#5 Ranked · Top 10 EDR Tools in 2026 — Reviewed & Ranked by Security Experts

VMware Carbon Black (Broadcom)

by Broadcom Inc. (formerly VMware)

VMware Carbon Black Cloud is a cloud-native endpoint protection platform that combines NGAV, EDR, and continuous behavioral analytics on a single lightweight agent, known for its unfiltered, full-fidelity endpoint data recording.

Cloud (SaaS) — Carbon Black Cloud; On-Premise — CB Response (legacy, EOL transition ongoing)Mid-Market & Enterprise (100+ endpoints; best for forensic/compliance use cases) Founded 2002 Waltham, MA, USA (Broadcom HQ: San Jose, CA) Part of Broadcom (20,000+ post-VMware acquisition)

Starting Price

Contact Broadcom/Carbon Black for quote — estimated $50 $100/endpoint/year depending on tier

Visit WebsiteBack to Rankings

G2

4.3

Gartner

4.3

Capterra

4.2

Ratings & Reviews

G2

4.3/5

198 reviews

View on G2

Gartner

4.3/5

198 reviews

View on Gartner

Capterra

4.2/5

Key Features

  • Continuous Data Recording (All Endpoint Activity
  • Always)
  • Predictive Security Cloud (Behavioral Analytics)
  • Live Response (Remote Shell Access)
  • Attack Chain Visualization
  • NGAV + EDR in Single Agent
  • Watchlist Threat Intelligence Feeds
  • Managed Alerts (CBC Managed Detection)
  • Ransomware Protection & Rollback
  • CB Defense (Streaming Prevention)
  • VMware vSphere & vCenter Integration

Pros & Cons

Pros

  • +Industry-best forensic fidelity — records all endpoint activity
  • +not just alerts
  • +Excellent post-breach investigation and replay capability
  • +Strong VMware infrastructure integration
  • +Longest trial period (60 days)
  • +Good fit for compliance-heavy regulated industries

Cons

  • Broadcom acquisition has raised uncertainty about product roadmap
  • pricing
  • and support quality
  • Higher endpoint resource usage vs. competitors
  • UI and console experience lag behind CrowdStrike and SentinelOne
  • On-premise CB Response version being phased out
  • Some enterprise customers have reported post-acquisition support degradation

Best For

Compliance-driven organizations — financial services, healthcare, legal — that need complete, unfiltered endpoint activity recording for forensic investigation, regulatory audits, and post-breach analysis.

Target Audience

Enterprise, Government, Financial Services, Legal, Healthcare (compliance-heavy industries)

Key Integrations

VMware vSphereVMware NSXSplunkIBM QRadarServiceNowAWS Security HubAzure SentinelPalo Alto XSOAR

Competitor Tools

CrowdStrike FalconSentinelOne SingularityCybereason Defense PlatformMicrosoft Defender for Endpoint

Pricing

Model

Per Endpoint / Annual Subscription — Essentials, Advanced, Enterprise tiers

Starting At

Contact Broadcom/Carbon Black for quote — estimated $50 $100/endpoint/year depending on tier

Free Trial

Yes — 60-day trial available via Carbon Black sales

Company Info

Founded

2002

Headquarters

Waltham, MA, USA (Broadcom HQ: San Jose, CA)

Employees

Part of Broadcom (20,000+ post-VMware acquisition)

Company Size

Mid-Market & Enterprise (100+ endpoints; best for forensic/compliance use cases)

Funding

Acquired by Broadcom (NASDAQ: AVGO) in November 2023 for $61B

Certifications

SOC 2 Type II | FedRAMP In Progress | ISO 27001 | HIPAA | PCI DSS | CJIS

Awards & Recognition

Gartner Magic Quadrant — Endpoint Protection Platforms (listed, 2023) | SC Awards Finalist — Best Endpoint Security | Forrester Wave Notable Vendor — EDR Providers 2023

Official Website

VMware Carbon Black (Broadcom)

Visit VMware Carbon Black (Broadcom)
Back to Top 10 EDR Tools in 2026 — Reviewed & Ranked by Security Experts

Data sourced from G2, Gartner & Capterra · Verified by Firmographic