This article is based on analysis originally written by Principal Analyst Josh Zelonis and published on zdnet.com in September 2019, covering VMware’s acquisition of Carbon Black and its implications for the detection and response market.
VMware Acquires Carbon Black: What It Means
VMware’s acquisition of Carbon Black came as a surprise to many security analysts, but in context it makes strategic sense. Carbon Black had earned a Leader position in Forrester’s Endpoint Detection and Response (EDR) Wave evaluation, giving it strong brand recognition and credible technology. However, as a public company, Carbon Black had been struggling—its stock price spent much of 2019 in the teens. VMware acquired it at approximately $26 per share, a premium over the trading price, but the bet was that the underlying technology was worth more than the market was reflecting.
From VMware’s perspective, the acquisition offered an immediate path to deploying EDR capabilities across virtualized and cloud environments—a natural fit given VMware’s dominance in enterprise virtualization.
The Problem With Calling It ‘Endpoint’
The term “endpoint” in EDR has always carried baggage. Traditionally, it implied laptops and workstations—managed devices on a corporate network. But by 2019, security practitioners were already stretching the technology well beyond that definition. Customer references in Forrester’s EDR evaluations consistently reported using EDR products on infrastructure that wouldn’t traditionally be classified as endpoints at all.
This linguistic drift was becoming explicit in practitioner conversations. At least one CISO had started referring to EDR as “enterprise detection and response”—a rebranding that better reflects how the technology is actually being deployed. The shift in terminology isn’t cosmetic: it signals a fundamental change in scope, from protecting managed workstations to providing visibility across an entire enterprise environment.
XDR: The Industry’s Attempt at a Broader Framework
By the time of this acquisition, vendors like Trend Micro and Palo Alto Networks were already marketing what they called XDR (Extended Detection and Response). The “X” is intentionally flexible, but the core concept is straightforward: aggregate data from network devices, EDR agents, log sources, and other telemetry into a unified detection layer to produce a more complete picture of the threat environment.
The practical driver for this approach is significant: many organizations have 10–20% of their devices unmanaged—meaning no agent can be deployed on them and traditional EDR provides zero visibility. XDR-style architectures attempt to compensate for that gap by pulling in network-level and other non-agent data sources.
Other vendors pursuing similar strategies at the time, without the XDR marketing label, included RSA (with NetWitness) and Cisco (with AMP).
Cloud Platforms Reinventing the Endpoint
A parallel and arguably more disruptive development was underway at Google Cloud Platform and Microsoft. Rather than extending agent-based detection outward, these companies were pursuing a different strategy: using application-level telemetry from productivity suites—email, collaboration tools, document editing—as a detection surface.
The logic is hard to argue with. Most knowledge workers spend the majority of their time inside browsers and productivity applications. If you can instrument those environments at scale, you have a rich and highly contextual signal for detecting threats—and only companies with access to those platforms at that scale can realistically do it.
It’s also no coincidence that both Microsoft and Google moved aggressively into the Security Information Management (SIM) space around the same time. Collecting telemetry is only useful if you have somewhere to correlate and analyze it—and these companies were building exactly that infrastructure.
The VMware Angle: EDR Meets Virtualization
The most immediately obvious technical benefit of VMware owning Carbon Black is the ability to deploy detection and response capabilities natively across virtualized and cloud workloads. VMware’s hypervisor-level access to workloads gives Carbon Black capabilities that a traditional agent-based deployment cannot replicate—particularly for workloads where deploying and managing an agent is impractical.
But the bigger picture, as the original analysis notes, is that this acquisition is part of a broader industry consolidation trend. Security vendors are converging on the idea that detection must span across every layer of the environment—endpoints, networks, cloud workloads, and productivity applications—rather than being siloed in a single product category.
Is It Time to Retire the Term ‘Endpoint Detection and Response’?
The question the original analysis poses is a genuine one: does “endpoint detection and response” still describe what these products actually do? The evidence suggests not. The technology has grown beyond its original scope, the terminology is already shifting in practitioner communities, and major platform vendors are redefining what a detectable surface even looks like.
“Enterprise detection and response” better captures the current reality. Whether the industry settles on that term, XDR, or something else, the direction is clear: the future of detection and response is not endpoint-centric. It is environment-wide.
Key Takeaways for Security and DevOps Engineers
- EDR scope has already expanded beyond traditional managed endpoints. Evaluate tools on their ability to cover cloud workloads, unmanaged devices, and non-agent data sources.
- The XDR category is the market’s attempt to formalize this broader scope. Approach vendor XDR claims with scrutiny—ask specifically what data sources are supported and how correlation is performed.
- Unmanaged device coverage (10–20% of environments, per practitioner reports) is a real gap that agent-only EDR cannot address. Network-level telemetry is increasingly critical.
- Productivity suite telemetry from platforms like Microsoft 365 is a growing and legitimate detection source. If your organization uses these platforms, evaluate whether their native security signals are being fed into your detection pipeline.
- VMware’s hypervisor-level access to workloads is a meaningful differentiator for detecting threats in virtualized environments where traditional agent deployment is constrained.
Original analysis by Principal Analyst Josh Zelonis, Forrester Research, as published on zdnet.com (September 2019).