Broadcom Carbon Black Threat Detection and Response

Name: Broadcom Carbon Black Threat Detection and Response
Brand: Broadcom
Rating: 4 (295 reviews)

Leader

Broadcom provides semiconductors and infrastructure software for global organizations’ complex, mission-critical needs

Est 1961|Valuation $1764B

LinkedIn 446K|Website|Web traffic 4.0M|FTEs 33,000|HQ Palo Alto, California, US

MarketsSecurity Information and Event Management (SIEM)Endpoint Security (EPP/EDR)

Broadcom Carbon Black Threat Detection and Response screenshot

Published Oct 9, 2026

01Common complaints

1) Organizations lacking detection engineering maturity - Deployments may require substantial tuning to achieve acceptable alert levels; vendors or alternatives that provide more managed or lower-noise options may be preferable for teams without detection engineering resources. 2) Organizations highly sensitive to commercial or channel uncertainty - If procurement risk from vendor consolidation or contracting posture is a critical factor, evaluate vendors with a channel and support model aligned to organizational risk tolerance. 3) Organizations requiring published, self-serve pricing - If procurement requires publicly posted list pricing and self-serve purchase, a quote-based enterprise offering may not meet that requirement; consider alternatives with clearer self-service purchasing models. 4) Environments with fragile or highly constrained endpoints - Prioritize pilot validation when agents may interact with critical systems (for example, clinical devices or tightly constrained VDI environments) before broad deployment. 5) Requirements for capabilities outside the product’s typical scope - If endpoint firewall management or other specialized capabilities are required and not included in Carbon Black bundles under consideration, evaluate vendors that explicitly include those modules. **Operational / service issues (publicly observed) - Public operational notices have referenced alert and event-processing delays in Carbon Black Cloud regions. **Deprecations / platform changes** - Notices indicate end of support for specific deployment modes (for example, container mode) and a focus on other modes (for example, RPM mode), which may require migration planning. **Limitations implied by user discussions** - High tuning requirements are commonly reported in community discussions. - Agent stability incidents have been reported by some users; organizations should validate agent behavior in pilot testing. **Roadmap visibility** - Public roadmap details are limited; enterprise customers typically obtain more detailed roadmap information under NDA.

Deal disqualifiers (poor fit)

Very lean IT/security teams unable to invest in tuning and workflow setup.
Environments with critical endpoints that cannot tolerate potential agent instability without a validated pilot.

02Why they buy

**Strengths supported by practitioner commentary** - Detailed endpoint telemetry that supports threat hunting and forensic investigation in environments with detection engineering resources. - Live Response remote-access workflows that enable incident responders to collect artifacts and perform remediation actions on endpoints. **Differentiation caveat** - Achieving the benefits associated with these capabilities typically requires investment in tuning and operational processes; organizations should plan for detection engineering and pilot validation.

03Field reports

Note: Several industry review platforms restrict full review text behind logins. Where direct quotes are gated, findings are paraphrased and attributed to the platform or community. **Vendor-commissioned economic studies** - Forrester TEI and other vendor-commissioned studies exist for Carbon Black Cloud. These studies typically use a composite customer model and interviewed customers; they can illustrate potential value drivers but are not independent validations of ROI without examination of methodology and the underlying customer data. **Vendor and partner solution briefs** - Vendor and partner materials describe Live Response and EDR capabilities, including typical use cases for remote actions and forensic collection. **Critical evaluation of case materials** - ROI and security outcome figures in vendor-commissioned studies should be validated through customer references and pilot implementations. Buyers are advised to request full reports, interview referenced customers, and run pilots that measure alert volumes, analyst time, and response workflow effectiveness.

Analyst/review platforms

A vendor listing and review page exists for Carbon Black EDR on multiple review platforms; full review texts on some platforms may require login.
Publicly visible review summaries indicate that users report strengths in telemetry and live response workflows, and also report challenges with operational tuning and agent stability in some environments.

G2 (public snippets)

Several user snippets describe the product as providing strong endpoint detection and response capabilities and highlight Live Response as enabling incident responders to access hosts, collect forensic data, and perform remediation.
User feedback on G2 includes both positive comments on investigatory features and notes about interface complexity and tuning efforts.

