Carbon Black Cloud review

Carbon Black Cloud is Broadcom’s cloud-native endpoint protection platform. A lightweight agent monitors endpoint activity, while a cloud console brings together endpoint security, workload protection, and IT operations. The stated aim is to detect, prevent, and remediate threats such as ransomware and fileless malware.

The product is sold in endpoint and workload offerings rather than as one clearly priced bundle. Endpoint Standard combines next-generation antivirus with behavioral detection and response. Enterprise EDR adds endpoint telemetry, attack-chain visualization, and threat-hunting tools. Audit and Remediation supports fleet-wide SQL queries and remote actions through Live Response. Workload Protection covers vulnerability assessment and runtime defense for virtual machines and containerized workloads.

Data Forwarder can stream endpoint and authentication events, alerts, and watchlist hits to cloud storage. That scope makes Carbon Black Cloud relevant to teams that need both endpoint response and workload security, but the available pricing information does not show which features come with each tier.

The feature set covers more than malware blocking. Endpoint Standard pairs antivirus with behavioral detection and response, while Enterprise EDR is positioned for teams that need telemetry, attack-chain views, and threat hunting. Audit and Remediation adds fleet queries and remote remediation, which can help security teams investigate and act without treating every endpoint as a separate task. Workload Protection extends coverage to virtual machines and containerized workloads.

That breadth matters if a team wants endpoint, workload, and investigation tools in one cloud console. Data Forwarder also offers a route for sending endpoint events, authentication events, alerts, and watchlist hits to cloud storage, though the published information does not specify destinations, retention, or volume limits.

There are some positive low-spec endpoint reports, but they are anecdotes, not a reliable performance comparison. In one r/sysadmin thread about switching from Sophos Central, one Carbon Black user said it ran smoothly on low-spec endpoints; another described Sophos slowing industrial Windows devices. Other commenters recommended evaluating competing products in a small pilot rather than choosing from marketing claims. Treat the resource-use reports as a reason to test on representative machines, not proof that Carbon Black will be lighter for your fleet.

The biggest buying drawback is price opacity. The available pricing information lists Endpoint Standard, Endpoint Advanced, Endpoint Enterprise, and Workload, but no monthly or annual prices, per-endpoint rate, or included feature breakdown. Sales quotes are required; a free trial is not published, and the pricing record does not list a free plan. No seat, endpoint, event-volume, retention, or other plan caps are published in the published material, so buyers cannot compare the tiers on those limits before talking to sales.

Support and administration deserve checking during evaluation. In one r/sysadmin thread, a Carbon Black Cloud customer described a confusing Azure IDP authentication migration; commenters disagreed on the right identity claim and entity ID. In another thread, users said removing a sensor can require an uninstall code or deleting the device from the portal, while the poster reported difficulty getting support. These are individual reports, not proof of a general support failure, but they point to questions worth resolving before rollout: test identity-provider migration, confirm sensor removal steps, and get support escalation terms in writing.

For a Sophos switch, Reddit comments about resource use conflict, and neither establishes comparative performance. Pilot both on the hardware and workloads that matter.

Carbon Black Cloud pricing is quote-based: the published pricing record lists no monthly or annual prices, starting price, or free trial. That means we can’t calculate the jump between tiers or compare per-endpoint costs from public figures. Get a written quote before treating any tier as within budget.

The listed plans are Carbon Black Cloud Endpoint Standard, Endpoint Advanced, Endpoint Enterprise, and Workload. The record does not publish plan inclusions, billing units, add-on prices, or discounts. It also does not say whether endpoint and workload protection are bundled, or whether contract length changes the rate. Don’t assume the plan names spell out the feature differences.

Ask sales to break out endpoint counts, workload coverage, included features, renewal terms, and any charges for data forwarding or support. The record lists no add-ons, but that is not confirmation that none are available. Pricing confidence is low, so verify the quote and contract directly before comparing it with another vendor.

The published material doesn’t document migration steps, deployment time, or the effort required to replace another endpoint agent. Treat those as pilot questions, not settled facts. Confirm how policy settings, exclusions, alerts, and historical telemetry move—or whether they need to be rebuilt. The docs or sales team should also clarify agent overlap and rollback before you schedule a cutover.

Carbon Black Cloud’s Data Forwarder streams endpoint events, authentication events, alerts, and watchlist hits to cloud storage. That gives teams a way to retain or route selected event data, but the material doesn’t establish that it exports all historical data or preserves it in a format another product can use. Check retention, fields, and export access before leaving. Live Response supports remote remediation; it is not described as a migration tool.

The review material flags uneven support reports, but supplies no Reddit thread details, so we can’t say what drove departures. Ask for support terms and escalation paths in writing. A pilot is sensible, especially if your team can’t absorb a drawn-out transition.