No more typing reviews! Try our Samantha, our new voice AI agent.

BlackBerry Cylance Cybersecurity vs VMware Carbon Black Endpoint comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 8, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in Endpoint Protection Platform (EPP)
4th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Detection and Response (EDR) (5th), Extended Detection and Response (XDR) (3rd), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
BlackBerry Cylance Cybersec...
Ranking in Endpoint Protection Platform (EPP)
34th
Average Rating
8.0
Reviews Sentiment
4.6
Number of Reviews
44
Ranking in other categories
No ranking in other categories
VMware Carbon Black Endpoint
Ranking in Endpoint Protection Platform (EPP)
26th
Average Rating
7.8
Reviews Sentiment
6.6
Number of Reviews
65
Ranking in other categories
Security Incident Response (4th), Endpoint Detection and Response (EDR) (28th), Ransomware Protection (8th)
 

Mindshare comparison

As of November 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, up from 3.6% compared to the previous year. The mindshare of BlackBerry Cylance Cybersecurity is 1.8%, up from 1.2% compared to the previous year. The mindshare of VMware Carbon Black Endpoint is 2.1%, up from 1.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP) Mindshare Distribution
ProductMindshare (%)
Cortex XDR by Palo Alto Networks3.8%
VMware Carbon Black Endpoint2.1%
BlackBerry Cylance Cybersecurity1.8%
Other92.3%
Endpoint Protection Platform (EPP)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Sooraj Makkancherrry - PeerSpot reviewer
Security Operations Manager at Philips
Doesn't have daily updates, which is important for healthcare IT
I face challenges with the exclusion policy - it still scans folders we told it not to, causing issues. When we contact support, they tell us to update the latest agent, but we can't do that immediately due to medical device protocols and validation testing. I wish support would try to understand our issues better instead of giving this standard response. The machine learning feature they use often tells us to upgrade the agent or add things to the exclusion list, which isn't unacceptable. It's a very good and new technology as a tool and antivirus. But sometimes, it doesn't work properly with our medical devices and products, quarantining files it shouldn't even after we add them to exclusions. This is tricky for us.
PM
CTO at Microsoft
Improved incident investigation has supported response while core protection still needs progress
VMware Carbon Black Endpoint does not have easy integration, as there are many complexities with the Ribitava API, which is very deep. I rate this solution overall as a five or six on a scale from one to ten. I have integrated VMware Carbon Black Endpoint with other tools that are helpful. I think this solution should be targeted at small clients, because adoption will grow more with small businesses tomorrow.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Threat identification and detection are the most valuable features of this solution."
"Cortex XDR is a simple platform that's easy for administrators and users. You have a lot of flexibility to change or customize the features."
"Cortex is the best solution for avoiding security breaches, malware attacks, and other kinds of security issues."
"The solution allows us to gain remote access without the user's knowledge and take the necessary actions on the device."
"We've had a significant increase in blocking with a decrease in false positives, because it's looking at how the files work, not just a list of files that it's been told to look for."
"It is easy to use."
"One of the main benefits of the solution is its intelligence to correlate the events into an incident."
"The integrations are out-of-the-box, as are the playbooks."
"The most valuable features of CylancePROTECT are its powerful machine-learning capabilities and predictive intelligence."
"We have been trained to learn how to use the product and now we have a very good experience with it."
"The solution is stable."
"In most cases, the solution's ability to detect in the MITRE framework, and its ability to be able to detect attacks in any one of seven or eight different areas of the life cycle of an attack is very useful."
"The solution is stable; it was no problem and all went quite well, with no bugs or freezes."
"It is extremely simple to manage and deploy."
"I find the actual overall endpoint malware protection the most valuable feature of CylancePROTECT."
"Even if an endpoint loses connection to the Internet, I know that endpoint is protected against 99.99% of the threats in the wild today."
"Carbon Black has very good market strategies."
"The most valuable feature of the solution stems from the fact that it is one of the best EDR tools in the market."
"It has improved our protection to have less false-positives, we have a greater ability to find malware notifications, and it has improved between 30-35% more than prior to our use of the solution."
"It significantly speeds up incident response times by alerting analysts immediately upon detecting potential issues."
"It has improved the number of alerts or the number of threat events that we are able to recognize in our environment, and it also highlights the usage of potentially unwanted programs, so these are the ways in which it highlighted the possible vectors through which we can have an incident happening in our environment."
"It actually does some heuristics, and some behavioral analysis."
"The most valuable feature of the solution stems from the support it provides."
"The solution is stable and the policy can be configured with flexibility, as it comes with its own pre-built standard policy and also allows us to write our own, which means the solution serves us going forward."
 