Community forums (Reddit) — paraphrased user reports

- Positive reports: some practitioners report that Carbon Black Response provides a balance between telemetry fidelity and event latency, and that it has helped detect and block ransomware in specific incidents. - Critical reports: some users reported high alert volumes requiring significant tuning, agent stability issues (including reports of excessive log growth consuming disk), and some reports tying a particular agent version to system crashes. - Commercial concerns: community threads reference changes in pricing and support after the vendor's acquisition, which influenced consideration of alternative vendors in some cases. **Why customers selected the product (community signals)** - Depth of telemetry and capabilities for threat hunting and incident response. - Fit where organizations have existing Carbon Black deployments or prefer particular telemetry characteristics. **Reasons for churn or change consideration (community signals)** - Concerns about acquisition-related commercial/support changes. - High alert volumes and the need for significant detection engineering. - Reported agent stability incidents in some environments.

04Best fit

Company sizes (practical fit range)

Common fit: organizations with a substantial endpoint estate (mid-size to large) when a dedicated SOC or detection engineering function exists.
Smaller organizations may adopt the product when paired with MDR or MSSP support.

Industries / verticals

Observed adoption signals include healthcare and government/public sector, based on procurement listings and community discussion; both adoption and sensitivity to stability are reported in these sectors.

Roles and personas

Primary buyers: CISOs, security directors, SOC managers.
Primary users: threat hunters, detection engineers, incident responders, endpoint/security engineers.

Pain points addressed

Need for detailed endpoint visibility, attack investigation capabilities, and remote response actions.
Integration of endpoint telemetry into SIEM and broader security analytics workflows.

Qualification criteria (fit indicators)

Organizations that can staff rule tuning, watchlist development, triage processes, and sensor lifecycle management.
Organizations that require detailed telemetry for threat hunting and incident response.

05The pitch

**What the product does (objective value proposition)** Broadcom Carbon Black Threat Detection and Response is Broadcom’s endpoint threat detection and response (EDR) offering under the Carbon Black portfolio. In practice, it spans: - **Carbon Black Cloud** (SaaS) endpoint security capabilities (commonly marketed as Endpoint Standard / Enterprise EDR) focused on prevention, EDR telemetry, and response actions (for example, remote live response). - **Carbon Black EDR** (historically “Cb Response”, commonly on‑prem) focused on detailed endpoint telemetry, threat hunting, and incident response. Carbon Black is presented by the vendor as an enterprise endpoint security platform for detection, investigation, and response across endpoints, with integrations into SIEM/SOAR ecosystems and partner MDR services. **Target market and market positioning** - Primarily mid-market to enterprise security teams requiring EDR visibility, threat hunting, and incident response workflows. - Also used by organizations seeking an alternative to CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, or that have legacy Carbon Black deployments (Cb Response/Protect/Defense families) and require continuity. **Company background (founding year, HQ, leadership)** - Carbon Black originated as Bit9 (founded 2002) and later became Carbon Black. The current Carbon Black product line is part of Broadcom through a series of acquisitions. **Funding and growth: investment rounds, acquisitions, estimated customer count/revenue** Key ownership milestones relevant to buyer risk and roadmap: - The company was acquired in 2019 in a multibillion-dollar transaction; it later became part of a larger technology company through a subsequent corporate acquisition. Public descriptions of how Carbon Black is integrated vary by offering. Independent, verifiable customer counts or current revenue specifically for Broadcom’s Carbon Black line are not consistently disclosed in a single public metric; vendor materials may reference adoption without a consistent methodology. **Pricing model with specific tiers and costs where available** Broadcom does not consistently publish simple list pricing for Carbon Black EDR/Cloud on the main product pages; pricing is commonly provided via sales or partner quotes. Observations: - Third-party review sites indicate no standard public pricing for Carbon Black EDR. - Community anecdotes cite specific per-license deals, but these are not authoritative and may reflect legacy arrangements or specific contract terms. - Third-party pricing estimates exist but should be treated as directional unless validated via an official quote. **Total cost of ownership (TCO) considerations** Common TCO drivers reported by users and partners: - Operational overhead and tuning time: high alert volumes and watchlist tuning can increase analyst time and effort. - Data retention options: extended retention is often available as an add-on SKU, which can increase costs. - Deployment model differences: Cloud (SaaS) versus on‑prem EDR affect infrastructure, upgrades, backups, and administrative effort. - Post-acquisition vendor/contract changes: community discussions cite concerns about pricing changes and support experience following ownership transitions. **Key competitors (4–6 direct alternatives)** - CrowdStrike Falcon - Microsoft Defender for Endpoint (MDE) - SentinelOne Singularity - Sophos Intercept X - Trellix / McAfee endpoint offerings (depending on region) - Trend Micro endpoint/XDR

Get a comprehensive analysis of Broadcom Carbon Black Threat Detection and Response including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Oct 9, 2026

01Common complaints

Organizations lacking detection engineering maturity

Deployments may require substantial tuning to achieve acceptable alert levels; vendors or alternatives that provide more managed or lower-noise options may be preferable for teams without detection engineering resources.

