Carbon Black under Broadcom, the renewal that opens six months out
Carbon Black now sits under the Broadcom Symantec Enterprise Security unit, not VMware: bundles were repackaged, the partner channel was reset, and renewal pricing followed the broader Broadcom playbook. The replacement timeline is three to six months minimum, and the quote arrives sixty to ninety days out, which is the whole strategic problem in one sentence.
Prepared by Redress Compliance · August 7, 2026 · Broadcom security advisory. Based on 20 to 30 Broadcom security renewals reviewed 2024 to 2025.
Executive summary
The bundle migration is the price increase. Standalone Carbon Black SKUs were steered into broader Symantec security bundles at 1.5 to 3 times the prior line, per endpoint list rose 10 to 40 percent across the tiers, and multi year discounts narrowed 10 to 20 points against pre acquisition renewals.
The uplift buys capability the security team did not request, which is exactly why accepting the consolidation as simpler is the expensive default.
The clock is the leverage problem.
Renewal quotes arrive on a sixty to ninety day cadence, replaced from the prior six month flow, while a credible replacement takes three to six months to evaluate and twelve to eighteen months to fully execute: agent rollout, console migration, tuning, and a three to six month parallel run.
Teams that open the conversation six months out hold leverage; teams that wait for the quote have no exit option and pay the uplift.
The replacement field has matured.
CrowdStrike Falcon at $60 to $220 per endpoint for enterprise SOCs, SentinelOne at $50 to $180 for automation focused mid market, and Microsoft Defender for Endpoint P2 at $5 to $18 effective inside an E5 estate, the option that reprices the whole conversation for Microsoft heavy environments.
In our reviews, roadmap uncertainty alone pushed 30 to 45 percent of estates to price an alternative.
The channel reset changes who can even quote.
Roughly 40 percent of VMware Carbon Black resellers retained Broadcom certification, enterprise tenants moved toward direct relationships, and volume floors for partner discounts rose, so the incumbent partner sometimes lost the right to renew the deal it sold.
Confirm certification, document quote sources, and negotiate at the recognized volume tier with the evidence attached.
The bundles and the benchmarks, tier by tier
| Bundle | Pre acquisition list, per endpoint year | Current list | Typical renewal discount |
|---|---|---|---|
| Endpoint Standard: NGAV plus behavioral EDR baseline | $40 to $55 | $50 to $70 | 30 to 45 percent |
| Endpoint Advanced: adds threat hunting | $60 to $80 | $75 to $95 | 25 to 40 percent |
| Enterprise EDR: full detection and response | $80 to $110 | $95 to $135 | 20 to 35 percent |
| XDR: network, identity, and cloud telemetry | $110 to $150 | $135 to $185 | 15 to 30 percent |
The discount narrows as the tier rises, and the add ons stack on top.
Audit and Remediation, Container Security, Workload Protection, and the managed detection overlay each price separately, and the commercial reset underneath, the Broadcom EULA replacing VMware's at renewal, arrived with the same signature.
The list movement is the visible half; the EULA swap and the discount compression are the halves that persist across terms.
The replacement field, honestly priced
| Option | Per endpoint year | Deployment | The honest fit |
|---|---|---|---|
| Renew Carbon Black | $50 to $185 | None | The status quo, priced by the table above |
| CrowdStrike Falcon | $60 to $220 | 3 to 6 months, medium tuning | Enterprise scale with a mature SOC |
| SentinelOne Singularity | $50 to $180 | 3 to 6 months, medium tuning | Mid market, automation focused |
| Microsoft Defender for Endpoint P2 | $5 to $18 effective with E5 | 4 to 8 months, high tuning | Microsoft 365 E5 estates, where it reprices everything |
The switch math includes what the rate table hides: twelve to eighteen months for full execution, three to six months of parallel licensing during cutover, professional services at $20 to $75 per endpoint at scale, and the SOC retraining and playbook redesign nobody budgets.
For E5 estates the Defender option connects to entitlements already owned, the same included versus standalone logic the Defender P1 versus P2 analysis works, which is why it anchors the comparison even where it does not win it.
The Carbon Black security licensing brief
The post acquisition framework: the bundle map, the benchmark rates, the replacement economics, and the six clauses that hold a renewal flat.