Cons

"If you compare it to SentinelOne, which has more functionalities and detection capabilities on an open platform, the pricing on SentinelOne is far more reasonable and cheaper than Cortex XDR by Palo Alto Networks."
"Being able to filter the events to see those that are related to the actual alert would save time spent by the engineer."
"Previously, the endpoint would leave the environment, not being on our VPN, essentially unable to interact with the server to upload files. It was unable to retrieve new file verdicts. It was using a thing called "local analysis" to determine if something was a malicious file or not. There was no dynamic analysis."
"One thing that was missing was the integration part. Currently, they don't have out-of-box integration with IBM QRadar, or if they have the integration, the integration doesn't work well."
"Additionally, I think the price is very high, and if it can be adjusted, I believe it will be a very good solution."
"Cortex XDR by Palo Alto Networks is a very good product, but financially, it is very expensive, so the company should look into that area."
"Technology evolves every day, so it would be nice if it gets more secure. It can also have more integration with other platforms."
"It should support more mobile operating systems. That is one of the cons of their infrastructure right now."
"CylancePROTECT's dashboard could be more user-friendly."
"For example, the interface and the Cylance Optics need to be improved a fair bit."
"The high price of the product is an area of concern where improvements are required. The product's price should be more competitive."
"I would say one thing that they might need to bring in is protection for mobile devices."
"The OPTICS component could be made more user-friendly with respect to giving people more information."
"The problem is, for me, sometimes it creeps into the computers and into the servers that we want to get running."
"Enhancing the product's detection rates and streamlining the user interface for easier management in daily operations would be beneficial improvements."
"It should have better support for Windows and Mac."
"It could be a bit complicated. You have to be very familiar with Carbon Black to understand what it is doing and why it is doing."
"I am not sure whether Carbon Black CB Defense can be considered as a stable solution or not."
"I'm actually looking for a replacement because of the fact that we lost that integration."
"Stability is one thing that's not robust. Other products are faster, but as far as the CB Defense, it's slow."
"The pricing could always be a bit better. They could work to make it less expensive."
"Right now, I get a lot of what I call noise email alerts. All I hear from them is, "Well, we're working on it. We're working on it." Well, they've been working on it for four years now, and nothing has changed."
"The solution would be more effective if there was a way to block automatically based on behavior."
"But here, we hardly can take any kind of a report out of Carbon Black, so I think that should be something that should be more user-friendly."
 

Pricing and Cost Advice

"When we first bought it, it was a bit expensive, but it was worth it. The licensing was straightforward."
"It is "expensive" and flexible."
"The price is on the higher side, but it's okay."
"Traps pays for itself within the first 16 months of a three-year subscription. This is attributed to OPEX savings, as security teams spent less time trying to identify and isolate malware for analysis as a result of a reduction in malware incidents, false positives, and breach avoidance."
"I did PoCs on products called Cylance and CrowdStrike. Although, I consider these products and they were also good, when it come to cost and budgetary factors, Traps has been proven to be better than the other two products. It is quite cost-effective and delivers all the entire solution which we require."
"The solution is expensive. It's pricing is on a yearly-basis."
"Cortex XDR’s pricing is very reasonable."
"The cost depends on your chosen license type, like Pro or other licenses."
"The licensing part of the product is too expensive compared to other solutions in the market."
"Review closely how many endpoints you actually need before buying into a pricing level. Deal and deal with the VAR of your choice."
"My company is on a yearly CylancePROTECT subscription. Price-wise, the solution is slightly expensive, so I'd rate it as eight out of ten."
"Our licensing cost for the solution is around $4,000 for six months. There are no costs in addition to the standard licensing fees."
"The license price for this solution could be better. It's on the expensive side."
"CylancePROTECT is worth the money, but I'm not sure of its exact price. I can't remember off the top of my head."
"The monthly fee is $55 USD per user."
"Currently, we have competitive pricing for Cylance, which is affordable enough to consider."
"In terms of licensing costs, Carbon Black CB Defense was all associated with CROW and the services my company is using with them, so it came all-inclusive."
"Carbon Black might be a touch more expensive than Symantec. They tend to get a premium for their capabilities. They're sort of an industry leader in a lot of areas with the functionality that they provide."
"The licensing cost is on the more expensive side, but I thought it was worth it because they did a good job. It was one of the vendors I truly didn't have to worry about too much until this latest upgrade."
"The pricing is annually based and operates through another department than mine."
"The product’s price is less expensive than other vendors."
"The solution has almost the same price as other different kinds of infrastructures, but it offers a lot of different features."
"The pricing is very high."
"I am not really involved in the pricing of this product. But, from my understanding, it is OK for us."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
920,929 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Outsourcing Company
12%
Construction Company
11%
Manufacturing Company
8%
Financial Services Firm
6%
Outsourcing Company
10%
Financial Services Firm
10%
Construction Company
9%
Manufacturing Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
By reviewers
Company SizeCount
Small Business33
Midsize Enterprise5
Large Enterprise14
By reviewers
Company SizeCount
Small Business31
Midsize Enterprise9
Large Enterprise33
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
Ask a question
Earn 20 points
What to choose: an endpoint antivirus, an EDR solution or both?
I can recommend Carbon Black, an award-winning next-gen anti-virus (NGAV) and endpoint detection and response (EDR) s...
What's the difference between Carbon Black CB Response and Carbon Black CB Defense?
Carbon Black offers two different levels of Endpoint Detection and Response. One is the VM Carbon Black Cloud Endpoin...
What is your experience regarding pricing and costs for Carbon Black CB Defense?
My rating for the pricing of VMware Carbon Black Endpoint is that it is not cheap, but it is also not as inexpensive ...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
Blackberry Protect
Carbon Black CB Defense, Bit9, Confer
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Panasonic, Noble Energy, Apria Healthcare Group Inc., Charles River Laboratories, Rovi Corporation, Toyota, Kiewit
Netflix, Progress Residential, Indeed, Hologic, Gentle Giant, Samsung Research America
Find out what your peers are saying about BlackBerry Cylance Cybersecurity vs. VMware Carbon Black Endpoint and other solutions. Updated: September 2026.
920,929 professionals have used our research since 2012.