Organizations highly sensitive to commercial or channel uncertainty

If procurement risk from vendor consolidation or contracting posture is a critical factor, evaluate vendors with a channel and support model aligned to organizational risk tolerance.

Organizations requiring published, self-serve pricing

If procurement requires publicly posted list pricing and self-serve purchase, a quote-based enterprise offering may not meet that requirement; consider alternatives with clearer self-service purchasing models.

Environments with fragile or highly constrained endpoints

Prioritize pilot validation when agents may interact with critical systems (for example, clinical devices or tightly constrained VDI environments) before broad deployment.

Requirements for capabilities outside the product’s typical scope

If endpoint firewall management or other specialized capabilities are required and not included in Carbon Black bundles under consideration, evaluate vendors that explicitly include those modules.

**Operational / service issues (publicly observed)

Public operational notices have referenced alert and event-processing delays in Carbon Black Cloud regions.

Deprecations / platform changes

Notices indicate end of support for specific deployment modes (for example, container mode) and a focus on other modes (for example, RPM mode), which may require migration planning.

Limitations implied by user discussions

High tuning requirements are commonly reported in community discussions.
Agent stability incidents have been reported by some users; organizations should validate agent behavior in pilot testing.

Roadmap visibility

Public roadmap details are limited; enterprise customers typically obtain more detailed roadmap information under NDA.

Deal disqualifiers (poor fit)

Very lean IT/security teams unable to invest in tuning and workflow setup.
Environments with critical endpoints that cannot tolerate potential agent instability without a validated pilot.

02Why they buy

Strengths supported by practitioner commentary

Detailed endpoint telemetry that supports threat hunting and forensic investigation in environments with detection engineering resources.
Live Response remote-access workflows that enable incident responders to collect artifacts and perform remediation actions on endpoints.

Differentiation caveat

Achieving the benefits associated with these capabilities typically requires investment in tuning and operational processes; organizations should plan for detection engineering and pilot validation.

03Field reports

Note: Several industry review platforms restrict full review text behind logins. Where direct quotes are gated, findings are paraphrased and attributed to the platform or community.

Vendor-commissioned economic studies

Forrester TEI and other vendor-commissioned studies exist for Carbon Black Cloud. These studies typically use a composite customer model and interviewed customers; they can illustrate potential value drivers but are not independent validations of ROI without examination of methodology and the underlying customer data.

Vendor and partner solution briefs

Vendor and partner materials describe Live Response and EDR capabilities, including typical use cases for remote actions and forensic collection.

Critical evaluation of case materials

ROI and security outcome figures in vendor-commissioned studies should be validated through customer references and pilot implementations. Buyers are advised to request full reports, interview referenced customers, and run pilots that measure alert volumes, analyst time, and response workflow effectiveness.

Analyst/review platforms

A vendor listing and review page exists for Carbon Black EDR on multiple review platforms; full review texts on some platforms may require login.
Publicly visible review summaries indicate that users report strengths in telemetry and live response workflows, and also report challenges with operational tuning and agent stability in some environments.

G2 (public snippets)

Several user snippets describe the product as providing strong endpoint detection and response capabilities and highlight Live Response as enabling incident responders to access hosts, collect forensic data, and perform remediation.
User feedback on G2 includes both positive comments on investigatory features and notes about interface complexity and tuning efforts.

Community forums (Reddit) — paraphrased user reports

Positive reports: some practitioners report that Carbon Black Response provides a balance between telemetry fidelity and event latency, and that it has helped detect and block ransomware in specific incidents.
Critical reports: some users reported high alert volumes requiring significant tuning, agent stability issues (including reports of excessive log growth consuming disk), and some reports tying a particular agent version to system crashes.
Commercial concerns: community threads reference changes in pricing and support after the vendor's acquisition, which influenced consideration of alternative vendors in some cases.

