Carbon Black EDR Reviews & Product Details

Carbon Black EDR is a market-leading incident response and threat hunting solution designed to provide responders with the most information possible, accompanied by expert threat analysis and armed with real-time response capabilities to stop attacks, minimize damage and close security gaps. Carbon Black EDR makes these teams more efficient, reducing investigations from days to hours, and more effective, enabling them to discover threats before attacks can exploit them. Carbon Black EDR also allows teams to connect to and isolate infected machines to prevent lateral movement and remediate devices without costly IT involvement. Continuous and Centralized Recording Centralized access to continuously recorded endpoint data means that security professionals have the information they need to hunt threats in real time as well as conduct in-depth investigations after a breach has occurred. Live Response for Remote Remediation With Live Response, incident responders can create a secure connection to infected hosts to pull or push files, kill processes, perform memory dumps and quickly remediate from anywhere in the world. Attack Chain Visualization and Search Carbon Black EDR provides intuitive attack chain visualization to make identifying root cause fast and easy. Analysts can quickly jump through each stage of an attack to gain insight into the attacker’s behavior, close security gaps and learn from every new attack technique to avoid falling victim to the same attack twice. Automation via Integrations and Open APIs Carbon Black boasts a robust partner ecosystem and open platform that allows security teams to integrate products like Carbon Black EDR into their existing security stack.

Seller

Broadcom

Discussions

Carbon Black EDR Community

Languages Supported

English

Solution Type

Best-of-Breed

Overview by

Hope Boyer

Value at a Glance

Averages based on real user reviews.

Time to Implement

3 months

Return on Investment

16 months

View More Pricing Information

Top-Rated Alternatives

Microsoft Defender for Endpoint

4.4/5(314)

SentinelOne Singularity Endpoint

4.7/5(245)

Sophos Endpoint

4.6/5(852)

View All Alternatives

User Insights

Average based on 87 real user reviews.

Implementation Time

3 months

Perceived Cost

$$$$$

Carbon Black EDR Integrations

(2)

Integration information sourced from real user reviews.

Carbon Black EDR Reviews FAQs

Generated using AI

Last updated: Nov 04, 2026

What is Carbon Black EDR, and what problem is it built to solve?

Carbon Black EDR is used to monitor endpoint activity, help identify suspicious behavior, and support threat investigation and response. Its detailed endpoint records are especially useful for threat hunting and understanding how an incident unfolded.

What languages does Carbon Black EDR support?

Carbon Black EDR supports 1 language: English.

What company sizes and industries is Carbon Black EDR the best fit for?

Carbon Black EDR appears most suited to mid-market and enterprise environments, with users also coming from smaller organizations. The industries with the strongest representation include:

Company size: Mid-market and enterprise organizations.
Technology and security: Information technology and services, and computer and network security.
Other represented industries: Financial services, telecommunications, and oil and energy.

How long does it take to implement Carbon Black EDR across a team?

Implementation timelines vary, but teams most often report getting Carbon Black EDR live within one to three months or in less than a month. Longer deployments also occur, particularly where setup and tuning take more effort.

Time to go live	Relative frequency
1–3 months	Most commonly reported
Less than 1 month	Also commonly reported
3–6 months	Reported less often
6–12 months or longer	Less common
Less than 1 day	Reported occasionally

What customer support options does Carbon Black EDR provide, and how do users find the overall support experience?

Support is available through direct channels such as phone, email/help desk, and chat. The experience is mixed: users value helpful support, while others describe slow responses or difficulty getting issues resolved.

What features or capabilities could make Carbon Black EDR even more useful?

Carbon Black EDR could be easier to navigate and tune, particularly for teams handling searches, alerts, and investigations. Improvements that would make the experience more efficient include:

Make complex searches and investigation workflows easier to use, with clearer results and more flexible display options.
Provide more straightforward controls for tuning alerts and reducing false positives.
Simplify administration and configuration, with clearer in-product guidance and documentation.

Is Carbon Black EDR considered safe and secure for handling data?

Carbon Black EDR is used to monitor endpoint activity, investigate suspicious behavior, and help teams respond to threats. Its detailed event records and investigation tools can support threat hunting and incident analysis, though users also describe false positives and note that effective administration can require security expertise and ongoing tuning.

