VMware Carbon Black / vmware.com
AI-powered endpoint security and detection platform providing AI behavioural threat detection, EDR, and advanced protection for enterprise endpoints against sophisticated attacks.
Pricing
Free
Free plan
No
Category
Developer Tools
Platforms
3
Free plan
No
API access
No
Open source
No
Platforms
3
Carbon Black is VMware's (now Broadcom's) endpoint security and detection platform — providing endpoint protection, detection and response (EDR), and AI-powered behavioural threat analysis for enterprise endpoints. Broadcom acquired VMware in 2023, making Carbon Black part of Broadcom's security portfolio. AI-powered Behavioural Detection analyses process behaviour in real time — identifying attack patterns based on what processes do rather than what they look like, catching novel malware and living-off-the-land attacks that signature-based detection misses. Carbon Black Enterprise EDR provides the most comprehensive endpoint detection and response — continuous recording of all process, network, and file activity enabling retroactive threat investigation when an attack is discovered. Watchlist Intelligence applies threat intelligence to recorded endpoint data — automatically searching historical endpoint activity for indicators of compromise from new threat intelligence feeds. NGAV (Next-Generation Antivirus) within Carbon Black uses ML to prevent known and unknown malware without relying only on signatures. VMware Carbon Black Cloud is the cloud-native delivery model — replacing on-premise AV management infrastructure with cloud-managed endpoint security. Cloud Workload Protection extends Carbon Black to cloud VMs and containers — endpoint security for cloud infrastructure alongside traditional endpoints. With enterprise customers across financial services, government, and healthcare, Carbon Black validates for enterprises requiring deep EDR visibility and behavioural threat detection.
Carbon Black AI runs as ml platform software built around data workflows. Users typically start with a prompt, upload, or connected data source, and the underlying model handles the heavy lifting before returning a result you can refine or export. It's available on web, agent, and api.
The capabilities that matter most for teams evaluating Carbon Black AI.
Process behaviour threat analysis catching novel and living-off-the-land attacks — security beyond signature-based detection for sophisticated threats.
Continuous endpoint activity recording enabling retroactive investigation — tracing attack origin and lateral movement from historical process, network, and file records.
Endpoint security extending to cloud VMs and containers — consistent threat detection across traditional and cloud infrastructure.
Enterprise licensing. No public pricing. Annual contracts. Owned by Broadcom (VMware). Demo available.
Model
Enterprise
Starting price
Free
Free trial
Yes
CrowdStrike (covered) is the leading AI endpoint security platform. SentinelOne (covered) provides AI-native endpoint security. Microsoft Defender provides endpoint security within Microsoft. Palo Alto Cortex XDR provides extended detection.
A side-by-side look at the closest alternative in this category.
Key facts about model providers, platforms, and team support.
Model Provider
Broadcom, CarbonBlack
Platforms
Web, Agent, API
Deployment
SaaS, On-premise
Integrations
SIEM systems, Splunk, CrowdStrike (covered), ServiceNow, API
Team Collaboration
No
Launch Year
2022
Compliance signals and data-handling notes as reported by the vendor.
SOC 2 Type II. ISO 27001. GDPR compliant. FedRAMP eligible. Enterprise data handling agreements.
Endpoint telemetry and security event data processed on VMware Carbon Black Cloud. Continuous recording data stored for configurable retention periods for retroactive investigation.
Editorial Verdict
Carbon Black is a strong AI enterprise endpoint security platform for organisations wanting behavioural threat detection, deep EDR recording, and cloud workload protection within VMware/Broadcom's ecosystem.
Last verified July 24, 2026.
Enterprise licensing. No public pricing. Annual contracts. Owned by Broadcom (VMware). Demo available.
Enterprise pricing based on users and devices protected. Annual contracts. Contact Darktrace for pricing.
SOC 2 Type II. ISO 27001. GDPR compliant. FedRAMP eligible. Enterprise data handling agreements.
ISO 27001. SOC 2 compliant. GDPR compliant. FedRAMP authorised.
Endpoint telemetry and security event data processed on VMware Carbon Black Cloud. Continuous recording data stored for configurable retention periods for retroactive investigation.
Network traffic and device behaviour data processed by Darktrace's AI within the customer's environment or Darktrace's compliant infrastructure.
Verified reviews from signed-in users, stored in the backend and averaged into this tool's rating.
Sign in to rate Carbon Black AI and leave a review.
No other reviews yet — be the first to share how this tool performs in practice.
