This article is based on coverage originally published by SiliconAngle, including an interview with Tom Barsi, Senior Vice President of Business Development at Carbon Black, conducted by theCUBE at VMworld 2019 in San Francisco.
VMware’s Security Ambition: A Multi-Year Build
By mid-2019, VMware had quietly assembled a significant cybersecurity portfolio. The company’s $2.1 billion acquisition of Carbon Black in August 2019 drew headlines, but it was the culmination of a deliberate, multi-year strategy rather than an opportunistic purchase.
The groundwork was laid as far back as 2014, when VMware acquired AirWatch to gain mobile device management and security capabilities. In 2016, VMware introduced micro-segmentation as a core feature of its NSX software-defined networking product, allowing security policies to be enforced at the workload level rather than solely at the network perimeter.
The security push intensified in 2018. In the first half of that year alone, VMware acquired CloudCoreo, a cloud security posture management startup, and E8 Security, a provider of AI-assisted behavioral analytics for threat detection. VMware also brought in Tom Gillis — a security industry veteran and co-founder of Bracket Computing — to lead its networking and security business unit.
The pace accelerated further in August 2019. On August 15, VMware acquired Veriflow, a network verification and intent-based networking firm. Within days, it purchased security startup Intrinsic. Then, within 48 hours of that deal, VMware announced the Carbon Black acquisition.
“We dated, and it just became obvious that there was so much synergy between our leadership and theirs. It was a super exciting week, and the culmination of a lot of work among an army of people to get us to where we are. There really is an opportunity to transform the industry.”
— Tom Barsi, SVP Business Development, Carbon Black, speaking at VMworld 2019
Fixing a ‘Broken’ Industry
VMware’s executives were blunt about their diagnosis of the enterprise security market. At his VMworld 2019 keynote, COO Sanjay Poonen described the security landscape as fragmented and dysfunctional.
“It’s a broken industry with 5,000 vendors. We looked at this industry and said, ‘There’s got to be a better way.'”
— Sanjay Poonen, COO, VMware, VMworld 2019 keynote
The integration story between VMware and Carbon Black predated the acquisition by more than two years. The companies had collaborated on VMware’s AppDefense product, which used hypervisor-level visibility to monitor and protect application workloads. Carbon Black’s telemetry was integrated into AppDefense, giving security operations teams a view into workload behavior that had previously been inaccessible from above the hypervisor layer.
“We built that integration exclusively. For the first time, the security operations center had been able to have visibility into the hypervisor. That’s when we started to see the potential and the opportunity.”
— Tom Barsi, Carbon Black
Carbon Black’s Platform: EDR, NGAV, and Bridging SecOps with IT Ops
Carbon Black’s product portfolio at the time of acquisition included several key capabilities:
- Endpoint Detection and Response (EDR): Continuous recording of endpoint activity to detect, investigate, and respond to advanced threats.
- Next-Generation Antivirus (NGAV): Behavioral-based prevention designed to catch threats that signature-based tools miss.
- LiveOps: A real-time endpoint query tool enabling system administrators to perform investigations and remote remediation from a single cloud-native platform without deploying additional agents.
- Workload Protection: Integration with VMware AppDefense to secure virtualized workloads at the hypervisor level.
Beyond the individual products, Carbon Black positioned itself as a bridge between two traditionally siloed teams: security operations centers (SOCs) and IT operations staff. The tension between these groups is a well-documented operational challenge — security teams want to isolate and shut down affected systems, while IT operations teams are focused on maintaining uptime.
“We see the opportunity to eliminate that friction and create an opportunity between those two. There’s friction because the ‘SecOps guys’ are saying, ‘Take the server down if there’s a problem’ and ‘IT ops guys’ are saying, ‘I’ve got runtime; I’ve got to keep it up.’ Now you have the opportunity to identify a threat and the ability to seamlessly leverage VMware’s infrastructure management tools to instantly remediate and orchestrate a problem without the conflict with IT and security operations.”
