Broadcom Carbon Black Threat Prevention

Name: Broadcom Carbon Black Threat Prevention
Brand: Broadcom
Rating: 4.4 (580 reviews)

Leader

Broadcom provides semiconductors and infrastructure software for global organizations’ complex, mission-critical needs

Est 1961|Valuation $1764B

LinkedIn 446K|Website|Web traffic 4.0M|FTEs 33,000|HQ Palo Alto, California, US

MarketsCloud-Native Application Protection Platform (CNAPP)Web Application & API Protection (WAAP)Security Service Edge (SSE)Security Information and Event Management (SIEM)Endpoint Security (EPP/EDR)Endpoint Management (UEM)

Broadcom Carbon Black Threat Prevention screenshot

Published Oct 9, 2026

01Common complaints

Deal disqualifiers (poor fit)

Very small IT teams without capacity for tuning and exception handling.
Environments that require fully offline console operations or exclusively on-prem management models (different product variants may be necessary).

Vendor-acknowledged / documented limitations

- Broadcom documentation notes that Endpoint Standard cannot be fully disabled using the default policy settings; partial disablement requires specific procedures and has caveats. (Broadcom KB: https://knowledge.broadcom.com/external/article/292184/endpoint-standard-how-to-disable-endpoin.html)

Platform reliability incidents (recent examples)

- March 5–6, 2026: alert processing delays in US infrastructure were resolved on March 6, 2026. (Status: https://status.broadcom.com/notices/rejdgxilv1eybcco-carbon-black-alert-processing-delays) - August 27, 2025: EU-region maintenance impacted policy, sensor updates, and quarantine/bypass actions. (Status: https://status.broadcom.com/notices/dkt77i6i9riofad7-carbon-black-cloud-endpoint-standard-prevention-eu-region-maintenance-august-27-2025)

Identity/auth migration friction (community-reported)

Administrators have reported migration-related friction around Broadcom Access / AuthHub and SSO expectations; these are anecdotal reports and should be validated with vendor documentation and account teams.

API lifecycle risk

API deprecation and deactivation events indicate that integration maintenance is an operational consideration. (Broadcom status notice regarding API deactivation: Sept 5, 2024).

02Why they buy

Unique selling points supported by customer feedback (neutral phrasing)

Detection and threat-finding capabilities are commonly noted in third-party reviews.
Process execution history and attacker behavior visibility are highlighted by reviewers as useful for investigations and threat hunting.

Differentiation that requires validation

Broad marketing claims should be validated through independent tests or pilot deployments, as third-party evidence varies by environment and use case.

Areas where competitors may have advantages

Published list pricing and pricing transparency (some competitors).
Bundling economics within larger vendor ecosystems (e.g., Microsoft).
Perceived support and operational experience in some customer segments.

Why customers chose Carbon Black (themes)

Common reasons cited by reviewers and discussion participants include:

Endpoint telemetry and process behavior visibility.
Malware detection and threat hunting capabilities.
Cloud-managed operations relative to on-prem management overhead.

03Field reports

Review platform snapshots

Gartner Peer Insights lists Carbon Black Cloud in Endpoint Protection Platforms with a favorable rating and a moderate review volume on the product overview page.
Review platforms such as G2 and TrustRadius present polarized feedback, with both positive and critical reviews.

Direct quotes (balanced)

G2 (negative) - "Consistently poor experience with this product. Wasted time and money due to its behavior." (G2 review excerpt) - "Poor feedback on blocks resulting in silent block behavior that results in wasted time troubleshooting…" (G2 review excerpt) G2 (positive/mostly positive) - "The product is good at stopping malicious software/behavior." (G2 review excerpt) Gartner Peer Insights (positive) - "Great platform that has excellent malware detection and threat finding capabilities." (Gartner Peer Insights review excerpt) Gartner Peer Insights (critical: performance + false blocks + support) - "When the product actually works, it works very well… However… performance issues… intrusive scanning, and constant false blocks…" (Gartner Peer Insights review excerpt) - "What I like the least about this product is the technical support… extremely inefficient and frustrating…" (Gartner Peer Insights review excerpt) TrustRadius (positive, with caveats) - "Carbon Black Endpoint is used to detect malicious processes… detect a suspected compromised computer very quickly…" (TrustRadius review excerpt) Reddit (operational reality: false positives/noise) - "Anyone else seeing Carbon Black throwing false positives lately? We’re getting blocks on stuff like: MsMpEng.exe… Msiexec.exe…" (Reddit thread excerpt) - Another sysadmin comment: "you do need to tune it if you want to get more aggressive with prevention." (Reddit thread excerpt)

Why some customers leave / consider replacements (themes)

Recurring themes in critical feedback include:

Concerns about support quality and responsiveness after organizational changes.
Policy management complexity and operational noise (false positives).
Perceived performance impact from scanning or enforcement modes.
Preference for alternatives with different operational models or managed services ecosystems.

