Carbon Black gave the endpoint a memory.

The awkward thing about a trusted file is that it can betray you. In February 2013, Bit9, a company selling software designed to control what could run on a computer, disclosed that attackers had stolen a code-signing credential. They used it to sign malware. Three customers were affected. The credential that was supposed to make software reassuring had become a disguise.

Bit9’s explanation was painfully ordinary. Some computers inside its own network did not have its product installed. A security business had encountered the distance between a sound policy and a completely implemented one. Keep that distance in mind. It explains more about Carbon Black, the business Bit9 became, than a list of detection features ever could.

01 / Permission is only the beginning

Bit9 began in 2002. Its founders were Todd Brennan, Allen Hillery and John Hanratty. The premise behind application control was to reverse the familiar antivirus question. Instead of continually identifying everything bad, establish which software deserves permission to run. For a critical machine with a predictable job, that is an appealing bargain: fewer surprises, fewer unauthorized changes.

But permission cannot answer every investigative question. Which process launched another process? What connection followed? What happened before an alert appeared? In 2014, Bit9 acquired the separate Carbon Black company, whose approach included continuously recording endpoint activity. Control and visibility belonged in the same conversation. By 2016, the combined business had adopted the Carbon Black name.

The sequence matters. It would be too tidy to claim that the breach caused the acquisition. The public record does not establish that. What it does reveal is a company adding a second way to understand trouble: preserve the activity so investigators can reconstruct it later. Prevention could have a memory.

02 / The recorder and the rulebook

Today, Carbon Black is an enterprise security portfolio within Broadcom. Carbon Black Cloud supplies a shared endpoint sensor and console. Endpoint Standard combines next-generation antivirus with behavioral endpoint detection and response, usually shortened to EDR. Enterprise EDR adds cloud-based threat hunting and incident response. The separately named Carbon Black EDR also serves organizations that need on-premises investigation infrastructure.

App Control handles the rulebook: trusted software, approved changes and protections around files, devices, memory and the Windows Registry. Workload protection extends the portfolio to servers and cloud workloads. Audit and Remediation, also associated with Live Query, lets teams inspect endpoint conditions and take remote action. These are related purchases, not interchangeable names for one antivirus package.

The intended buyers are security operations teams, incident responders, IT departments and service providers. The useful distinction is less glamorous than the branding: can a team follow a sequence of behavior, search across machines and act on what it finds? Carbon Black’s developer network exposes APIs and integrations so that endpoint evidence can travel into a broader security operation.

03 / A customer wanted the tools to talk

A historical Samsung Research America case study offers a concrete example. Its security team evaluated endpoint products, replaced traditional antivirus with Cb Defense and emphasized integration with tools it already owned. The published account reports better prevention and visibility. Its test results belong to that customer’s evaluation, rather than a universal promise about every attack.

“Tools need to work together.”

Steven Lentz, Samsung Research America
Historical customer case study

That is a useful buying criterion. A detection that reaches the wrong console, or arrives without enough context, creates work before it creates protection. Carbon Black competes in the endpoint market alongside CrowdStrike, Microsoft, SentinelOne and Palo Alto Networks. Continuous recording is now a category expectation. Its combination of investigation tools, application control and deployment choices is the more useful place to examine fit.

04 / The price includes the people

The commercial model is enterprise software: subscriptions, licenses, support and services. Historically, pricing largely followed endpoint count. A meaningful current quote needs the product mix, deployment, contract term and service requirements. The operational bill also includes someone deciding which alerts deserve attention and which legitimate applications a policy must permit.

Carbon Black’s own rollout advice is refreshingly specific. For App Control, begin with low enforcement, then work toward medium and high. Establish trusted approval mechanisms. Examine the exceptions. Increase restrictions as the organization learns. That is a process a reader can borrow: inventory, observe, tune, enforce. Turning every restriction on immediately can interrupt legitimate work; collecting events without a response process can leave useful evidence unread.

A useful product demonstration should make that work visible. Ask the team to trace an event back to its origin, explain why a policy allowed or stopped it, and show how an investigator would respond. Then introduce a legitimate software change. The interesting question is whether the people responsible can distinguish an attack from an ordinary working day without rebuilding the investigation by hand.

There are technical boundaries, too. Endpoint Standard’s Monitored policy records activity but has no preventive capability. A missing sensor leaves a coverage gap. Application control needs ongoing attention when software changes. These conditions do not make the tools pointless. They explain why buying them and operating them are different commitments.

05 / A new owner. The same evidence problem.

VMware completed its acquisition in October 2019, paying $26 per share at an enterprise value of $2.1 billion. Broadcom acquired VMware in November 2023. Carbon Black subsequently joined Symantec in Broadcom’s Enterprise Security Group, and the 2024 Catalyst initiative gave regional partners responsibility for go-to-market and customer relationships.

In March 2026, Broadcom introduced Symantec CBX, a cloud platform combining Symantec technologies with Carbon Black EDR for teams with limited security resources. Packaging changes. Owners change. The stubborn question remains concrete: when a machine does something it should not, will anyone have enough evidence, enough time and enough authority to do something useful about it?