G2 reviews are authentic and verified.

Here's how.

Verified User in Manufacturing

Enterprise (> 1000 emp.)

8/6/2026

"Consistent Over the Years, but Limited Features Compared to Carbon Black Cloud"

3.5/5

What do you like best about Carbon Black EDR?

I like that it hasnt changed in the last 5-6 years that we have had despite it being bought by many companies. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

Its very limited on what it can do, I much rather we have Carbon Black Cloud which has more features. Review collected by and hosted on G2.com.

Current UserValidated ReviewerIncentivizedSource: G2 invite

Ernesto M.

IT Security Engineer

Mid-Market (51-1000 emp.)

2/17/2026

"Easy to Use, Powerful Automation and Integrations"

5/5

What do you like best about Carbon Black EDR?

It is very easy to use, it is a great tool, and it can integrate with many other solutions and also automate tasks and workflows. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

Pricing increased after the product was purchased by another company, besides that this is a great tool. Review collected by and hosted on G2.com.

G2 IconValidated ReviewerIncentivizedSource: G2 invite

Prajwal V.

Security Analyst

Enterprise (> 1000 emp.)

10/17/2024

"Robust EDR with excellent Incident Response Capabilities"

4.5/5

What do you like best about Carbon Black EDR?

We have been using Carbon Black EDR for quite some time and it is crucial for our security as our teams use it everyday. The amount of detail it can provide into our endpoints is amazing and works effectively in real-time detections. It's easy to implement, integrate, and their support team is awesome. The benefits heavily outweigh the downsides and it's one of the best EDR products I have ever seen. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

It requires occasional alert fine-tuning which is still common with most EDR's in the market and it also depends on an organization's environment. Review collected by and hosted on G2.com.

What problems is Carbon Black EDR solving and how is that benefiting you?

We use Carbon Black EDR to drastically reduce the threats our organization faces. It's been a game changer for Incident Response and Forensics helping us reduce our Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). Its detection capabilities help us with Advanced Threats that are often otherwise missed. Review collected by and hosted on G2.com.

Validated ReviewerIncentivizedSource: G2 invite

Verified User in Information Technology and Services

Mid-Market (51-1000 emp.)

10/23/2024

"Powerful Endpoint Visibility and Threat Hunting Tool"

4/5

What do you like best about Carbon Black EDR?

Carbon Black EDR excels in presenting deep visibility into endpoint activity, which is critical for real-time threat detection and response. The ability to quickly search through vast amounts of endpoint data allows for comprehensive threat hunting and investigation. Its centralized dashboard offers intuitive monitoring of all assets, making it easy to detect and respond to suspicious activity across the network. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

One of the downsides of Carbon Black EDR is the steep learning curve. While this is a strong tool, it can be overwhelming for less experienced users due to the depth of customization and complex query language. Additionally, it can generate a high number of false positives, which requires careful tuning to avoid alert fatigue. Resource consumption can also be an issue as it can affect endpoint performance on lower spec machines. Review collected by and hosted on G2.com.

What problems is Carbon Black EDR solving and how is that benefiting you?

Carbon Black EDR is solving the problem of real-time endpoint visibility and threat detection across our network, which is crucial for identifying and mitigating advanced cyber threats. By continuously monitoring and capturing endpoint activity, it helps us detect malicious behavior and respond to incidents quickly, reducing the risk of data breaches. It also addresses the challenge of root cause analysis, allowing us to trace the origins of an attack through detailed event logs and forensic data.

The benefit to our team is a more proactive security posture, improved incident response time, and the ability to perform advanced threat hunting to uncover hidden vulnerabilities. This has significantly improved our overall security operations and enhanced our defense against targeted attacks. Review collected by and hosted on G2.com.

Validated ReviewerIncentivizedSource: G2 invite

Martins O.

Cyber Security Analyst

Mid-Market (51-1000 emp.)

10/21/2024

"Endpoint Detection & Response (EDR) Software"

5/5

What do you like best about Carbon Black EDR?

