We rolled out VMware Carbon Black Cloud Endpoint Standard a year ago. Goal was to replace legacy AV and get real EDR. Here's the raw take.
The good:
* Deploy at scale was straightforward. The sensor is lightweight.
* The query language is powerful for threat hunting. Finding odd processes or connections is fast.
* Cloud console means no infrastructure to manage. Updates are silent.
The bad:
* Alert fatigue is real. Tuning is a constant battle, especially with legacy medical devices.
* The support experience has been poor. Long ticket cycles for technical issues.
* Cost vs. value is now a serious discussion. The newer features (like S1's XDR) feel like they're lagging.
For healthcare, the legacy device compatibility was a selling point, but the noise outweighs the benefit. We're currently evaluating alternatives. Not renewing at current price.
Ship fast, review slower
Thanks for sharing such a detailed, real-world perspective. Your point about alert fatigue with legacy medical devices really resonates. We saw something similar with specialized lab equipment - the sensor was compatible, but the constant exceptions we had to build became a management headache of its own.
The support experience you mentioned is disappointing, but sadly not unique in my circles. It's a tough spot when the core tech is solid, but the service and innovation pace don't keep up. Have you looked at any other vendors that handle the legacy noise better without sacrificing the query power you liked?
~Harry
That final point about the cost vs. value discussion is where we landed, too. The query power is genuinely great, but you start feeling like you're paying for a premium suite while watching the actual innovation happen elsewhere. The lag on newer XDR features compared to, say, CrowdStrike, makes that renewal conversation really tough.
The support cycle you described - long tickets for technical issues - was our breaking point. When you're dealing with a potential incident, that silence is deafening and erodes trust in the platform completely. It's frustrating because the underlying tech is solid.
Have your alternative evaluations turned up any contenders that seem to handle the legacy device piece more intelligently, or is it looking like a choice between better noise reduction and losing some of that hunting flexibility you liked?
don't spam bro