CrowdStrike Falcon vs Microsoft Defender for Identity comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

CrowdStrike Falcon
Ranking in Identity Threat Detection and Response (ITDR)
3rd
Average Rating
8.6
Number of Reviews
112
Ranking in other categories
Endpoint Protection Platform (EPP) (3rd), Endpoint Detection and Response (EDR) (3rd), Extended Detection and Response (XDR) (1st), Ransomware Protection (1st)
Microsoft Defender for Iden...
Ranking in Identity Threat Detection and Response (ITDR)
1st
Average Rating
9.0
Number of Reviews
13
Ranking in other categories
Advanced Threat Protection (ATP) (6th), Microsoft Security Suite (8th)
 

Mindshare comparison

As of June 2024, in the Identity Threat Detection and Response (ITDR) category, the mindshare of CrowdStrike Falcon is 11.3%, up from 0.0% compared to the previous year. The mindshare of Microsoft Defender for Identity is 35.1%, down from 48.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Identity Threat Detection and Response (ITDR)
Unique Categories:
Endpoint Protection Platform (EPP)
11.0%
Endpoint Detection and Response (EDR)
17.4%
Advanced Threat Protection (ATP)
6.7%
Microsoft Security Suite
7.1%
 

Featured Reviews

VP
May 2, 2024
Helps protect our data, is stable, and reasonably priced
A popular choice for Data Loss Prevention is CrowdStrike Falcon. This is the primary function our clients leverage it for, as it offers industry-leading DLP capabilities CrowdStrike Falcon has helped our customers secure their confidential data. The DLP is the most valuable feature of…
Reynaldo Ruiz Flores - PeerSpot reviewer
Jun 1, 2023
The solution is easy to implement and helps us identify issues like weak or reused passwords
Defender for Identity provides intelligent authentication through conditional access policies and monitors user behavior. Defender looks at things like password changes and application use One of our users had the same password for every personal and company account. That was a problem because…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Overall, what I found most valuable in CrowdStrike Falcon is its good mechanism. It also has a good reporting feature. CrowdStrike Falcon is an invaluable tool because, through it, you can take quick action, for example, when an OS is missing specific patches."
"I like the vulnerability assessment and proactive hunting features of CrowdStrike Falcon."
"The most valuable feature of CrowdStrike Falcon is crowdsourcing intelligence."
"The features I like the most are the response time and the dashboard are both excellent."
"Scalability hasn't been an issue for us."
"Enables us to understand what processes are running on the system, what registry keys have been enabled."
"I haven't had any issues with bugs or glitches. I haven't had a problem with stability so far."
"Scalability is good. We have had no issues with it."
"This solution has advanced a lot over the last few years."
"The feature I like the most about Defender for Identity is the entity tags. They give you the ability to identify sensitive accounts, devices, and groups. You also have honeytoken entities, which are devices that are identified as "bait" for fraudulent actors."
"The most valuable aspect is its connection to Microsoft Sentinel and Defender for Endpoint, and giving exact timelines for incidents and when certain events occured during an incident."
"Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence."
"One of our users had the same password for every personal and company account. That was a problem because she started receiving phishing emails that could compromise all of her accounts. Defender told us that the user was not changing their password."
"It automates routine testing and helps automate the finding of high-value alerts."
"All the integration it has with different Microsoft packages, like Teams and Office, is good."
"Defender for Identity has not affected the end-user experience."
 

Cons

"It is cloud-based, and this does make some weary of the data being held on the cloud. Privacy requirements must be taken into account."
"They respond quickly on the weekdays, but the weekend response times are slower."
"Technical support could be better than what is currently offered."
"The Integration with tools, SOC tools, could be better."
"CrowdStrike Falcon needs to improve their host management system."
"As the company has grown, the technical support has felt less personal."
"The performance could be better."
"I would like to see the machine learning feature enhanced."
"The impact of the sensors on the domain controllers can be quite high depending on your loads. I don't know if there's any room for improvement there, but that's one of the things that might be improved."
"The technical support needs significant improvement. Documentation for more minor issues in the form of guides or walkthroughs could help to resolve this issue. The number of tickets raised would decrease, removing some pressure from the support team and making it easier to clear the remaining tickets."
"Defender for Identity gives us visibility, but we often get false positives from Azure that take us down the garden path. We go through 30 incidents each day and most of those are false positives or benign positive alerts. Occasionally, we get true positive alerts."
"When the data leaves the cloud, there are security issues."
"The solution could be better at using group-managed access and they could replace it with broad-based access controls."
"Microsoft should look at what competing vendors like CrowdStrike and Broadcom are doing and incorporate those features into Sentinel and Defender. At the same time, I think the intelligence inside the product is improving fast. They should incorporate more zero-trust and hybrid trust approaches. They need to build up threat intelligence based on threats and methods used in attacks on other companies."
"And when you are working in a priority IP address, Identity is not able to know that those IPs are from the company. It sees that the IPs are from Taiwan or from Hong Kong or from India, even though they are internal IPs, resulting in a lot of false positives."
"I would like to be able to do remediation from the platform because it is just a scanner right now. If you onboard a device, it shows you what is happening, but you can't use it to fix things. You need to go into the system to fix it instead."
 

Pricing and Cost Advice

"Crowdstrike Falcon is relatively cheap."
"The solution isn't very costly; it's affordable."
"I would like them to further reduce the price, because it is quite pricey at the moment."
"The pricing is definitely high but you get what you pay for, and it's not so high that it prices itself out of the market."
"Years ago, when we bought CrowdStrike, you got everything it had. I was a little concerned when they broke this out into a la carte modules where you can buy EDR, Spotlight, etc., picking and choosing off the menu. I was a little worried that the solution would get watered down. However, I realized in my previous organization when we had the full suite that there were a bunch of features in it that we didn't have time to operationalize. So, I warmed up to it. I get the whole, "Look, you can pick and choose. Okay, everybody buys a steak, but do you want mashed potatoes, or do you want lobster mac and cheese?" So, you can pick the sides that you want, so you can buy the solution that you want and operationalize versus paying a lot of money and getting a bunch of things, but not using 60 percent of the tools in the box."
"Purchasing the product through the AWS Marketplace is just a click away. Since we were using the on-premise version of the product, we continued on the cloud by purchasing it through the AWS Marketplace."
"We pay between $30-50 per user for a yearly license, which is more expensive than SentinelOne or Bitdefender. However, CrowdStrike gives better value for money."
"When it comes to licensing, customers can choose a bundle or select licences based on the specific features they would like access to. This solution comes with premium pricing. It is approximately 20 to 30% more expensive than competing solutions."
"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."
"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."
"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."
"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."
report
Use our free recommendation engine to learn which Identity Threat Detection and Response (ITDR) solutions are best for your needs.
787,779 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Financial Services Firm
10%
Manufacturing Company
8%
Government
7%
Computer Software Company
15%
Financial Services Firm
14%
Government
8%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions that are very scalable, secure, and user-friendly. Cortex XDR by Palo Alto offers ...
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing user interface that makes setup easy and seamless. CrowdStrike Falcon offers a cl...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...
What do you like most about Microsoft Defender for Identity?
Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence.
What needs improvement with Microsoft Defender for Identity?
One potential area for improvement could be exploring flexibility in the installation of Microsoft Defender for Identity agents. Currently, it is mandatory to install the agent on the on-premises e...
What is your primary use case for Microsoft Defender for Identity?
Microsoft Defender for Identity is like a personal security guard for our organization's identity. It keeps a close eye on how we use our identities across both on-premises and Azure Active Directo...
 

Also Known As

CrowdStrike Falcon, CrowdStrike Falcon XDR
Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity
 

Overview

 

Sample Customers

Information Not Available
Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.
Find out what your peers are saying about CrowdStrike Falcon vs. Microsoft Defender for Identity and other solutions. Updated: May 2024.
787,779 professionals have used our research since 2012.