Forrester TEI (vendor-commissioned) — limitations

A Forrester Total Economic Impact™ study is available via third-party hosting. TEI studies commissioned by vendors are often useful for identifying cost categories and potential ROI, but the underlying assumptions should be validated against a buyer’s specific environment before relying on the quantified results. Critical evaluation: - Commissioned TEI studies use interviews and modeling with vendor-selected references; results are directional and require mapping of assumptions (endpoint count, staffing costs, incident rates) to the buyer’s environment.

Vendor performance claim example (methodology disclosed, but vendor-run)

A VMware internal analysis described cloud cost reductions by moving Carbon Black Cloud workloads to newer EC2 instance types. This analysis reflects vendor infrastructure efficiency and does not directly equate to customer pricing reductions.

Critical evaluation:

Vendor infrastructure efficiency claims are not equivalent to customer-facing TCO reductions without explicit pricing or contractual changes.

04Best fit

Company sizes

Most appropriate for mid-market to large enterprise environments (for example, several hundred to many thousands of endpoints) with staff capacity for policy tuning and exclusions.

Industries

Commonly referenced sectors include financial services, healthcare, and regulated government organizations based on review excerpts and use-case descriptions.

Roles/personas

Security operations (SOC analysts, incident responders)
Endpoint security engineers
IT operations teams responsible for deployment and ongoing policy management

Great-fit qualification criteria

Requirement for enhanced endpoint telemetry and investigation capabilities beyond basic antivirus.
Availability of staff or managed services to manage policy tuning and exception management.
Procurement via vendor/partner sales channels is acceptable.

05The pitch

What the product does (objective core value proposition)

Broadcom Carbon Black Threat Prevention typically refers to the prevention/NGAV layer delivered through the Carbon Black Cloud platform (often packaged as Endpoint Standard / Prevention). The product is designed to: - Prevent known and unknown malware using behavioral techniques and reputation/telemetry-driven detections. - Provide endpoint visibility, policy enforcement, and response actions (e.g., quarantine/isolation workflows depending on edition). - Support investigation workflows via a cloud console and APIs. Vendor documentation for Carbon Black Cloud Endpoint Standard describes the product as providing multiple layers of prevention to detect and block various types of attacks (Official product FAQ and vendor documentation).

Target market & positioning

Mid-market to enterprise security teams needing cloud-managed endpoint prevention (and optionally EDR/XDR/MDR add-ons depending on SKU).
Particularly applicable for organizations seeking behavior-centric telemetry and process lineage visibility and that can allocate resources for policy tuning.

Get a comprehensive analysis of Broadcom Carbon Black Threat Prevention including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Oct 9, 2026

01Common complaints

Deal disqualifiers (poor fit)

Very small IT teams without capacity for tuning and exception handling.
Environments that require fully offline console operations or exclusively on-prem management models (different product variants may be necessary).

Vendor-acknowledged / documented limitations

Broadcom documentation notes that Endpoint Standard cannot be fully disabled using the default policy settings; partial disablement requires specific procedures and has caveats. (Broadcom KB: https://knowledge.broadcom.com/external/article/292184/endpoint-standard-how-to-disable-endpoin.html)

Platform reliability incidents (recent examples)

March 5–6, 2026: alert processing delays in US infrastructure were resolved on March 6, 2026. (Status: https://status.broadcom.com/notices/rejdgxilv1eybcco-carbon-black-alert-processing-delays)
August 27, 2025: EU-region maintenance impacted policy, sensor updates, and quarantine/bypass actions. (Status: https://status.broadcom.com/notices/dkt77i6i9riofad7-carbon-black-cloud-endpoint-standard-prevention-eu-region-maintenance-august-27-2025)

Identity/auth migration friction (community-reported)

Administrators have reported migration-related friction around Broadcom Access / AuthHub and SSO expectations; these are anecdotal reports and should be validated with vendor documentation and account teams.

API lifecycle risk

API deprecation and deactivation events indicate that integration maintenance is an operational consideration. (Broadcom status notice regarding API deactivation: Sept 5, 2024).

02Why they buy

Unique selling points supported by customer feedback (neutral phrasing)

Detection and threat-finding capabilities are commonly noted in third-party reviews.
Process execution history and attacker behavior visibility are highlighted by reviewers as useful for investigations and threat hunting.