Why customers selected the product (community signals)

Depth of telemetry and capabilities for threat hunting and incident response.
Fit where organizations have existing Carbon Black deployments or prefer particular telemetry characteristics.

Reasons for churn or change consideration (community signals)

Concerns about acquisition-related commercial/support changes.
High alert volumes and the need for significant detection engineering.
Reported agent stability incidents in some environments.

04Best fit

Company sizes (practical fit range)

Common fit: organizations with a substantial endpoint estate (mid-size to large) when a dedicated SOC or detection engineering function exists.
Smaller organizations may adopt the product when paired with MDR or MSSP support.

Industries / verticals

Observed adoption signals include healthcare and government/public sector, based on procurement listings and community discussion; both adoption and sensitivity to stability are reported in these sectors.

Roles and personas

Primary buyers: CISOs, security directors, SOC managers.
Primary users: threat hunters, detection engineers, incident responders, endpoint/security engineers.

Pain points addressed

Need for detailed endpoint visibility, attack investigation capabilities, and remote response actions.
Integration of endpoint telemetry into SIEM and broader security analytics workflows.

Qualification criteria (fit indicators)

Organizations that can staff rule tuning, watchlist development, triage processes, and sensor lifecycle management.
Organizations that require detailed telemetry for threat hunting and incident response.

05The pitch

What the product does (objective value proposition) Broadcom Carbon Black Threat Detection and Response is Broadcom’s endpoint threat detection and response (EDR) offering under the Carbon Black portfolio. In practice, it spans:

Carbon Black Cloud (SaaS) endpoint security capabilities (commonly marketed as Endpoint Standard / Enterprise EDR) focused on prevention, EDR telemetry, and response actions (for example, remote live response).
Carbon Black EDR (historically “Cb Response”, commonly on‑prem) focused on detailed endpoint telemetry, threat hunting, and incident response.

Carbon Black is presented by the vendor as an enterprise endpoint security platform for detection, investigation, and response across endpoints, with integrations into SIEM/SOAR ecosystems and partner MDR services.

Target market and market positioning

Primarily mid-market to enterprise security teams requiring EDR visibility, threat hunting, and incident response workflows.
Also used by organizations seeking an alternative to CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, or that have legacy Carbon Black deployments (Cb Response/Protect/Defense families) and require continuity.

Company background (founding year, HQ, leadership)

Carbon Black originated as Bit9 (founded 2002) and later became Carbon Black. The current Carbon Black product line is part of Broadcom through a series of acquisitions.

Funding and growth: investment rounds, acquisitions, estimated customer count/revenue Key ownership milestones relevant to buyer risk and roadmap:

The company was acquired in 2019 in a multibillion-dollar transaction; it later became part of a larger technology company through a subsequent corporate acquisition. Public descriptions of how Carbon Black is integrated vary by offering.

Independent, verifiable customer counts or current revenue specifically for Broadcom’s Carbon Black line are not consistently disclosed in a single public metric; vendor materials may reference adoption without a consistent methodology.

Pricing model with specific tiers and costs where available Broadcom does not consistently publish simple list pricing for Carbon Black EDR/Cloud on the main product pages; pricing is commonly provided via sales or partner quotes. Observations:

Third-party review sites indicate no standard public pricing for Carbon Black EDR.
Community anecdotes cite specific per-license deals, but these are not authoritative and may reflect legacy arrangements or specific contract terms.
Third-party pricing estimates exist but should be treated as directional unless validated via an official quote.

Total cost of ownership (TCO) considerations Common TCO drivers reported by users and partners:

Operational overhead and tuning time: high alert volumes and watchlist tuning can increase analyst time and effort.
Data retention options: extended retention is often available as an add-on SKU, which can increase costs.
Deployment model differences: Cloud (SaaS) versus on‑prem EDR affect infrastructure, upgrades, backups, and administrative effort.
Post-acquisition vendor/contract changes: community discussions cite concerns about pricing changes and support experience following ownership transitions.

Key competitors (4–6 direct alternatives)

CrowdStrike Falcon
Microsoft Defender for Endpoint (MDE)
SentinelOne Singularity
Sophos Intercept X
Trellix / McAfee endpoint offerings (depending on region)
Trend Micro endpoint/XDR