Carbon Black EDR has the ability to monitor endpoints and capture how data is processed, file execution and file paths, and the network connection. It helps stop malicious processes and block attacks in real time. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

The cost of having Carbon Black for a small company with the ongoing operational cost. Review collected by and hosted on G2.com.

Validated ReviewerIncentivizedSource: G2 invite

Abhijeet K.

Cybersecurity Technical Writer

Small-Business (50 or fewer emp.)

Updated 10/28/2024

Originally submitted 10/10/2024

"My experience with the product was great!"

5/5

What do you like best about Carbon Black EDR?

The Corbon Black EDR is a powerful cybersecurity solution designed to provide real-time visibility into endpoint activities, enabling advanced threat detection and rapid incident response. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

No, I don't think there is anything I dislike about it. Review collected by and hosted on G2.com.

Validated ReviewerIncentivizedSource: G2 invite

MAHANTESH S H.

Lead Cybersecurity

Mid-Market (51-1000 emp.)

10/10/2024

"CB EDR"

4.5/5

What do you like best about Carbon Black EDR?

I like the real-time threat detection and prevention feature of CB EDR, continuous monitoring, behavioral analysis, and machine learning. Its focus on endpoint security, integration with various tools, and proactive threat hunting capabilities. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

Overwhelming Alerts, High resource requirements Review collected by and hosted on G2.com.

Validated ReviewerIncentivizedSource: G2 invite

Sri V.

Senior Manager - Cyber Security Governance & Compliance

Mid-Market (51-1000 emp.)

5/23/2024

"Best Detection and Response tools to Cyber Attacks"

5/5

What do you like best about Carbon Black EDR?

Comprehensive threat hunting, detection and response capability, which are mostly automated Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

nothing to dislike, while there are always opportunities for improvements to an already good tool Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic

Joevanne V.

Principal Security Architect and Engineer

Enterprise (> 1000 emp.)

3/4/2024

"VMware and now Broadcom have destroyed CBC"

0/5

What do you like best about Carbon Black EDR?

Ability to remotely remove malware without having to get hands on endpoint Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

Ever since VMware took over cbc has gone on a decline and support has become a huge disappointment Review collected by and hosted on G2.com.

Current UserValidated ReviewerSource: Organic Review from User Profile

Animesh R.

Senior Manager

Computer & Network Security

Enterprise (> 1000 emp.)

9/12/2023

"Corporate POV of VMware Carbon Black Next Gen AV(used- ChatGPT for clear writing)"

5/5

What do you like best about Carbon Black EDR?

Incredible Antivirus with Behavior Analysis:

I'm absolutely thrilled with the antivirus solution I've been using - it's truly next-gen! This software goes beyond traditional antivirus by delving into attacker behaviour patterns, making it a force to reckon with. It doesn't matter whether it's malware, those sneaky fileless threats, or the cunning living-off-the-land attacks – this antivirus has my back!

I can't stop raving about the VMware Carbon Black Cloud Endpoint Standard product. It's like having a digital guardian angel watching over my devices. The secret sauce? Well, it's got this AI technology called Next-Generation Antivirus (NGAV). Thanks to NGAV, it's become a pro at catching malware before it even has a chance to blink. I can sleep soundly knowing my digital world is safe and sound. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

Price and Documentation Concerns:

While I'm quite pleased with the antivirus itself, there are a couple of aspects that could use some improvement. The pricing can be on the steeper side, which might not be everyone's cup of tea. Additionally, I've noticed a lack of open documentation. Finding solutions or troubleshooting can sometimes be a bit tricky due to this. It would be great if there were more comprehensive resources available to help users navigate any issues that may arise. Review collected by and hosted on G2.com.

What problems is Carbon Black EDR solving and how is that benefiting you?

AI-Powered Detection, User-Friendliness, and Comprehensive Reporting Dashboard:

I'm truly impressed by the AI-based detection capabilities, the user-friendly interface, and the richness of the reporting dashboard. Additionally, I appreciate how seamlessly it integrates with EDR by allowing you to work with 'whitelisted' hashes, making scans more efficient by ignoring known safe files.

we use it, as we are product based company and dev applications are not signed and usually get flagged as 'malware' Review collected by and hosted on G2.com.

Validated ReviewerIncentivizedSource: G2 invite