Broadcom Carbon Black XDR. Enterprise Licensing.

Broadcom Carbon Black XDR is licensed per endpoint across bundle tiers, and the post acquisition repackaging is where enterprises quietly lose negotiated discount.

How is Broadcom Carbon Black XDR licensed in 2026?

Carbon Black is licensed per protected endpoint. Each agent on a server, workstation, or virtual machine counts as one endpoint, and the tier you assign decides the price per endpoint.

The model is simple to state and easy to overpay. The cost driver is not just the endpoint count but the tier you apply across those endpoints.

Broadcom documents the portfolio on the Carbon Black product page, and the broader licensing approach follows the Broadcom product and support terms.

What counts as an endpoint

An endpoint is any device running the agent. The count is broader than many buyers expect, and stale entries are common.

• Servers: physical and virtual, including short lived cloud instances.
• Workstations: laptops and desktops with the agent deployed.
• Virtual machines: every active VM image, which is where sprawl inflates the count.

Why endpoint hygiene lowers cost

Decommissioned machines that keep an agent record stay in the licensed count. Reconciling the agent inventory against live assets removes ghost endpoints you are still paying for.

What do the Carbon Black bundle tiers actually include?

Carbon Black sells in tiers that climb from prevention to full extended detection and response. Each step up adds capability and cost, and most estates do not need the top tier everywhere.

Mapping endpoint groups to the tier their risk justifies is the core discipline. A finance server and a kiosk do not need the same protection level.

Prevention and endpoint detection

The lower tiers cover next generation antivirus and endpoint detection and response. For low risk, low value endpoints this is frequently sufficient.

The XDR tier

XDR correlates telemetry across endpoint, network, and identity for advanced threat hunting. It carries the highest price and belongs on high value, high exposure assets, not the whole fleet.

How did Broadcom change Carbon Black terms after the acquisition?

After Broadcom acquired VMware, the Carbon Black portfolio was repackaged and renewals frequently default buyers into repriced bundles. The negotiated discount on the old SKUs does not always carry across.

Treat the first post acquisition renewal as a fresh negotiation, not a rollover. Confirm which bundle you are being moved to and whether your prior discount survives the migration.

Watch the default tier migration

• Confirm the SKU mapping: ask exactly which new bundle replaces each old one.
• Protect the discount: require your prior discount level to carry into the new packaging.
• Reject silent upgrades: do not accept a higher tier across the estate without justification.

Keeping a credible alternative

The endpoint security market is competitive. A live evaluation of a rival platform is the most effective check on a repackaged Broadcom renewal, even when you intend to stay.

Where the common advice on Carbon Black licensing is wrong

The standard Broadcom partner pitch is that standardizing the whole estate on the XDR tier simplifies operations and earns the deepest volume discount. We disagree. In roughly two thirds of the Carbon Black estates we benchmarked in 2024 and 2025, a large share of endpoints carried the top tier when a lower tier covered their real risk, so the volume discount never offset the tier overpay. The buyer side move is to segment endpoints by risk and value, license each group to the tier it genuinely needs, and reserve XDR for the high exposure assets where cross domain correlation earns its premium.

On a Carbon Black renewal the top tier across the whole fleet is the easy answer and the expensive one.

What buyer side moves cut a Carbon Black renewal?

The renewal turns on a clean endpoint inventory and a risk based tier map. Bring both, plus a competitive alternative, and the repackaged quote loses its momentum.

• Reconcile endpoints: remove ghost agents from decommissioned machines before the count is set.
• Segment by risk: assign each endpoint group the lowest tier that covers its real exposure.
• Protect the discount: require prior discount levels to carry into the new bundles.
• Hold an alternative: keep a live rival evaluation to anchor the price.

Handling multi year commitments

Multi year terms earn discount but freeze the endpoint count. Negotiate a true down right so a shrinking estate is not stuck paying for endpoints it has retired.

What to do next

1. Export the Carbon Black agent inventory and reconcile it against live assets.
2. Remove ghost endpoints from decommissioned servers and virtual machines.
3. Segment endpoints into risk groups and map each to the lowest sufficient tier.
4. Confirm the exact SKU mapping from your old bundles to the repackaged ones.
5. Require your prior discount level to carry into the new packaging.
6. Run a competitive evaluation of one rival endpoint platform.
7. Take the inventory, tier map, and alternative into the renewal.

Frequently asked questions

How is Broadcom Carbon Black licensed in 2026?

Carbon Black is licensed per protected endpoint across tiered bundles. Each agent on a server, workstation, or virtual machine counts as one endpoint, and the tier you assign, from prevention up to full XDR, sets the price per endpoint.

What does the Carbon Black XDR tier add?

The XDR tier correlates telemetry across endpoint, network, and identity for advanced threat hunting. It is the most expensive tier and belongs on high value, high exposure assets rather than the entire fleet, where lower tiers usually cover the real risk.

What counts as an endpoint?

Any device running the Carbon Black agent counts, including physical and virtual servers, laptops, desktops, and cloud instances. Virtual machine sprawl and ghost agents on decommissioned machines are common reasons the licensed count is higher than it should be.

How did Broadcom change Carbon Black after acquiring VMware?

Broadcom repackaged the Carbon Black portfolio, and post acquisition renewals frequently default buyers into repriced bundles where the old negotiated discount does not automatically carry across. Treat the first such renewal as a fresh negotiation, not a rollover.

Should we standardize the whole estate on XDR?

Usually not. In most estates we reviewed, many endpoints carried the top tier when a lower tier covered their actual risk, so the volume discount never offset the tier overpay. Segment endpoints by risk and license each group to the tier it genuinely needs.

How do we reduce the endpoint count we pay for?

Reconcile the agent inventory against live assets and remove ghost endpoints from decommissioned servers and virtual machines. This endpoint hygiene typically removes 10 to 20 percent of a count inflated by stale records.

Are multi year Carbon Black commitments worth it?

They earn discount but freeze the endpoint count, so a shrinking estate overpays for the back half of the term. If you commit multi year, negotiate a true down right so you can reduce endpoints you have retired.

How do we get leverage on a Carbon Black renewal?

Bring a clean endpoint inventory, a risk based tier map, and a live competitive evaluation. Confirm the SKU mapping into the new bundles and require your prior discount to carry across before accepting any repackaged quote.