Endpoint Standard, Advanced, Enterprise EDR, and Cloud Workload under Broadcom ownership. Our benchmark database covers 150+ Carbon Black enterprise renewals since the acquisition. Here is what the pricing data actually shows — and why renewals now look very different from pre-Broadcom contracts.
Per endpoint per year subscription, tiered by Carbon Black Cloud capability level; Cloud Workload priced per VM/workload
1–3 year subscription; Broadcom now prefers 3-year commits with front-loaded billing
15–30% off list (compressed from pre-Broadcom 30–42%); 25–35% with credible migration RFP in play
180 days strongly recommended under Broadcom; 120-day minimum due to compressed negotiation cycles
Carbon Black is now part of Broadcom's enterprise software division, following Broadcom's acquisition of VMware in November 2023. This shift fundamentally altered the commercial architecture of the product. Pre-Broadcom, VMware Carbon Black followed a conventional per-endpoint subscription model with flexible bundle options and a wide volume discount ladder. Under Broadcom, pricing discipline has tightened, the number of tier permutations has been reduced, and the negotiation power has concentrated in a smaller number of strategic account teams. For context on how Carbon Black fits in the broader market, see our enterprise cybersecurity pricing guide.
The Carbon Black Cloud product line today is organized into three endpoint tiers plus Cloud Workload Protection. Endpoint Standard delivers cloud-native NGAV prevention plus behavioral EDR, basic investigation, and policy enforcement. Endpoint Advanced adds vulnerability management, audit, and remediation capabilities suitable for compliance-focused organizations. Enterprise EDR is the full threat-hunting platform with watchlists, live response, and the complete investigation surface used by mature SOC teams. Cloud Workload Protection is a separately priced module for VM, container, and Kubernetes workload protection, priced per protected workload rather than per endpoint.
Two legacy products — Carbon Black App Control (formerly Bit9) and Carbon Black EDR (formerly Response, the on-premises product) — continue to exist but have been deemphasized under Broadcom. New customer acquisition on these products has largely halted, though renewal support continues for existing deployments.
The Broadcom ownership transition is the defining commercial reality for Carbon Black buyers in 2026. Broadcom's M&A strategy, consistent across Symantec, CA Technologies, and VMware, focuses on maximizing cash flow from a reduced customer base of large strategic accounts. The practical implications for mid-market and enterprise buyers below $500K annual commitment are substantial: narrower account team access, reduced procurement flexibility, compressed discount authorization, and renewal-cycle price increases that approximate enterprise software portfolio norms Broadcom applies across its acquired assets.
Our benchmark data across 150+ Carbon Black enterprise contracts, including the pre-Broadcom baseline and post-acquisition renewals, shows the following 2026 pricing profile. Where the pre-Broadcom range still applies (for larger strategic accounts with significant leverage), we note both data points.
| Tier / Product | List Price (per endpoint/yr) | 2026 Benchmark (Post-Broadcom) | Achievable Discount |
|---|---|---|---|
| Endpoint Standard | $30–$45 | $23–$36 | 18–28% |
| Endpoint Advanced | $45–$58 | $34–$46 | 20–30% |
| Enterprise EDR | $58–$72 | $44–$58 | 19–30% |
| Cloud Workload Protection (per workload/yr) | $150–$320 | $110–$240 | 18–27% |
| App Control (legacy Bit9) | $85–$150 | $65–$125 | 15–25% |
| Audit & Remediation Add-on | $12–$22 | $9–$18 | 18–25% |
A 10,000-endpoint Enterprise EDR deployment benchmarks at approximately $440K–$580K annually under current Broadcom pricing. Pre-Broadcom, the same scope benchmarked at $350K–$460K. This represents a 20–30% effective renewal cost increase on equivalent product scope, which is consistent with Broadcom's post-acquisition playbook observed across Symantec and CA Technologies portfolio assets.
Submit your renewal quote for a full pricing benchmark and migration economic analysis within 24 hours. Our database covers 150+ Carbon Black renewals under Broadcom — see exactly where your pricing stands and whether migration economics favor you.
Submit Your Contract →The single most important factor in Carbon Black discount negotiation under Broadcom is credible migration leverage. Without it, discount ceilings compress rapidly. With it, buyers still achieve meaningful negotiation outcomes, though not at pre-Broadcom levels.
