Carbon Black licensing under Broadcom. Why the renewal starts six months out.

Carbon Black is now sold by Broadcom's Enterprise Security Group alongside Symantec, with higher list prices and narrower discounts. Quotes arrive 60 to 90 days out while a replacement takes three to six months to evaluate, so the renewal has to start six months early.

What changed in Carbon Black licensing after the Broadcom acquisition?

Carbon Black is no longer a VMware product. Broadcom moved it into its enterprise security business alongside Symantec, consolidated the sales teams, reset the partner channel and replaced the VMware EULA with its own at renewal. The Carbon Black Cloud bundles survived, repackaged and repriced.

• November 22, 2023. Broadcom closed its acquisition of VMware, and Carbon Black came with it.
• Late 2023 into early 2024. Broadcom explored a sale of Carbon Black and put it on hold in February 2024 when bids fell short. Customers still cite that episode when they question the roadmap.
• March 2024. Broadcom merged Carbon Black and Symantec into a new Enterprise Security Group, which now quotes and sells Carbon Black renewals. Our guide to Symantec licensing under Broadcom covers the other half of the unit.

Why the quote date matters more than the list price

Renewal quotes now arrive 60 to 90 days before the term ends, where the VMware process started about six months out. A credible replacement takes three to six months just to evaluate, so a team that waits for the quote cannot finish the evaluation before the contract lapses.

Customers who start six months out can put a priced alternative on the table. Customers who start when the quote lands usually pay the uplift, because they have nothing else to sign.

How much does each Carbon Black bundle cost per endpoint now?

Current list runs from $50 to $70 per endpoint per year for Endpoint Standard up to $135 to $185 for XDR. Per endpoint list rose 10 to 40 percent across the tiers after the acquisition, and discounts shrink as the tier rises, so the net increase is steepest where customers spend the most.

What the tier names hide

Each tier is the one below it plus a module, on the same sensor and console. Threat hunting arrives only with Enterprise EDR, while Endpoint Advanced adds Audit and Remediation, so check which module your analysts use before you accept a tier change. Our Carbon Black XDR licensing guide covers the top tier on its own.

Which add ons are priced separately?

Container Security, Workload Protection and the managed detection overlay each carry their own price, as does Audit and Remediation when added to Standard. Each arrives as a separate quote line that can be negotiated or removed on its own.

List increases are the visible part of the change. The narrower discount and the Broadcom EULA persist, because they carry into every later term unless you negotiate them at this one.

How much does a Carbon Black renewal go up in practice?

Where Broadcom steered standalone Carbon Black SKUs into broader Symantec security bundles, renewals landed at 1.5 to 3 times the prior contract line. Like for like renewals rose for two reasons at once: higher list prices and multi year discounts 10 to 20 points narrower than before the acquisition.

A worked example on 4,000 endpoints

Say you run 4,000 endpoints on Endpoint Advanced. Last term you paid $70 list less 40 percent. At renewal the list is $80 and the discount has narrowed by 15 points to 25 percent. The figures are hypothetical, but each sits inside the ranges above.

The like for like renewal costs about 43 percent more before a single module is added. The bundle cases cost two to three times as much, and every added module needs a requirement your security team actually holds.

Why we push back on consolidating into the Symantec bundle

The usual advice is to accept the Symantec bundle because one vendor, one contract and one console look simpler. We disagree. In the renewals we reviewed, the uplift paid for capability the security team had never requested, and the promise of simplicity became the reason no one tested the price.

Ask for the standalone like for like quote first and treat it as the negotiating baseline. Add bundle components only against a written requirement from your security lead, and price each one separately.

What are the alternatives to Carbon Black, and what does switching cost?

Three platforms dominate the exit conversation: CrowdStrike Falcon, SentinelOne Singularity and Microsoft Defender for Endpoint P2. Their rates overlap with Carbon Black, so the decision turns on switch costs and on what you already own. Our CrowdStrike, SentinelOne and Defender comparison sets them side by side.

What the rate table leaves out

• Time. Full execution takes 12 to 18 months: agent rollout, console migration, tuning and a parallel run.
• Parallel licensing. Three to six months of paying for both products during cutover.
• Professional services. $20 to $75 per endpoint at scale.
• People. SOC retraining and rewritten detection rules and runbooks, a cost that rarely appears in the business case.

On the 4,000 endpoint example, services come to $80,000 to $300,000, and three to six months of parallel Carbon Black at the renewal rate adds $60,000 to $120,000. A replacement at a hypothetical $55 net per endpoint costs $220,000 a year, so year one totals $360,000 to $640,000.

Against the like for like renewal at $240,000, that replacement saves only $20,000 a year from year two, which would take many years to recover the switch cost. Against a bundle migration at $336,000 to $504,000, the saving is $116,000 to $284,000 a year. In most cases the priced alternative earns its keep by changing Broadcom's quote.

