.png){kind=small}
What is Carbon Black EDR?
Carbon Black EDR is an incident response and threat hunting solution designed for Security Operations Center teams with offline environments or on-premises requirements. Carbon Black EDR continuously records and stores endpoint activity data so security professionals can hunt threats in real time and visualize the complete attack kill chain, using the Carbon Black Cloud’s aggregated threat intelligence.
Company Details
Need Assistance?
We're here to help you with understanding our reports and the data inside to help you make decisions.
Get AssistanceCarbon Black EDR Ratings
Real user data aggregated to summarize the product performance and customer experience.
Product scores listed below represent current data. This may be different from data contained in reports and awards, which express data as of their publication date.
75 Likeliness to Recommend
81 Plan to Renew
65 Satisfaction of Cost Relative to Value
Emotional Footprint Overview
Product scores listed below represent current data. This may be different from data contained in reports and awards, which express data as of their publication date.
+64 Net Emotional Footprint
The emotional sentiment held by end users of the software based on their experience with the vendor. Responses are captured on an eight-point scale.
How much do users love Carbon Black EDR?
Pros
- Respectful
- Trustworthy
- Caring
- Client Friendly Policies
Cons
- Less Performance Enhancing
- Less Generous
How to read the Emotional Footprint
The Net Emotional Footprint measures high-level user sentiment towards particular product offerings. It aggregates emotional response ratings for various dimensions of the vendor-client relationship and product effectiveness, creating a powerful indicator of overall user feeling toward the vendor and product.
While purchasing decisions shouldn't be based on emotion, it's valuable to know what kind of emotional response the vendor you're considering elicits from their users.
Footprint
Negative
Neutral
Positive
Feature Ratings
Mac OS support
Cross Platform Integration
Kernel Monitoring
Host NGFW Functionality
Centralized Management Portal
Ransomware Recovery and Removal
Automated Remediation
Cross Platform Support
Port and Device Control
System Hardening
Application Containment Mechanisms
Vendor Capability Ratings
Product Strategy and Rate of Improvement
Breadth of Features
Vendor Support
Quality of Features
Ease of Data Integration
Business Value Created
Ease of IT Administration
Availability and Quality of Training
Ease of Customization
Ease of Implementation
Usability and Intuitiveness
Also Featured in...
Carbon Black EDR Reviews
Thijs W.
- Role: Information Technology
- Industry: Technology
- Involvement: IT Development, Integration, and Administration
Submitted Nov 2024
Broad feature set with challenging implementation
Likeliness to Recommend
What differentiates Carbon Black EDR from other similar products?
The broad feature set which has all sorts of capabilities. Also the user management features are quite extensive and make it easier to manage large organizations.
What is your favorite aspect of this product?
The possibility to create different policies which can be dynamically applied to certain groups.
What do you dislike most about this product?
The dynamic malware detection capabilities are flagging a lot of false positives, so much so that it was too much for the SOC.
What recommendations would you give to someone considering this product?
Ask yourself if you really need all the features, otherwise other products might be better.
Pros
- Includes Product Enhancements
- Trustworthy
- Unique Features
- Caring
Cons
- Security Frustrates
- Less Reliable
- Less Performance Enhancing
Sunil K.
- Role: Information Technology
- Industry: Other
- Involvement: IT Development, Integration, and Administration
Submitted Jun 2026
EDR Platform with powerful threat visibility
Likeliness to Recommend
What differentiates Carbon Black EDR from other similar products?
Carbon Black EDR has comprehensive endpoint visibility and forensic detail. The platform provides security teams with rich telemetry to help speed up investigation and threat hunting. The platform provides excellent insights that make it easier to spot suspicious act. Most importantly, it is a great addition to the organisations focusing on incident response, and endpoint visibility.
What is your favorite aspect of this product?
The best part of Carbon Black EDR is it gives you the great endpoint visibility during the investigation process. It also saves a lot of time of security team while threat hunting & analysing the root cause of security incidents.
What do you dislike most about this product?
The one thing which is kind of MSP as well as the bad point is the excessive numbers of endpoints it provides. While the experienced team can utilise it up to the best, but it can also be overwhelming for those who are new to the EDR tool or platform. Also, need an improvement in administrative & reporting tasks.
What recommendations would you give to someone considering this product?
The organization thinking of implementing Carbon Black EDR must go through the POC evaluation to check if their security requirements & technology stack is aligned. Great option for the organizations targeting incident response, threat hunting & endpoint visibility.
Pros
- Security Protects
- Helps Innovate
- Continually Improving Product
- Reliable
MAHANTESH S H.
- Role: Information Technology
- Industry: Finance
- Involvement: IT Development, Integration, and Administration
Submitted May 2026
Cardon black EDR for enterprise security
Likeliness to Recommend
What differentiates Carbon Black EDR from other similar products?
Because of the real time monitoring, threat intel features. Good endpoint activity visibility and dahboard.
What is your favorite aspect of this product?
Favorite aspect about Carbon Black Eadar is the visibility and alerting capability. Detailed device timeline and artifacts present.
What do you dislike most about this product?
The Initial setup, integrations feels little tricky and complex for new users or beginners. KB artcile or KT or shadowing can help
What recommendations would you give to someone considering this product?
Would recommend deployment on endpoint, server, regular health check, proper policy configuration
Pros
- Continually Improving Product
- Unique Features
- Saves Time
- Transparent