Migration-credible negotiation: When Broadcom's account team receives documented evidence of an active RFP involving CrowdStrike Falcon, SentinelOne Singularity, or Microsoft Defender for Endpoint, discount authority expands. Our benchmark data shows 25–35% negotiated discounts in these situations, even at renewal. The key is that the RFP must be visible to Broadcom at executive level — not just a rep-level conversation. Procurement teams typically surface the RFP through a formal vendor communication at 150+ days before renewal.
Three-year commitment pricing: Broadcom strongly prefers 3-year commitments. In exchange, 5–10% additional discount is available on top of base negotiated pricing. The trade-off is worth analyzing carefully: a 3-year commit to a declining platform forfeits migration optionality, which is a material asset as the Carbon Black roadmap diverges from leading EDR platforms. Our benchmark recommendation for organizations seriously evaluating migration is a 1-year renewal or a 2-year term with strong termination-for-convenience protection.
Portfolio bundling with Broadcom assets: Broadcom's software portfolio includes Symantec endpoint, Symantec DLP, CA Technologies assets, and VMware vSphere. Organizations with multiple Broadcom portfolio entries occasionally unlock portfolio-level discount authorization. This is rare and requires an executive-level Broadcom relationship, but where it exists, effective discounting can reach 30–40%.
Fiscal year-end (October 31): Broadcom's fiscal year ends October 31. September and October close periods produce marginally improved discount authority. However, Broadcom's fiscal-year leverage is materially less than most cybersecurity vendors — their commercial discipline is consistent across quarters. A 2–5% improvement is typical, not the 10–15% seen at SentinelOne or Cybereason.
Volume tier thresholds: Broadcom has largely flattened the historical VMware volume tier structure. Marginal threshold benefits above 10,000 endpoints remain but below that, volume discount leverage is limited. Focus negotiation energy on per-endpoint discount percentage rather than chasing volume tier boundaries.
For the majority of Carbon Black enterprise customers, the decisive question is not negotiation tactics but strategic direction: stay or migrate. Our benchmark data across 150+ 2024–2026 Carbon Black renewals shows 42% resulted in partial or full migration. Here is the economic framework most commonly applied.
Three-year total cost comparison: Build a three-year total cost model including Year 1 migration cost and Years 2–3 license cost. Migration costs typically run $15–$35 per endpoint for straightforward EDR migrations (agent deployment, policy migration, SOC runbook updates). Complex environments with App Control dependencies, custom integrations, or regulated industries run $50–$100 per endpoint. A 5,000-endpoint migration typically runs $100K–$250K as one-time cost.
License cost delta: Carbon Black under Broadcom at renewal frequently produces 3-year license totals 25–40% higher than Falcon, SentinelOne, or Defender at equivalent scope. Add migration cost to the destination vendor's license total and compare to the Carbon Black renewal scenario. Migration breaks even between 14 and 22 months for typical Enterprise EDR deployments above $250K annually.
Operational risk assessment: Migration carries operational risk — parallel agent deployment, SOC runbook changes, temporary reduction in investigation velocity during team transition. Our benchmarks show the operational risk is typically overstated by incumbent vendor account teams. Modern EDR migrations can be executed in 60–90 days with well-defined playbooks. The largest risk is actually inadequate project management rather than inherent technical complexity.
Strategic commitment signal: Perhaps most importantly, the act of running an RFP and credibly threatening migration materially improves the Carbon Black renewal outcome even if you ultimately choose to stay. Organizations that run formal RFPs but renew with Broadcom routinely achieve 10–15 points better pricing than organizations that skip the RFP and renew directly.
150+ Carbon Black renewals analyzed across both migration and stay scenarios. Upload your renewal quote and get a full migration economic analysis in 24 hours — including side-by-side Falcon, SentinelOne, and Defender comparisons.
Submit Your Contract →Front-loaded three-year billing: Broadcom increasingly structures three-year Carbon Black commitments with billing heavily weighted to Year 1. This preserves Broadcom's cash flow but exposes customers to significant balance-sheet impact in the first year. Negotiate ratable billing across the full three-year term — Broadcom will agree on competitive renewals but rarely proposes it as the default structure.
Narrow product substitution rights: Carbon Black's commercial terms under Broadcom restrict the ability to substitute licenses between product tiers or between endpoint types during the term. If a customer license profile changes — say, reducing endpoint count but adding cloud workloads — Broadcom's default position is to sell the new capability at list while maintaining the original commitment. Negotiate explicit conversion rights between Carbon Black products at contracted discount rates.
