.
Validate the study assumptions against the prospective buyer’s endpoint count, staffing model, incident rates, and expected tool consolidation savings.

Vendor-authored technical posts on specific protections

04Best fit

Company size

Typical adoption patterns suggest a focus on:

Mid-market to enterprise organizations (several hundred to many thousands of endpoints)
Public sector and government procurement channels may also be applicable through resellers and specialized distributors

Industries / verticals

Roles and personas

Economic buyer: CISO / VP Security / Head of IT
Champions: Security engineering, endpoint engineering, IT operations
Daily users: SOC analysts and incident responders

Pain points addressed

Need to limit endpoint CPU and memory impact
Need for automated prevention approaches that do not rely solely on signature updates
Desire to simplify endpoint tooling if the product is adopted as primary EPP

Qualification criteria (good fit)

The organization can validate prevention efficacy in an appropriate test harness
SOC workflows and escalation procedures are defined and can ingest alerts from the product
Procurement teams are comfortable with post-acquisition governance and contractual clarity

05The pitch

What the product does (core value proposition)

BlackBerry documentation also describes CylanceINFINITY, a cloud-based AI/ML service used across certain BlackBerry Protect/UEM features (for example, URL and software risk decisions). The documentation includes statements about privacy practices for uploaded APKs and the use of TLS-encrypted connectivity.

Target market and market positioning

Since late 2024/early 2025, the market context changed materially: BlackBerry sold its Cylance endpoint security assets to Arctic Wolf (deal announced in late 2024; completion referenced by BlackBerry in early 2025). This creates buyer uncertainty around product roadmap, support continuity, branding, packaging, and long-term investment, although both BlackBerry and Arctic Wolf publicly emphasized continuity.

Get a comprehensive analysis of BlackBerry Cylance AI including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →