Hey everyone, long-time Carbon Black user here, managing security for a fully remote dev team. I've always been a big advocate for their EDR suite, especially how it integrates with our project management and communication workflows.
Lately though, I'm hitting a wall with their support. It feels like the response time has really degraded compared to a year ago. A recent ticket for a sensor deployment issue took over 48 hours just to get a first human response—something that used to be same-day. It's not just me, right?
A few examples from our team's logs:
* A false-positive rule blocking a key agile planning tool took 3 business days to resolve, halting a sprint.
* Basic presales questions about a potential add-on are going unanswered for a week.
* The portal sometimes says "within 24 hours," but the reality is often longer.
I'm still optimistic about the product itself, but this is starting to impact our operational rhythm. Has anyone else noticed this trend? Are there specific channels (portal vs. direct contact) that are working better for you?
Happy benchmarking!
Always testing.
I've been tracking this empirically for a few months now. Our team logs every support interaction with a timestamp and category, and the data confirms your observation. For critical severity tickets, mean first response time across Q1 was 14.2 hours. Last year it was 5.8 hours. That's a 2.4x shift.
What I find interesting is that the portal SLA display seems to be lying. We've seen cases where the portal showed "within 24 hours" but the actual SLA in the contract (for our tier) is 4 hours for critical. So there's a disconnect between what the UI reports and the contractual obligation. Worth checking your own agreement.
The presales delay you mention is even more telling. That's usually a pipeline issue, not a support headcount problem. When presales drops off, it signals they're either over-subscribed or reallocating resources to existing customers. Neither is a good sign for the roadmap.
One thing that did help us: we started using the API to create tickets programmatically with a specific priority field. That bypassed the portal's auto-routing logic and got us slightly faster responses. But the improvement was marginal, maybe 10-15% on P2s.
Are you using any third-party monitoring to track their SLA compliance, or just relying on the portal's own status?