Carbon Black EDR Reviews & Product Details

Carbon Black EDR is a market-leading incident response and threat hunting solution designed to provide responders with the most information possible, accompanied by expert threat analysis and armed with real-time response capabilities to stop attacks, minimize damage and close security gaps. Carbon Black EDR makes these teams more efficient, reducing investigations from days to hours, and more effective, enabling them to discover threats before attacks can exploit them. Carbon Black EDR also allows teams to connect to and isolate infected machines to prevent lateral movement and remediate devices without costly IT involvement. Continuous and Centralized Recording Centralized access to continuously recorded endpoint data means that security professionals have the information they need to hunt threats in real time as well as conduct in-depth investigations after a breach has occurred. Live Response for Remote Remediation With Live Response, incident responders can create a secure connection to infected hosts to pull or push files, kill processes, perform memory dumps and quickly remediate from anywhere in the world. Attack Chain Visualization and Search Carbon Black EDR provides intuitive attack chain visualization to make identifying root cause fast and easy. Analysts can quickly jump through each stage of an attack to gain insight into the attacker’s behavior, close security gaps and learn from every new attack technique to avoid falling victim to the same attack twice. Automation via Integrations and Open APIs Carbon Black boasts a robust partner ecosystem and open platform that allows security teams to integrate products like Carbon Black EDR into their existing security stack.

Seller

Broadcom

Discussions

Carbon Black EDR Community

Languages Supported

English

Solution Type

Best-of-Breed

Overview by

Hope Boyer

Value at a Glance

Averages based on real user reviews.

Time to Implement

3 months

Return on Investment

16 months

View More Pricing Information

Top-Rated Alternatives

Microsoft Defender for Endpoint

4.4/5(314)

SentinelOne Singularity Endpoint

4.7/5(245)

Sophos Endpoint

4.6/5(852)

View All Alternatives

User Insights

Average based on 87 real user reviews.

Implementation Time

3 months

Perceived Cost

$$$$$

Carbon Black EDR Integrations

(2)

Integration information sourced from real user reviews.

Carbon Black EDR Reviews FAQs

Generated using AI

Last updated: Nov 04, 2026

What is Carbon Black EDR, and what problem is it built to solve?

Carbon Black EDR is used to monitor endpoint activity, help identify suspicious behavior, and support threat investigation and response. Its detailed endpoint records are especially useful for threat hunting and understanding how an incident unfolded.

What languages does Carbon Black EDR support?

Carbon Black EDR supports 1 language: English.

What company sizes and industries is Carbon Black EDR the best fit for?

Carbon Black EDR appears most suited to mid-market and enterprise environments, with users also coming from smaller organizations. The industries with the strongest representation include:

Company size: Mid-market and enterprise organizations.
Technology and security: Information technology and services, and computer and network security.
Other represented industries: Financial services, telecommunications, and oil and energy.

How long does it take to implement Carbon Black EDR across a team?

Implementation timelines vary, but teams most often report getting Carbon Black EDR live within one to three months or in less than a month. Longer deployments also occur, particularly where setup and tuning take more effort.

Time to go live	Relative frequency
1–3 months	Most commonly reported
Less than 1 month	Also commonly reported
3–6 months	Reported less often
6–12 months or longer	Less common
Less than 1 day	Reported occasionally

What customer support options does Carbon Black EDR provide, and how do users find the overall support experience?

Support is available through direct channels such as phone, email/help desk, and chat. The experience is mixed: users value helpful support, while others describe slow responses or difficulty getting issues resolved.

What features or capabilities could make Carbon Black EDR even more useful?

Carbon Black EDR could be easier to navigate and tune, particularly for teams handling searches, alerts, and investigations. Improvements that would make the experience more efficient include:

Make complex searches and investigation workflows easier to use, with clearer results and more flexible display options.
Provide more straightforward controls for tuning alerts and reducing false positives.
Simplify administration and configuration, with clearer in-product guidance and documentation.

Is Carbon Black EDR considered safe and secure for handling data?

Carbon Black EDR is used to monitor endpoint activity, investigate suspicious behavior, and help teams respond to threats. Its detailed event records and investigation tools can support threat hunting and incident analysis, though users also describe false positives and note that effective administration can require security expertise and ongoing tuning.

G2 reviews are authentic and verified.

Here's how.

Verified User in Computer & Network Security

Small-Business (50 or fewer emp.)

3/21/2024

"Good and easy to triage"

5/5

What do you like best about Carbon Black EDR?

Carbon Black is very user friendly, it is easy to use, great and fast implementation. Support is not the fastest. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

Support is not fast. I do not enjoy the new investigation tab and I can't change the size of the tab in search. Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic

Wakkas A.

Solution Architect

Automotive

Enterprise (> 1000 emp.)

Updated 1/2/2023

Originally submitted 12/17/2022

"VMWare Carbon Black ER"

4.5/5

What do you like best about Carbon Black EDR?

