Carbon Black Response

An endpoint detection and response product for security operations and incident response teams that continuously records activity on endpoints and servers; renamed Carbon Black EDR in 2020 and now sold by Broadcom. Supported platforms are Linux, macOS, Windows and Windows Server. Recorded capabilities include behavioral detection, central management console and malware detection. It is aimed at Enterprise buyers. Carbon Black Response is sold on a quoted basis rather than at a published price.

Current Version

7.5.1

Product Page

broadcom.com/…/endpoint-detection…

Market

Enterprise

Licence

Paid

Price

Quote

Record Created

2026-08-20

Last Updated

2026-10-28

Carbon Black was one of the first companies to argue that endpoint security should record what happens on a machine continuously, the way a flight recorder does, so that an investigator can replay an intrusion rather than infer it from an alert. It came together from two firms: Bit9, an application allowlisting company, and Carbon Black, which made the recorder; they merged in 2014 and took the Carbon Black name in 2016. It has changed hands twice since. VMware bought it in 2019, and Broadcom acquired VMware in 2023, so the products are now part of Broadcom's security division alongside Symantec's enterprise range. The line still reflects both halves of the original merger: Carbon Black App Control is the descendant of Bit9's allowlisting product, still used to lock down fixed-function machines such as tills and industrial controllers, while Carbon Black Cloud Endpoint Standard and Carbon Black EDR carry the recording and detection side. Bit9 also appears separately in this index; it is the same lineage under its original name. Vendor page →

Website

broadcom.com

Country

🇺🇸United States

Headquarters

🇺🇸Waltham, United States

Year Established

2002

Customers

5,600 organisations

Users

10M devices protected

Revenue

$70.6M (2015)