Get the white paper →The six clauses that hold the renewal
- Price protection: zero percent uplift across the multi year term, in writing.
- Right to reduce: fifteen to twenty percent endpoint count reduction per anniversary, because workforces shrink and estates consolidate.
- Right to swap: movement between Carbon Black bundles without penalty as the security architecture evolves.
- Co terminus: every Broadcom Carbon Black product aligned to a single anniversary, so the negotiation happens once with full weight.
- Benchmarking: an annual right to compare against published indices.
- Exit cooperation: data export, parallel run support, and decommissioning assistance included, because the exit priced at exit is priced by Broadcom.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across Broadcom security renewals, 2024 to 2025
Across roughly 20 to 30 Broadcom security renewals Fredrik Filipsson reviewed between 2024 and 2025, Carbon Black customers faced the broader Broadcom playbook applied to endpoint security:
Standalone SKUs steered into Symantec bundles carrying capability the security team did not request.
Driven by roadmap uncertainty as much as price, with the documented alternative moving the quote either way.
The calendar discipline decides the outcome: six months out, the strategic review opens and the alternative documents; four months out, the renewal quote is requested and the replacement RFP runs; two months out, the clauses negotiate and the contract locks.
Inside two months, the posture is defensive, accept the uplift or move under pressure.
The pattern is the Broadcom VMware playbook on a security estate, and the same two instruments answer it: the corrected base and the credible exit, with the Nutanix comparison showing the identical dynamic one product family over.
Your first five moves
- Open the renewal six months out, because the exit takes three to six months to price and twelve to eighteen to execute, and the quote arrives at ninety days.
- Confirm your partner's Broadcom certification now, since roughly 40 percent retained it and yours may have lost the right to renew.
- Price the replacement field honestly, CrowdStrike, SentinelOne, and Defender P2 against owned E5 entitlements, with the switch costs included.
- Refuse the bundle migration by default: the 1.5 to 3x buys capability nobody requested, and the standalone comparison is the negotiation.
- Lock the six clauses, price protection, reduction, swap, co terminus, benchmarking, and exit cooperation. The Broadcom practice runs the renewal with you.
Frequently asked questions
What happened to Carbon Black after the Broadcom acquisition?
It moved from VMware Security into the Broadcom Symantec Enterprise Security unit, with sales teams consolidated, the partner channel reset, the VMware EULA replaced by Broadcom's at renewal, and quote cadence tightened to sixty to ninety days.
The four Cloud bundles remain, repackaged, with per endpoint list up 10 to 40 percent.
How much did Carbon Black renewals increase under Broadcom?
Where standalone SKUs were steered into broader Symantec bundles, renewals ran 1.5 to 3 times the prior line, with multi year discounts narrowing 10 to 20 points against pre acquisition terms.
Current list runs $50 to $70 for Endpoint Standard up to $135 to $185 for XDR, with typical discounts of 15 to 45 percent by tier.
What are the alternatives to Carbon Black?
Three dominate the exit conversation: CrowdStrike Falcon at $60 to $220 per endpoint for enterprise SOCs, SentinelOne Singularity at $50 to $180 for automation focused estates.
And Microsoft Defender for Endpoint P2 at $5 to $18 effective inside an E5 estate, which reprices the whole comparison for Microsoft heavy environments.
How long does replacing Carbon Black take?
Twelve to eighteen months for full execution, agent rollout, console migration, and tuning, with three to six months of parallel licensing during cutover and professional services at $20 to $75 per endpoint at scale.
The evaluation alone takes three to six months, which is why the renewal conversation opens six months out or the exit is not real.
Did my Carbon Black reseller keep the right to renew?
Possibly not: roughly 40 percent of VMware Carbon Black resellers retained Broadcom certification, enterprise accounts moved toward direct relationships, and partner discount volume floors rose.
Confirm the certification on the Broadcom Symantec partner listing, document quote sources, and plan the partner transition before the renewal window compresses.
What should a Carbon Black renewal contract include?
Six clauses: written price protection at zero uplift across the term, a fifteen to twenty percent annual endpoint reduction right, bundle swap rights without penalty, co terminus alignment to one anniversary, an annual benchmarking right.
And exit cooperation covering data export and the parallel run.
Each only exists if negotiated before signature.