How to compare Defender P2 with a per endpoint price

Defender for Endpoint is licensed per user, and each license covers up to 5 devices. Servers are excluded and licensed separately, so convert both products to the same unit and add the server cost before you compare. Our Defender P1 versus P2 analysis covers the included versus standalone question.

Microsoft 365 E5 already includes Defender for Endpoint P2, which is why its effective cost inside E5 comes to $5 to $18 per endpoint. The extra spend is mostly servers, deployment and tuning, so Defender sets the reference point even where it does not win.

Can your Carbon Black reseller still renew your contract?

Possibly not, because only about 40 percent of VMware Carbon Black resellers kept Broadcom certification. Broadcom also moved enterprise tenants toward direct relationships and raised the volume floors partners must meet to earn discounts, so some partners lost the right to renew deals they originally sold.

Checks to run before the quote arrives

1. Get written confirmation that your partner can transact Carbon Black at your volume tier this year.
2. Check that partner against the Broadcom Symantec partner listing.
3. Ask Broadcom whether your account is now designated direct.
4. Record the source and date of every quote, then negotiate at the volume tier Broadcom recognizes with that evidence attached.

Account size changes the picture. A 1,500 endpoint customer may find few certified partners able to quote a useful discount. A 25,000 endpoint customer is more likely to be pulled into a direct relationship with a Broadcom account team.

How do you check how many Carbon Black endpoints you need to license?

Start in the Carbon Black Cloud console, not with last year's invoice. The Endpoints page lists every registered sensor with its status and last check in, and that list can include machines retired long ago.

• Stale sensors. Sort the Endpoints page by last check in and export it. Machines silent for 30 days or more are candidates to deregister before you give Broadcom a count.
• Old records. On the Endpoints page, open Sensor Options, then Sensor settings, and set the console to delete deregistered sensors after one day to one month. A separate setting deregisters VDI sensors automatically after a period of inactivity.
• Tier by policy group. Check which groups use Audit and Remediation or Enterprise EDR in practice. If kiosks or some server groups do not, ask Broadcom in writing whether those devices can be licensed at a lower tier.
• Microsoft entitlements. In the Microsoft 365 admin center, count users licensed for E5 or Defender for Endpoint P2 to see how much of the fleet Defender could cover without new spend.

The count you agree at renewal carries into later terms, and a reduction right is worth much less when it starts from an inflated number.

What will the Broadcom account team say, and how should you respond?

• "The standalone SKU is going away, so the bundle is your renewal path." Ask for the end of availability notice in writing, with dates and a mapping to the nearest like for like SKU. Price the bundle against that mapping, not against the bundle list.
• "The better rate needs a longer commitment." Accept a longer term only if the zero uplift price hold and the annual reduction right sit in the same signature.
• "This price holds until quarter end." That deadline helps you only if your alternative is priced by then. Get the validity date in writing and keep your RFP schedule; our note on Broadcom quarter end timing explains the calendar.
• "XDR adds the visibility your SOC needs." Ask your SOC lead whether network and identity telemetry is on their requirement list. If it is not, keep the current tier and use the swap right later.

Which contract terms should a Carbon Black renewal include?

Six clauses hold a Carbon Black renewal flat across its term, and each exists only if you negotiate it before signature. Once the order is booked, you have nothing left to trade for them.

One more term worth asking for

Ask for an extension option of three to six months at the renewal rate, exercisable at the end of the term. It covers a parallel run if you switch and removes the deadline Broadcom would otherwise hold over a late evaluation. Our guide to price caps in Broadcom contracts covers the wording.

An exit is only a real option if the evaluation starts before Broadcom sends the quote.

What have we seen in Broadcom security renewals in 2024 and 2025?

Across roughly 20 to 30 Broadcom security renewals I reviewed between 2024 and 2025, Carbon Black customers met the commercial approach Broadcom applied to VMware, now aimed at endpoint security. Two patterns stood out.

• Bundle migration drove the largest increases. Standalone SKUs were steered into Symantec bundles carrying capability the security team had not requested.
• 30 to 45 percent priced an exit. Roadmap uncertainty drove this as much as price. Whether or not those customers switched, a documented alternative changed the quote.

The customers who fared best worked to a fixed calendar, set out below.

The pattern matches the Broadcom VMware licensing changes, and the same two answers apply: a corrected endpoint count and a credible exit. Our VMware versus Nutanix cost comparison for 2026 shows the identical dynamic one product family over.

What to do next

1. Six months before the end date. Open the renewal review, well before the quote arrives.
2. This month. Confirm your partner's Broadcom certification and whether your account has moved to direct.
3. Before any count goes to Broadcom. Clean the sensor inventory and map tiers to the groups that use them.
4. During the review. Price CrowdStrike, SentinelOne and Defender P2 against the E5 licenses you already own, with switch costs included.
5. When the quote arrives. Refuse the bundle migration by default and negotiate from the standalone like for like price.
6. Before signature. Lock all six clauses. Our Broadcom practice can run the renewal with you.

Frequently asked questions