— Tom Barsi, Carbon Black
From Second Place to First: VMware’s Acquisition Track Record as a Blueprint
At the time of the Carbon Black deal, the endpoint security market was dominated by CrowdStrike. VMware’s Sanjay Poonen acknowledged publicly at VMworld that Carbon Black sat in second position behind CrowdStrike in the cloud-native endpoint security space. CrowdStrike’s market valuation at the time was reported at over $11 billion, compared with the $2.1 billion VMware paid for Carbon Black.
Barsi and VMware leadership pointed to two previous acquisitions as evidence that second place was not a permanent position:
- Nicira (acquired 2012, ~$1.2 billion): The technology became the foundation for VMware NSX, VMware’s flagship software-defined networking product, which went on to generate substantial recurring revenue.
- AirWatch (acquired 2014, ~$1.5 billion): AirWatch was not the market leader in mobile device management at the time of purchase. Under VMware, it evolved into the Workspace ONE platform, which CEO Pat Gelsinger cited as a commercial success during earnings calls around the time of the Carbon Black announcement.
“It’s what they’ve done with Nicira, what they’ve done with AirWatch and WorkspaceONE, and their ability to take a business from no revenues to a couple hundred billion. I believe we can take our position as number two and be number one.”
— Tom Barsi, Carbon Black
The Data Advantage: NSX Telemetry Meets Carbon Black’s Security Cloud
Beyond the commercial rationale, a key technical argument for the combination was data. VMware’s NSX micro-segmentation had, over years of deployment across large enterprise virtual machine estates, generated a substantial volume of network behavior telemetry. The hypothesis was that combining this infrastructure-level data with Carbon Black’s endpoint security cloud could enable threat detection and analysis at a scale that neither company could reach independently.
VMware’s partner and customer ecosystem — reported at approximately 75,000 partners and 500,000 customers at the time — also represented a ready distribution channel for Carbon Black’s platform that would have taken years to build independently. Additionally, VMware’s parent company Dell Technologies brought access to the broader Dell EMC ecosystem, including established security brands such as RSA and Secureworks.
“The best way to secure enterprise is to integrate security into the actual infrastructure. The opportunity is to leverage the infrastructure management and security portfolio that VMware has and sprinkle in the Carbon Black capabilities. By integrating it across that portfolio, you have the ability to transform the security space and now you’re coming up with intrinsic security.”
— Tom Barsi, Carbon Black
Leadership Continuity and Deal Timeline
Although the acquisition was announced in August 2019, the deal was not expected to close until early 2020, pending regulatory review. To signal continuity, VMware moved quickly to secure Carbon Black’s leadership team. Carbon Black’s then-CEO Patrick Morley was designated to lead a newly formed VMware security business unit. Offer letters were extended to Carbon Black’s chief operating officer and chief product officer as well.
The speed and deliberateness of those retention moves reflected the strategic importance VMware placed on Carbon Black — not merely as a product acquisition, but as the organizational core of a broader security business.
What ‘Intrinsic Security’ Means in Practice
The phrase “intrinsic security” became a central part of VMware’s security messaging in 2019. The concept is straightforward: rather than bolting security tools onto infrastructure as an afterthought, security capabilities should be built directly into the virtualization and networking layers where VMware already operates.
In practical terms, this means:
- Endpoint behavior monitoring delivered through the same agent or hypervisor instrumentation already present in VMware environments, reducing the need for separate endpoint agents.
- Network micro-segmentation enforced through NSX policies, limiting lateral movement by attackers inside the data center.
- Unified visibility across endpoint, workload, and network layers within a single platform, reducing the operational overhead of managing multiple point products.
- Automated remediation that can leverage VMware’s infrastructure management APIs to isolate, snapshot, or restore workloads without manual intervention.
Whether VMware fully delivered on this vision in the years following the acquisition is a separate question — but the architectural logic articulated at VMworld 2019 reflected a coherent and technically grounded security strategy.
Original reporting by SiliconAngle. Interview conducted by Dave Vellante and John Walls of theCUBE at VMworld 2019, San Francisco.