Eliminated add-on bundling: Pre-Broadcom, Carbon Black bundled audit and remediation, vulnerability management, and threat intelligence into several cross-tier packages. Post-Broadcom, these capabilities are more frequently surfaced as separate add-ons at list pricing. Review your current deployment scope and ensure the renewal quote does not split previously-bundled capabilities into separately-priced line items.
Aggressive automatic renewal provisions: Broadcom's standard agreement contains automatic renewal provisions with 60–90 day opt-out notification requirements. Convert to manual renewal or reduce the opt-out window to 30 days. Missing the window locks the enterprise into another full term at list-plus-escalator pricing.
True-up at list: Carbon Black's standard true-up provisions allow Broadcom to bill new endpoints at current list pricing — not contracted discount. This is a material financial exposure in growth-mode organizations. Negotiate a pre-agreed expansion rate matching your contracted per-endpoint price, with a reasonable cap structure.
Professional services attach: Broadcom's services-attach model frequently bundles onboarding or advanced configuration services at elevated day rates. Evaluate the services quote separately — in most deployments, the technical migration or deployment work can be accomplished through reseller channel partners at 30–50% lower day rates than Broadcom's direct services pricing.
Carbon Black renewals under Broadcom follow a different pattern than pre-Broadcom. Expectations should be recalibrated. Historical vendor relationships, reseller leverage, and VMware-era commercial flexibility have all narrowed.
Renewal conversations open with a list-price increase — typically 15–40% above the prior-term unit cost. This is not a negotiating posture but Broadcom's starting position. Buyers who respond with acceptance or minor pushback consistently pay above benchmark. Buyers who respond with a formal competitive evaluation and 150+ day runway negotiate the increase down to 0–15% or occasionally achieve flat or decreased pricing when migration signals are strong.
What remains negotiable: the discount percentage on new or expanded scope. If the organization is adding endpoints at renewal, Broadcom will generally match the contracted discount for incremental volume rather than pricing at list. Bundle expansion is another lever — adding Audit & Remediation or Cloud Workload Protection at renewal can pull the composite discount higher, particularly when Broadcom's sales team is measured on bundle attach rates.
What does not change: Broadcom's strategic direction. For mid-market customers below $250K annual commitment, Broadcom's account team engagement will remain limited. For enterprise accounts above $1M, direct executive engagement is available but the commercial terms are still structured around Broadcom's cash-flow maximization strategy. The renewal will not look like the VMware-era experience regardless of negotiation skill.
Endpoint Standard runs $30–$45/endpoint/year list. Endpoint Advanced runs $45–$58. Enterprise EDR runs $58–$72. Cloud Workload Protection runs $150–$320 per workload per year. Post-Broadcom negotiated discounts have compressed to 15–30% from the pre-Broadcom 30–42% range. A 10,000-endpoint Enterprise EDR deployment benchmarks at $440K–$580K annually.
Yes. Renewal increases of 15–40% on existing customers at first renewal under Broadcom. Narrowed product tiers with fewer bundle options. Reduction in mid-market quoting support. Elimination of historical volume tier discounts. Large enterprise customers still negotiate, but the floor has risen and discretion has narrowed.
42% of Carbon Black renewals in 2024–2026 resulted in partial or full migration to Falcon, SentinelOne, Defender, or Cybereason. Migration cost is typically $15–$35 per endpoint. Three-year total cost comparison favors migration for contracts above $250K annually in most cases. Migration breaks even between 14 and 22 months.
15–30% off list for standard enterprise renewals. 25–35% when a credible migration RFP is visible to Broadcom's executive team. Three-year commitments add 5–10%. Portfolio bundling with Symantec or VMware assets occasionally unlocks 30–40% composite pricing but requires executive-level Broadcom engagement.
For greenfield endpoint security deployments in 2026, Carbon Black is rarely the optimal choice. Broadcom's roadmap signals prioritize large strategic accounts. New customers in 500–5,000 endpoint range typically receive less attentive pricing and support relative to Falcon, SentinelOne, or Defender quotes. Carbon Black remains viable where App Control or Carbon Black EDR is architecturally embedded.
Our benchmark database covers 150+ Carbon Black enterprise renewals under Broadcom ownership. Submit your proposal and receive a full analysis — per-endpoint benchmarks, migration economic model, and negotiation recommendations — within 24 hours.