Carbon Black · Case

How a Fortune 200 insurer cut its Carbon Black EDR renewal by 54 percent.

A quote of $19.4M came in three weeks before the renewal anniversary. The contract that closed sat at $8.9M and added two years of price protection. The work that moved the number had almost nothing to do with discount conversations.

By The Negotiation Desk · Carbon Black · Archetype: The Case

Published 13 Apr 2025

The insurer is a Fortune 200 carrier with roughly 41,000 endpoints under Carbon Black EDR. The contract had been renewed twice since the Broadcom transaction. Each renewal had been negotiated on the same axis. The seller opened with a list price built on a wider scope than the buyer was actually consuming, the buyer pushed on the headline discount, and the closing number landed in a band that looked acceptable against the prior contract but quietly carried a year on year cost increase of about 9 percent. The third renewal arrived in early 2026 with a quote of $19.4M for a 36 month term. The buyer brought our team in five weeks before the anniversary, with one instruction. Establish whether the number is anchored to anything we are actually consuming, and if it is not, restructure the deal around what we are.

The eight weeks of work that followed produced a closing contract at $8.9M for the same 36 month term, with two material concessions added rather than removed. A 24 month price hold on the per endpoint rate. A right of audit cooperation clause that limited the seller to a single audit event in the contract life. The 54 percent reduction is what the headline shows. The structural changes are what the buyer cared about, and they are what made the price reduction durable.

The starting position

The buyer's prior contract had been written in 2022 against an estate footprint that was much larger than the one running in 2026. Two business units had been divested between 2023 and 2025. A third had been migrated off Carbon Black onto a competing platform for a specific regulated workload. The endpoint count on the live console at the time of the renewal quote was 41,200. The endpoint count assumed by the renewal quote was 58,000. The seller's position was that the original entitlement was the starting point and any reduction in scope was a negotiation concession to be reasoned about against discount levels. The buyer's position, once we got into the data, was that the entitlement no longer described the deployment and the renewal quote was anchored to a number that had stopped being real two years earlier.

The first 10 working days of our engagement were spent reconciling the seller's count with the management console output. The work was finicky. Endpoint deactivations had been recorded in the console but not always in the entitlement record. The console reported 41,200 active endpoints. The licensing record carried 49,800 entitled endpoints. The renewal quote assumed an uplift to 58,000 on the theory that the buyer would absorb projected business growth. None of the three numbers matched. The reconciliation produced a single document, signed by the buyer's endpoint operations lead, that listed the 41,200 active endpoints, the 8,600 deactivated endpoints with deactivation dates, and the absence of any growth signal in the buyer's three year operating plan. The document is what changed the conversation.

The find that mattered

The second piece of work was a clause read of the prior contract. We found three provisions that the seller had not surfaced in the renewal quote and that, taken together, changed the negotiation position. The first was a true down right that the buyer had negotiated into the 2022 contract and never used. The right allowed the buyer to true down endpoint count at any renewal anniversary by up to 25 percent without penalty. The seller had quoted the renewal as if the right did not exist. The second was a feature substitution provision that allowed the buyer to swap one premium module for another without re pricing. The buyer had been paying for a module that two of its security operations leads confirmed had not been used in 18 months. The third was a co termination provision tied to a separate Carbon Black App Control contract that the buyer held. The provision meant the EDR renewal could not be priced in isolation from the App Control contract that ran adjacent to it. The seller's renewal quote had treated the two contracts as separate.

"The contract the buyer had already signed in 2022 carried three rights the seller's 2026 quote ignored. Reading the prior contract is not a discovery exercise. It is the first move."Carbon Black Engagement Lead, The Desk

The restructure

With the deployment reconciliation and the clause read in hand, the buyer's procurement lead opened the formal negotiation with three documented positions rather than one discount ask. Position one was that the renewal price had to be calculated against the 41,200 endpoints actually deployed. Position two was that the true down right entitled the buyer to a further reduction of up to 25 percent if exercised, which would bring the negotiated count to 30,900. Position three was that the App Control co termination clause required the seller to bring the App Control contract economics into the renewal conversation, and that the buyer would not sign on EDR until both contracts had been re scoped.

The seller's first response was that the entitlement number reflected what had been licensed and that the deactivations were a buyer side accounting matter rather than a contractual entitlement reset. The buyer's response, signed by the endpoint operations lead, was that the management console was the contractual source of truth for active endpoints under the deployment clause of the 2022 contract, and that the seller had agreed to this in writing during a prior dispute in 2024. The seller did not contest the point in the next round. The conversation moved to which discount band would apply against the reconciled count.

The feature substitution play came next. The buyer asked to substitute the unused premium module for one that the security operations team did want. The seller initially priced the substitution as a re pricing event. The buyer's procurement lead read the substitution clause back to the seller and asked the seller to confirm in writing that the clause applied. The seller confirmed. The substitution moved through at no incremental cost and removed a future negotiation lever the seller had been planning to use, which was to up sell the new module at the next renewal.

The App Control conversation took the longest. The two contracts had been written by different account teams and the co termination clause had not been raised in either renewal cycle since 2022. We spent four working days walking the seller through the clause and waiting for an internal confirmation. The confirmation came back in the seller's favour on legal force, but the seller asked the buyer to surrender the co termination right in exchange for a deeper discount on the EDR renewal. The buyer agreed. The trade moved the closing EDR price down by a further 11 percent in exchange for the buyer giving up a clause it had not used in three renewal cycles.

The numbers

Opening quote$19.4M

Closing contract$8.9M

Reduction against opening54%

Endpoints quoted by seller58,000

Endpoints reconciled to console41,200

Endpoints negotiated against38,500

Price hold negotiated24 months

Working days from start to signature38

What the case demonstrates

The most useful pattern from the engagement is the order of the work. The buyer arrived asking for help on a discount conversation. Eight weeks later the closing number was less than half the opening quote, and only a small share of that movement came from discount negotiation. Most of it came from reconciling the deployment to the entitlement, reading the prior contract carefully enough to find provisions the seller had not surfaced, and refusing to negotiate one contract in isolation from the adjacent contract it was co terminated with. The discount conversation, when it arrived, was the last piece of work rather than the first.

A second pattern worth noting. The buyer had been carrying three contract rights it had never exercised. None of those rights would have surfaced if the buyer had not asked us to read the prior contract before the renewal opened. The seller had no obligation to surface them, and procurement leads who had inherited the contract from a predecessor were not aware of them. The rights had been written by a lead negotiator who had since moved on. The contract file was the only record. Reading the file is unglamorous work. It is also the work that produced more than half of the $10.5M reduction.

The takeaway

Reconcile the deployment to the entitlement before negotiating against the quote. A Carbon Black EDR renewal quoted against a stale endpoint count is the most common pattern we see in 2026, and the buyer who arrives with a console reconciliation document changes the conversation in one step.
Read the prior contract before opening the renewal. Provisions written in 2022 are often still in force and are often invisible to the renewal account team. In this case three unused provisions accounted for more than half of the closing reduction.
Refuse to negotiate one contract in isolation from contracts it is co terminated with. The App Control co termination clause moved 11 percent off the EDR renewal in this engagement and is a recurring pattern across Broadcom security portfolios that grew through acquisition.