Carbon Black XDR licensing. Broadcom pricing and negotiation.

When Broadcom closed the VMware acquisition in November 2023, it absorbed the Carbon Black product line and pulled it onto the Broadcom Master Agreement. What looked like a routine vendor change became a structural pricing reset. List prices climbed 30 to 60 percent depending on tier, the SKU shelf collapsed into three core endpoint bundles, and standalone product purchases that buyers had relied on for years quietly disappeared. This article unpacks the new Carbon Black licensing model, the bundle traps that catch unprepared buyers at renewal, and the moves that recover 15 to 35 percent against the first Broadcom quote. For surrounding context read the Broadcom practice, the VMware Negotiation Playbook, the Broadcom audit defense guide, and the VMware alternatives 2026 guide.

The Carbon Black XDR product line in 2026

Carbon Black sits inside the Broadcom Symantec Enterprise Security Group and is sold under three product family banners. Endpoint protection covers laptops, desktops, and servers running Windows, macOS, and Linux. Cloud workload protection covers Linux servers, virtual machines, and containers in AWS, Azure, GCP, and on prem hypervisors. App Control is the application allowlisting product that locks down fixed function workloads such as point of sale, ATMs, industrial systems, and regulated kiosk endpoints. The XDR layer ties detection signal across these three families into a single response console. Buyers should treat XDR as an architectural overlay, not a separate license. The cost sits in the underlying endpoint, server, and App Control tiers.

Endpoint bundles and indicative pricing

The endpoint bundles are the largest cost driver in nearly every Carbon Black estate. Three tiers carry the catalog; everything that used to ship as a separate add on is now folded into one of them.

The realistic net column reflects deals we have priced for buyers running 5,000 to 50,000 endpoints with a credible competitive process in market. Smaller estates without alternatives in play sit closer to list. Larger estates with a real CrowdStrike or SentinelOne paper bid in hand can push 5 to 10 points further than the table.

Server and cloud workload protection

Server and cloud workload SKUs sit outside the endpoint bundles. Carbon Black Cloud Workload starts around $90 per server per year for the lower tier and runs to $160 per server per year for the equivalent of the Enterprise bundle. Container protection bills per CPU core or per pod count depending on contract vintage.

Two pitfalls live here:

• Legacy AppDefense decoupling. Customers with a mature VMware footprint often have legacy Carbon Black AppDefense entitlements bundled into vSphere that Broadcom is now decoupling.
• Per server to per core migration. Server licenses have been quietly migrated from per server to per CPU core in some renewals, which can double the line item cost on a single socket dual processor estate without a single new agent being deployed.

App Control and fixed function endpoints

App Control is the highest margin product in the Carbon Black portfolio and the one most often overprovisioned. List price runs $130 to $180 per protected endpoint per year. The buyer side move is to audit the deployment against actual fixed function devices. We routinely find App Control entitlements deployed to general purpose workstations that should sit on Endpoint Standard at one third the cost. A clean rightsizing exercise across an App Control estate of 5,000 endpoints typically reclaims $300,000 to $450,000 per year before any pricing negotiation begins.

The competitive picture in 2026

Carbon Black no longer competes on a feature gap. CrowdStrike Falcon, SentinelOne Singularity, and Microsoft Defender for Endpoint are all credible enterprise EDR platforms with comparable detection efficacy in MITRE ATT&CK evaluations. The competitive math has shifted to commercial structure and ecosystem fit.

Microsoft Defender is the most common competitive lever in 2026 because most Carbon Black customers already pay for it inside an E5 entitlement and run it as a complementary control. Whether or not Defender is the long term answer, putting it on the table reframes the Broadcom discussion.

A worked renewal: 18,000 endpoint global manufacturer

A North American industrial manufacturer with 18,000 endpoints, 1,200 servers, and 600 App Control devices arrived at first Broadcom renewal post acquisition. The opening Broadcom quote came in at $2.4M per year on a three year term, a 47 percent uplift over their last VMware era price. Three moves brought the deal to settlement at $1.55M per year, a 35 percent reduction from the first quote and a 5 percent net reduction from the prior contract.

1. Edition rightsizing. 4,200 Endpoint Enterprise seats were moved to Endpoint Advanced because the customer SOC was not consuming the XDR data lake. Saving: $360,000 per year.
2. App Control deployment audit. 240 App Control entitlements were retired because the underlying devices had been decommissioned or migrated to Endpoint Standard. Saving: $42,000 per year.
3. Competitive process. A Microsoft Defender for Endpoint pilot covering 2,000 endpoints ran in parallel with the renewal. The signed Defender quote sat in the room during the final Broadcom commercial review. Final discount: 28 percent off remaining list, on top of the rightsizing savings.

Renewal benchmark anchors

For renewal modeling against your own Carbon Black estate, the indicative anchors below reflect what we see on enterprise deals in 2026 across Endpoint Enterprise plus Cloud Workload Advanced plus App Control coverage on a three year commit.

• 5,000 to 10,000 endpoints: 18 to 25 percent off list achievable, 28 percent with active competitive bid
• 10,000 to 25,000 endpoints: 25 to 32 percent off list achievable, 38 percent with active competitive bid
• 25,000 to 75,000 endpoints: 32 to 42 percent off list achievable, 48 percent with active competitive bid
• 75,000 plus endpoints: 42 percent plus on a three year commit, with strategic concession on list pricing in year one

How we engage on a Broadcom renewal

Redress runs a four phase Carbon Black renewal process. We sit on the buyer side from kickoff to signature.

1. Deployment audit. Audit against the actual estate, which typically reclaims 8 to 12 percent of recurring spend before any pricing conversation.
2. Competitive evaluation. A market evaluation against CrowdStrike, SentinelOne, and Defender, run in parallel with the Broadcom commercial track.
3. Priced negotiation. The priced negotiation against Broadcom with documented benchmark anchors and a paper alternative.
4. Contract structure. Term length, payment timing, true up cap, growth pricing, and exit terms.

Read the Vendor Shield program for always on advisory across the renewal cycle and the VMware negotiation playbook for the surrounding Broadcom estate.

Independent buyer side advisory

Redress is independent and 100 percent buyer side. Industry recognized, 500 plus enterprise clients, $2B plus under advisory across 11 vendor practices. Read the Broadcom services practice, the Broadcom audit defense playbook, and the case studies library for representative engagements, or contact us to scope a Carbon Black renewal review.