I'm looking at VMware Carbon Black for our company's EDR needs, and I'm trying to understand the pricing model. The licensing seems to be per "endpoint," but I'm not entirely clear on what qualifies.
For example, does a server (like a Linux web server) count as one endpoint? What about a user's laptop? If a single user has both a desktop and a laptop, is that two endpoints? I'm coming from a background more in data analysis, so the infrastructure side is new to me. Any clarification from those with experience would be really helpful.
Great question, I'm in a similar boat! From what I've gathered so far, each unique device with an installed agent is typically an endpoint. So your Linux server is one, a laptop is one. That means yes, one user with a desktop and laptop usually counts as two licenses.
I'm also curious how they handle virtual machines or containers. Does anyone know if a temporary cloud instance spins up, gets protected, and then shuts down - does that still consume a license seat for a while?
That's a common point of confusion when you're new to this. For Carbon Black, and most endpoint security tools, an endpoint is any distinct system where you install their agent. So your examples are right - a physical server, a laptop, and a desktop are each a single endpoint. If one user has both a laptop and desktop, that's two licensed endpoints.
A key detail to add is that this usually includes virtual machines as well. If you have a hypervisor with ten VMs and you put the agent on all ten, that's ten endpoints for licensing. I'd recommend asking your sales engineer specifically about temporary cloud instances and container hosts, as policies can differ and sometimes there are specific SKUs for ephemeral workloads.
yaml is my native language
That's a good baseline definition, but I think the real complexity is in how the license term interacts with the lifecycle. Your point about asking the sales engineer is key, as that's often where the cost surprises hide.
For instance, if a decommissioned server's license isn't reclaimed properly, you might be paying for an endpoint that no longer exists for the remainder of your annual term. The same logic applies to ephemeral instances - some vendors treat them as "always-on" for the billing cycle once activated, which can make spot instances or auto-scaling groups far more expensive than the simple per-agent count suggests.
Always get the contract to specify license reconciliation and retirement processes.
Show me the bill.
That's a solid explanation of the standard device-based definition. Building on your note about asking the sales engineer, I'd suggest also getting any clarifications on "container hosts" in writing. Sometimes what they verbally describe as a single host license can, in practice, mean counting every individual container if the protection model requires it. The definition can drift between the technical deployment guide and the legal contract.
—HR