VMware Carbon Black

Behavioral EDR platform with continuous endpoint activity recording

ToolEndpoint & EDRCloud, Self-hosted

Pricing: From $52.99/endpoint/year / Enterprise custom

Reviewed by the Cyber Vendor Guide editorial team against the public sources cited below · Last reviewed February 2026 · How we review listings

What is VMware Carbon Black?

VMware Carbon Black Cloud is an endpoint protection platform that consolidates endpoint security using a single agent and console. Known for its behavioral EDR capabilities, it provides next-gen antivirus, EDR, managed detection, and audit and remediation. Its strength lies in continuous recording of endpoint activity for detailed threat analysis and compliance.

Best for: Enterprises needing deep behavioral analytics and continuous endpoint recording for compliance

Pros

Excellent behavioral analytics and event recording
Strong compliance and audit capabilities
Deep VMware infrastructure integration
Continuous recording enables retroactive threat hunting
Competitive entry-level pricing

Things to check

Agent can be heavier than competitors on endpoints
Console UI can feel less modern compared to newer platforms
Broadcom acquisition has created uncertainty
Detection rates lag behind CrowdStrike and SentinelOne in some tests

Reported in public reviews and vendor documentation. See sources below.

Key Features

Continuous endpoint activity recording

Behavioral threat detection and analytics

Next-generation antivirus

Live response for remote remediation

Managed detection and response (MDR)

Audit and remediation workflows

Workload protection for VMs and containers

VMware infrastructure integration

Do you work at VMware Carbon Black? to confirm the details or send us a correction.

Add the Cyber Vendor Guide badge to your site