VMWare Carbon Black is a suitable Endpoint and Detection Security Solution. We are using it for threat hunting and Threat analysis. We are getting a lot of details from this product. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

We needed good customer support from the VMWare Carbon Black support team. Sometimes Support team takes a lot of time to provide a solution. We are tired of chasing the support team. Review collected by and hosted on G2.com.

Current UserValidated ReviewerIncentivizedSource: G2 invite

Shareek M.

Mid-Market (51-1000 emp.)

3/24/2023

"Reliable EDR for mid range organizations"

4.5/5

What do you like best about Carbon Black EDR?

Detections are very detailed, extremely granular logs. Does not hog system resources like some other AV solutions. Easy to use admin console. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

Integration with VMware's own Workspace ONE MDM was a pain. We cannot set it up without help from the vendor. VMware should think about merging both their MDM and EDR into a single console. Review collected by and hosted on G2.com.

Current UserValidated ReviewerSource: Organic

Verified User in Primary/Secondary Education

Enterprise (> 1000 emp.)

9/18/2023

"Provides excellent results"

4/5

What do you like best about Carbon Black EDR?

The results we are receiving have enhanced our security tremendously. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

You must have someone experienced to setup and configure. Review collected by and hosted on G2.com.

Current UserValidated ReviewerIncentivizedSource: G2 invite

Shagun J.

Senior Security Engineer

Enterprise (> 1000 emp.)

5/30/2023

"A very moderate EDR"

1.5/5

What do you like best about Carbon Black EDR?

1. The GUI of the VMware Carbon Black EDR is good.

2. The agent/sensor deployment was easier. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

1. Bad vendor support.

2. Wasn't able to detect and prevent a number of attacks.

3. A number of issues were observed with their agent/sensor. Issues like blue screen of death, high CPU utilization, bypassed agent, high disk space utilization etc.

4. Limited functionalities in their console.

5. Limited supportability for a number of OS versions. Review collected by and hosted on G2.com.

Validated ReviewerIncentivizedSource: G2 invite

vivek m.

Mid-Market (51-1000 emp.)

4/2/2023

Business partner of the seller or seller's competitor, not included in G2 scores.

"Best EDR endpoint protection solution"

5/5

What do you like best about Carbon Black EDR?

One of Carbon Black's advantages is that its platform goes beyond cyberattack defence and enables endpoint detection and reaction, a more sophisticated form of cybersecurity. (EDR). Businesses get a complete security option when combining EDR with its antivirus capabilities. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

It might impact computer performance and also needs more defensive abilities. There is no free trail available, so you must purchase it through partners. Processes are occasionally not adequately captured. Review collected by and hosted on G2.com.

Validated ReviewerIncentivizedSource: G2 invite

Jahanvi P.

Network Engineer

Small-Business (50 or fewer emp.)

12/14/2022

"Best for IOS users"

4/5

What do you like best about Carbon Black EDR?

It is compatible with IOS systems which is very rare in comparison to other VMware. It is easy to install and works smoothly without any hassle. I'm happy to use it. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

Well it is hard to say that VMware Carbon Black EDR has any downside, but yes after installation sometimes it takes time to open other operating systems in IOS system. Review collected by and hosted on G2.com.

Validated ReviewerIncentivizedSource: G2 invite

Kovendhan J.

Technical Consultant

Enterprise (> 1000 emp.)

Updated 11/18/2023

Originally submitted 12/10/2022

Business partner of the seller or seller's competitor, not included in G2 scores.

"Most celebrated EDR product"

5/5

What do you like best about Carbon Black EDR?

AV and response in a single shot. Advance detection techniques like ml and behavioral analysis technique to find the advanced malware. It has good sense attack prediction. Low resources consuming. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

Costing is the one of the concern area of carbon black so companies choose other products instead Carbon black, licensing could be feature based. Would be better it has some more AV functionality. Review collected by and hosted on G2.com.

Validated ReviewerIncentivizedSource: G2 invite

Sachin V.

Associate professional - Infrastructure

Mid-Market (51-1000 emp.)

12/14/2022

"Advance and Secure"

4.5/5

What do you like best about Carbon Black EDR?

The best thing about VMware Carbon Black EDR is the Live Response for remote remediation, where Security Administrators can securely identify and remediate issues remotely. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

The least helpful thing about VMware Carbon Black EDR is that it requires an understanding of core security and networking knowledge for administration, and it's complicated. Review collected by and hosted on G2.com.

Validated ReviewerIncentivizedSource: G2 invite

Abdul H.

Assistant Admin Officer

Mid-Market (51-1000 emp.)

Updated 2/26/2024

Originally submitted 12/5/2022

"VMware Carbon"

5/5

What do you like best about Carbon Black EDR?

Threat Hunting is the most liked feature. Also, the Customized Detection system is very helpful. Incident reporting is accompanied by notifications. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

In my opinion, the least likely feature is host isolation, and host isolation means we are isolating threats. Review collected by and hosted on G2.com.