Yup. You cannot get malware or run non-whitelisted programs if Carbon Black brings your computer to a grinding halt and eats all your battery.
I cannot emphasize this enough: the most amazing thing about carbon black is there are actually options that are worse in terms of performance impact (and much, much worse in terms of increased attack surface). There was a time I would not have thought that possible.
Corporate policy: also install CB on all VMs running too. CB inception.
Do not take your security team for granted. They're already doing more than most, sadly.
At a large video game company I worked for we installed Perforce on the D drive because C drive was constantly scanned by carbon black among other things.
My work computer currently locks up at a precise time once a week. It is either Carbon Black or Malwarebytes but I can't diagnose it as it requires a hard reboot. IT refuses to tinker with this sacred software.
You can try to blue screen it and debug the crash dump.
It's CB. Google "Microsoft Driver Verifier" and use it, focusing on the memory tests. I'd wager a sandwich that doing so will cause a bluescreen within ~10 minutes or so, and that those bluescreens will stop if you remove CB.
It makes my 2018 MBP run about as well as my 2010 model.
Agreed! I've gathered that it's a powerful toolset "if" tuned to your environment. But as a new midsize customer of CbDefense we've encountered many performance issues (many of them network file access related) with sensor v3.4. So rolled back to v3.2 but then found out that only Win7 endpoints could use v3.2 and Win10 requires v3.4... SMH
Where 'tuning' involves turning it off enough to drive a truck through.
Yes! If not everything else, Carbon Black is the reason du jour to run away from Windos. Provided, your company allows the use of another OS.
Companies install it on Macs as well. It's pretty much everywhere.
Cylance at first used to be pretty good about not doing that, but they took a turn for the worst.
Looking for more anecdotal evidence, if you had to run an AV what would be the lowest impact?