Differentiation that requires validation

Broad marketing claims should be validated through independent tests or pilot deployments, as third-party evidence varies by environment and use case.

Areas where competitors may have advantages

Published list pricing and pricing transparency (some competitors).
Bundling economics within larger vendor ecosystems (e.g., Microsoft).
Perceived support and operational experience in some customer segments.

Why customers chose Carbon Black (themes)

Common reasons cited by reviewers and discussion participants include:

Endpoint telemetry and process behavior visibility.
Malware detection and threat hunting capabilities.
Cloud-managed operations relative to on-prem management overhead.

03Field reports

Review platform snapshots

Gartner Peer Insights lists Carbon Black Cloud in Endpoint Protection Platforms with a favorable rating and a moderate review volume on the product overview page.
Review platforms such as G2 and TrustRadius present polarized feedback, with both positive and critical reviews.

Direct quotes (balanced)

G2 (negative)

"Consistently poor experience with this product. Wasted time and money due to its behavior." (G2 review excerpt)
"Poor feedback on blocks resulting in silent block behavior that results in wasted time troubleshooting…" (G2 review excerpt)

G2 (positive/mostly positive)

"The product is good at stopping malicious software/behavior." (G2 review excerpt)

Gartner Peer Insights (positive)

"Great platform that has excellent malware detection and threat finding capabilities." (Gartner Peer Insights review excerpt)

Gartner Peer Insights (critical: performance + false blocks + support)

"When the product actually works, it works very well… However… performance issues… intrusive scanning, and constant false blocks…" (Gartner Peer Insights review excerpt)
"What I like the least about this product is the technical support… extremely inefficient and frustrating…" (Gartner Peer Insights review excerpt)

TrustRadius (positive, with caveats)

"Carbon Black Endpoint is used to detect malicious processes… detect a suspected compromised computer very quickly…" (TrustRadius review excerpt)

Reddit (operational reality: false positives/noise)

"Anyone else seeing Carbon Black throwing false positives lately? We’re getting blocks on stuff like: MsMpEng.exe… Msiexec.exe…" (Reddit thread excerpt)
Another sysadmin comment: "you do need to tune it if you want to get more aggressive with prevention." (Reddit thread excerpt)

Why some customers leave / consider replacements (themes)

Recurring themes in critical feedback include:

Concerns about support quality and responsiveness after organizational changes.
Policy management complexity and operational noise (false positives).
Perceived performance impact from scanning or enforcement modes.
Preference for alternatives with different operational models or managed services ecosystems.

Forrester TEI (vendor-commissioned) — limitations

Critical evaluation:

Commissioned TEI studies use interviews and modeling with vendor-selected references; results are directional and require mapping of assumptions (endpoint count, staffing costs, incident rates) to the buyer’s environment.

Vendor performance claim example (methodology disclosed, but vendor-run)

Critical evaluation:

Vendor infrastructure efficiency claims are not equivalent to customer-facing TCO reductions without explicit pricing or contractual changes.

04Best fit

Company sizes

Most appropriate for mid-market to large enterprise environments (for example, several hundred to many thousands of endpoints) with staff capacity for policy tuning and exclusions.

Industries

Commonly referenced sectors include financial services, healthcare, and regulated government organizations based on review excerpts and use-case descriptions.

Roles/personas

Security operations (SOC analysts, incident responders)
Endpoint security engineers
IT operations teams responsible for deployment and ongoing policy management

Great-fit qualification criteria

Requirement for enhanced endpoint telemetry and investigation capabilities beyond basic antivirus.
Availability of staff or managed services to manage policy tuning and exception management.
Procurement via vendor/partner sales channels is acceptable.

05The pitch

What the product does (objective core value proposition)

Prevent known and unknown malware using behavioral techniques and reputation/telemetry-driven detections.
Provide endpoint visibility, policy enforcement, and response actions (e.g., quarantine/isolation workflows depending on edition).
Support investigation workflows via a cloud console and APIs.

Vendor documentation for Carbon Black Cloud Endpoint Standard describes the product as providing multiple layers of prevention to detect and block various types of attacks (Official product FAQ and vendor documentation).

Target market & positioning

Mid-market to enterprise security teams needing cloud-managed endpoint prevention (and optionally EDR/XDR/MDR add-ons depending on SKU).
Particularly applicable for organizations seeking behavior-centric telemetry and process lineage visibility and that can allocate resources for policy tuning.

Get a comprehensive analysis of Broadcom Carbon Black Threat Prevention including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →