CrowdStrike Falcon Reviews

My main use case for CrowdStrike Falcon is endpoint detection and response. We use CrowdStrike Falcon for our antivirus across our entire organization, as well as insight and investigation to event data, telemetry data, and a plethora of other use cases and visibility.

Their early warning detections, their ransomware protections, their endpoint detection and response capabilities, and the telemetry data that allows us deeper insight into identifying threats as well as utilizing that for troubleshooting purposes are the best features CrowdStrike Falcon offers. It is pretty useful to glean a lot of details of what's happening within a process when you're trying to figure out something in a more technical aspect of the problem.

Positively, we have been able to successfully maintain compliance within all of our security obligations within our industry. We have had next to zero downtime outside of larger widespread problems, which has allowed us to remain secure on all of our endpoints and be able to conduct business with a lot less worry. We have also been able to improve our response speed to potential threats and infiltrations into the firm, as well as hardening those areas and offering faster and more effective remediation methods based on the data found from CrowdStrike Falcon.

There are a number of areas that I only touch a handful of times, but when I get in there, I realize why I don't do that. The main area would be within the support area. The support bot is not really as smart as you would expect it, especially in this day and age of LLM and other capabilities that I know CrowdStrike Falcon is already capable of doing. Additionally, I would appreciate a little bit more easy to read insights of some of the dashboards or maybe manipulation of the dashboards. It is still a little cumbersome to build custom dashboards and it's not as intuitive as you would think.

Documentation is abysmal and needs to be improved dramatically. I know that there's a big effort to do this, however, even the new effort is honestly worse than it was before. Those are definitely major areas of improvement, just more in the usability of the features.

I have been using CrowdStrike Falcon since 2014.

We have put CrowdStrike Falcon at the top of our detection list, meaning we are now getting what we feel to be higher efficacy alerts and prevention capabilities to our entire fleet. That has helped speed up our response capabilities as well as improve our CIS benchmarking for different areas and different teams.

It has increased the speed in which we are able to address incidences and it has increased the deployment capabilities of our security solutions that we are subscribing to within CrowdStrike Falcon.

I feel CrowdStrike Falcon's AI capabilities are a lot better than they were even six months ago and after a lot of the sessions that I've sat in this week, I am optimistic that they are getting their heads wrapped around what is most important, obviously starting with discovery. Initially as AI was this budding landscape and budding technology, CrowdStrike Falcon was just there and it was a little easy to read through the marketing fluff. However, they really seem to have figured it out. They understand already because CrowdStrike Falcon is a great company. They've already gotten a head start in understanding the nuances and difficulties around security and staying on the bleeding edge. In terms of AI, I think that they really are defending the right areas to gain that appropriate visibility and then put the appropriate guardrails in place. I also appreciate how CrowdStrike Falcon is on the forefront of governance and actually helping define that across the industries to ensure that there is safe usage of AI and that education is disseminating out from them.

As with any AI output, I am a little hesitant to believe it outright as I do think that it still hallucinates quite a bit. I have not had the opportunity to play too much with the AI outside of the support AI, which again I already mentioned is not good and in my opinion is more a chatbot than anything else. The Charlotte AI, initially, and again, I have not tried it in the last year or so, but the Charlotte AI, I felt initially was more a glorified search engine. As the LLM models are maturing and becoming more efficient, I would still trust the output, but I would still validate whatever it would tell me and I would do that for anything. As I've worked with AI now for the last several years, all models suffer from the same problem and I don't think it is unique to CrowdStrike Falcon. I think it is something that as usage increases, so will the efficacy and capabilities of the models to be able to trust them even more. We get into that situation when should we do a full trust and will we ever? Living in a zero trust environment or mindset, we should never. We should still have some sort of checks and balances and controls in place with a human or another agent or multiple agents to do validation where needed.

I wasn't involved too much with the earlier methods prior to CrowdStrike Falcon's deployment, so I don't have the baseline of where we were prior. However, I can speak to the overall supportability of the tool and the software, ensuring that we are able to quickly update our versioning across a large number of endpoints much more efficiently and effectively than in the past. Our overall deployment and replacement of our previous EDR solution and AV was a much more painless and seamless process to actually be able to deploy within just a matter of weeks, as opposed to older, more legacy software where that might take months. We've also been able to systematically improve our versioning updates. Initially we were doing regular updates that would take several months to ensure that we were continually pushing forward and maintaining those updates and those updated versions. But now with more automation and capabilities to remain as vigilant and compliant as possible, we're now down to automating those updates and are able to complete that within a matter of hours.

We started with EDR and AV and have brought on multiple modules since then. We brought in device control, Falcon Complete, and Overwatch. We have a lot of the prevention and ransomware features enabled and we are eyeballing other features such as AIDR.

CrowdStrike Falcon is a cloud-based deployment that is faster to update and has higher efficacy in terms of their detection capabilities.

Don't get sticker shocked by the price. It does a lot for the money; it's a lot of bang for the buck. Build off of lower tiered offerings and as you mature your organization, see what capabilities and features you have to turn on. It makes it very easy to enable new features. Keep that in mind as you're evaluating products.

CrowdStrike Falcon is the industry leader and continues to maintain that leading the charge of all of this. Having these multiple security products in the same tool is helpful because we already have that peace of mind that they are able to do that proper security. Everything is under a single pane of glass, so we're able to take a look and we can scale, or we only have to offer access via roles and responsibilities via CrowdStrike Falcon platform. We can control everything in one spot, which is also very helpful. The downside of having everything on one platform is if it goes down, then everything is down. We want to really be a bit cautious about how we do that. I would rate this product an 8 out of 10 overall.

My main use case for CrowdStrike Falcon is to monitor endpoint and end devices, find any anomalies, detect them, and provide a resolution to secure our endpoint devices.

I use CrowdStrike Falcon to examine different network traces and traffic around our Windows and Linux devices. CrowdStrike Falcon monitors how people are accessing our applications around those servers and logs, catching any blast radius such as a high volume of bombarding requests coming to a specific server or any unauthorized access to the server, whether internally or from disallowed external sources.

The best features CrowdStrike Falcon offers include endpoint device monitoring, protection from malware and external threats, and alerting on wrong policies being implemented or blocking such as an administrator applying certain policies, making CrowdStrike Falcon a great endpoint protection tool.

The feature I rely on most day to day is endpoint device protection, as CrowdStrike Falcon surpasses tools such as Symantec which do not have interactive monitoring or defensive methodology, allowing us to control and align policies across all servers in our organization.

CrowdStrike Falcon has positively impacted my organization by helping us to stay secure, resilient, and provide what our customers need all the time without impacting their data or disclosing their personal information.

I can share that CrowdStrike Falcon has prevented our end users from uploading malicious files to our applications on those servers, meaning our systems are well protected, and we avoid incidents or threats against our applications.

I chose nine out of ten because while CrowdStrike Falcon has the capabilities and features I want, the pricing for each different functionality or feature we want to add raises my concern about potentially having a compound or overall pricing increase.

I have been using CrowdStrike Falcon for five years.

CrowdStrike Falcon is stable, and I have not witnessed any performance impact on our endpoints due to the Falcon sensor as they are running smoothly without issues. The sensor is deployed through our imaging tool quickly to all endpoints.

CrowdStrike Falcon's scalability is excellent because it is software as a service, allowing us to deploy more agents without experiencing performance lags or issues.

The customer support is excellent. We receive reliable enterprise support when we have issues, and they provide all the guidance we need.

We previously used Symantec and Norton for some time before switching five or six years ago because they became obsolete and failed to keep pace with market advancements.

Using CrowdStrike Falcon has significantly helped our security team by allowing them to get alerts and perform blast radius detection in a straightforward manner, making the process more automated without the need to look through logs.

Since our initial deployment, our use of CrowdStrike Falcon has expanded significantly, starting with the basic Falcon sensor and then gradually including more capabilities around AIDR and other tools.

We utilize Charlotte AI within CrowdStrike Falcon to investigate endpoints and understand what certain actors did, allowing us to retrieve user and machine information quickly without manually browsing through CrowdStrike Falcon.

We have seen a return on investment with CrowdStrike Falcon as our security team has been optimized and scaled, allowing them to conduct more analyses around different security postures because CrowdStrike Falcon handles most of the groundwork.

I am not very knowledgeable about pricing, but I am aware it is quite expensive.

We did not evaluate other options before choosing CrowdStrike Falcon.

CrowdStrike Falcon has already improved significantly with its AI capability, Charlotte, and I am quite happy with what is being offered.

CrowdStrike Falcon's AI capabilities are remarkable, and I trust CrowdStrike to maintain governance, security, and data privacy with the tools they provide.

Regarding the AI capabilities, I have used Charlotte AI a couple of times, and I find it quite accurate, providing the right resiliency and detection during any investigation I perform.

Having multiple security capabilities on a single platform is excellent as it eliminates the need to navigate different tools to find anomalies or detect and analyze root causes, thereby saving time for analysts whenever security breaches or vulnerabilities are identified.

CrowdStrike Falcon helped our team detect a security incident where someone attempted a SQL injection on one of our secured Drupal-based application servers. CrowdStrike Falcon alerted our team, allowing us to block access and patch the vulnerability to avoid any future incidents.

CrowdStrike Falcon has significantly helped my security team reduce their efforts and time spent analyzing vulnerable resources or security mishaps and setting up enterprise policies across the organization.

My advice to others considering CrowdStrike Falcon is that it is a great product that reduces analyst time while providing greater security posture to meet industry standards. I gave this product a rating of nine out of ten.

My main use cases for CrowdStrike Falcon include endpoint defense, investigations, and triage.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by making it much more granular. It allows us to dive deep into the details of an investigation and gain a deep understanding of what is occurring.

I have seen benefits from having multiple security capabilities on a single platform. It makes the unity of all the detections and information being in one place far more beneficial than having to navigate between devices, assets, or tools. This significantly reduces dwell time.

The value I have seen from having endpoint identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is the same; having it all in one location truly benefits the time to remediation.

CrowdStrike Falcon has affected the workload and productivity of my security team by reducing it. We utilize CrowdStrike Falcon Complete as well, and having them serve as the front line for everything eliminates many false positives. When we receive an escalation from them, it is a clear directive stating 'Here is a problem you need to fix,' rather than uncertainty about whether something might be an issue.

CrowdStrike Falcon can be improved by addressing the side tabs and menu options, which represent the biggest area for enhancement.

I cannot identify any additional features that should be included in the next release unless they address that menu structure.

I have been using CrowdStrike Falcon for three months.

I would assess the stability and reliability of CrowdStrike Falcon as good. There appear to be occasional issues with their hosting infrastructure; US2 might experience downtime occasionally. Having greater focus on that from their side would be beneficial.

I have experienced the portal being unavailable to log into only occasionally, but beyond that, there has been no significant downtime, crashes, or performance issues.

We have not noticed any hardware issues or strain from the CrowdStrike Falcon sensor on endpoint performance and our ability to deploy security at scale. It provides the fine details necessary for thorough investigations.

I would evaluate customer service and technical support as good. Since we are still in rollout and working with CrowdStrike Falcon Launch, we have not yet needed to use the actual on-demand support, but it appears to be solid.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools.

As we are still in the rollout phase, it will replace Palo XDR, to some degree Splunk, and Palo XSOAR. Having everything on one platform with a single login and single pane of glass would be truly beneficial. Those three have been the primary tools being replaced.

I would describe my experience with deploying CrowdStrike Falcon as relatively streamlined. I believe we make it difficult ourselves, but for the most part, it has been quite seamless.

Getting an endpoint removed and a new endpoint installed with a single reboot has presented some challenges.

I have seen a return on investment with CrowdStrike Falcon. The amount of alert fatigue that we would have experienced with other tools has decreased significantly.

With Palo XDR, we would constantly receive alerts, granted they were alerts we set up. However, because it lacked the granularity to specify certain conditions while excluding others, we received far more alerts. Now, escalations are very limited, which is beneficial.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that the crowd aspect of CrowdStrike is valuable because we gain insight from attack vectors and methods we do not experience ourselves, allowing us to build alerts or develop awareness for them.

My use of CrowdStrike Falcon has expanded since my initial deployment. The initial deployment focused strictly on endpoint defense. We now have endpoint, SOAR, SIEM, and even some asset inventory capabilities, which is beneficial.

Currently, we are using AI within CrowdStrike Falcon to build many of the SOAR playbooks within their SOAR solution.

The impact AI has had on my security operations allows us to investigate matters more deeply and build very specific exclusions or alerting rules, which is beneficial.

The advice I would give to other organizations considering CrowdStrike Falcon is that while there is much to tackle and accomplish, it is well worth the effort. I would rate this product 9 out of 10.

My main use cases for CrowdStrike Falcon are endpoint security, using one sensor to deploy various different types of tools. The end goal is less agent on an endpoint where I could accomplish so much with just one sensor installed, and that truly impresses me.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats. Our response ratio, which was our end goal, has decreased significantly from what it used to be.

In security incidents where multiple malware activities have occurred, CrowdStrike Falcon has prevented them, which could have resulted in much greater costs.

The benefits I have seen from having multiple security capabilities on a single platform are that it made my team's life easier by deploying one less agent on an end host, where we have seen significant performance improvement.

The value I have seen from having endpoint, identity, cloud, and other security telemetry in CrowdStrike Falcon is that a single pane of glass has really helped us. The analysts are not fatigued by moving between different platforms. It's a single pane of glass that has helped us focus on our goal.

CrowdStrike Falcon could be improved in several areas. For the next release, I have seen exposure management and some new modules coming up. If I had to compare with other products, it's not there yet. I was wondering if modules could be enhanced, especially on SSPM and exposure management.

I have been using CrowdStrike Falcon for five years.

I assess the stability and reliability of CrowdStrike Falcon as approximately 99% uptime, so it's very good.

I have experienced only the July 19th incident as downtime, crashes, or performance issues.

The impact that CrowdStrike Falcon sensor has had on endpoint performance and my ability to deploy security at scale is significant. The performance improvements have been substantial. Deploying one less agent has been easier to maintain.

I evaluate customer service and technical support as excellent. I have seen better improvement than other vendors I have worked with.

CrowdStrike Falcon has allowed me to consolidate and replace other security tools.

We decommissioned Trellix by replacing it with EDR. We also replaced Qualys by implementing exposure management.

I would describe my experience with deploying CrowdStrike Falcon as very easy and straightforward. I had a very good experience compared to other EDRs I have worked with.

What worked well is that it was easier to reach our metrics. The challenges I faced were keeping up with the sensors and sensor version updates. The deployment pace was very fast, making it difficult to keep up with.

I have seen return on investment with CrowdStrike Falcon. Addressing downtimes based on malware activities, I think we have seen great improvement.

My experience with pricing, setup cost, and licensing is that the license is expensive since it is based on per host. It is more expensive than other solutions I have dealt with.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is mainly the performance, where we have seen a vast improvement.

The impact it has had on my security operations is that it has made it easier for me to accomplish a lot of our use cases and finish all those tasks.

My use of CrowdStrike Falcon has expanded since my initial deployment as we have purchased many additional modules. We started with EDR and expanded with different modules like CrowdStrike Falcon for IT and exposure management.

I am currently using AI within CrowdStrike Falcon to write queries.

The advice I would give to other organizations considering CrowdStrike Falcon is to move forward with it. I provide this review with an overall rating of 9 out of 10.

Our main use cases for CrowdStrike Falcon are that we are a Falcon Complete customer and we are likely expanding in the next year. We are going to go with Next Gen SIM. I am here because I already took my class. We are going to integrate Identity, and we might be doing AIDR as well.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats. I think this has a lot to do with some of the automation and the ability to see things before they happen, and it results in very few false positives. Normally, if we get alerted, there is something we need to address or look into immediately.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools. We are in the process of that right now by proof of concepting out Next Gen SIM, Identity, and AIDR. We are going to be probably discontinuing our current SIM to go to Next Gen and some of our identity monitoring tools will likely be sunsetted when we get Identity spun up.

The value I have seen from having endpoint, identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is fantastic. You are seeing potential attack points from many different angles while monitoring user activities and behaviors. It is absolutely a great product and a great platform.

CrowdStrike Falcon can be improved by continuing to keep everything on the cutting edge. The product works and is stable, as long as we do not have a rehash of what happened in the summer of 2024 because I dealt with that frontline. The product works well, is not a resource hog, and is the best in the class. Just keep progressing and adding new features as the IT field changes for the next ten to twenty years.

From my perspective on identity access management, there are additional features I would like to see included in the next release of CrowdStrike Falcon. I am just getting started with the Identity portion of CrowdStrike Falcon, so if you ask me this next year, I would probably give you a great answer, but right now I cannot.

I have been using CrowdStrike Falcon for a good five years, which is when we first started.

I assess the stability and reliability of CrowdStrike Falcon as high. There was only one issue, and we all know when that was, and we hope it does not happen again.

I have not experienced any downtime crashes or performance issues with CrowdStrike Falcon. The only downtime we have ever experienced was in June of 2024.

The impact of CrowdStrike Falcon sensor on endpoint performance and my ability to deploy security at scale is minimal. Loading the sensor is really a piece of cake. We have it scripted into new machine builds and it is very easy to manage and easy to get pushed out to the base.

I would evaluate customer service and technical support for CrowdStrike Falcon as very good. Our product teams, sales engineers, and support are always good. Support is very good across the board. Everybody is friendly, knowledgeable, and wants to help, and you can feel that they want to keep your business. Many companies in this era seem like they do not care. CrowdStrike does care.

My experience with deploying CrowdStrike Falcon is positive. Getting the agent out on the workstations and servers is easy. Once you get your tenant set up and you have your CIDs and everything, building it out becomes straightforward. We have now built out three or four different tenants and it gets easier every time.

What works well with CrowdStrike Falcon deployment is that we really did not face major challenges. The biggest challenge is always finding all of the machines in your environment because asset inventories are often not accurate, new machines are coming in, and old machines are going out. So that is really the biggest challenge and that really is not a CrowdStrike Falcon issue; that is just a corporate IT issue.

I have seen return on investment with CrowdStrike Falcon. I am sure this is the case because we are in the medical industry and keeping PHI and everything safe. We have to have cyber liability insurance, and knowing that we have CrowdStrike Falcon definitely helps when it comes to the bottom line and helping our insurance rates stay at a fair level.

My experience with pricing, setup costs, and licensing for CrowdStrike Falcon is that it is pretty fair. We are always able to get to a good price and the proper amount of licensing. It is very fair.

My advice to other organizations considering CrowdStrike Falcon is to definitely work with one of the good reselling partners. We use GuidePoint, and they are fantastic. I can also say that you should really get to know your CrowdStrike Falcon team once they are assigned to your company because they are definitely assets to leverage. I would rate this product as a nine overall.

My main use case for CrowdStrike Falcon is protecting high value assets and servers. For example, we typically have a lot of people doing click-through for downloads of remote management and ScreenConnect type software, so CrowdStrike Falcon is really good at identifying those user interactions, the clicks, and the hacker trying to come in and log in using that ScreenConnect software; we do see that a lot.

The best features CrowdStrike Falcon offers include the time to discovery, the cost and effectiveness of the software, and the ability to isolate machines and allow for remediation.

The ability to isolate machines has positively impacted my operations because it can take the threats offline quickly and allow us the time that we need to be able to interact with them and get them back online properly.

CrowdStrike Falcon has positively impacted my organization by allowing our admins and our Security Operations Center folks to be able to focus on other things, giving them enough time to not just be dealing with these incidents on a regular basis, but allowing us to free that time and use it in other places more effectively.

I am pretty happy with CrowdStrike Falcon where it is. I do like some of the new features being added to it with some of the AI pieces and the SIM, and we have not really broached those pieces yet, but I think we are really interested in at some point expanding our portfolio.

Regarding CrowdStrike Falcon's AI capabilities, I think it still needs a little bit of time to learn and improve itself in the environment, but overall it has been pretty accurate.

I have been using CrowdStrike Falcon for approximately four years.

CrowdStrike Falcon is very stable.

CrowdStrike Falcon's scalability has been good because we have not had any issues. We are using automated deployment methods such as Jamf for Macs and adding AD groups, so members just get joined to an AD group, and the agent is deploying effectively, allowing us to do dozens of machines at a time without any issue.

Customer support has been good. We do have a third-party MSP that is assisting us with some of those issues, so between that and the MSP, we are actually doing pretty good.

We were primarily using Microsoft Defender before choosing CrowdStrike Falcon. It just was not very effective, especially on things like Linux and Mac.

My experience with pricing, setup cost, and licensing has been pretty seamless. We are purchasing from multiple sources for various reasons, but working with CrowdStrike Falcon directly through a third-party VAR has actually been working out really well without any issues or hiccups.

CrowdStrike Falcon has allowed us to consolidate or replace other security tools, and we have actually replaced traditional antivirus in most of our deployment cases, not requiring to have paid extra money for the high-level Defender or a third-party software for our Macs. We are able to almost ubiquitously deploy CrowdStrike Falcon to all of our Linux, Macs, and Windows boxes easily.

I think we have seen a return on investment from CrowdStrike Falcon, as generally the amount of time saved not having to threat hunt and look for these issues as they pop up saves us if we can catch it early enough from having to disable multiple users, which may be part of a later phishing event or disruption event in our environment.

We did not purchase CrowdStrike Falcon through the AWS Marketplace.

Before choosing CrowdStrike Falcon, we really did not look around a lot, as we actually got such a good deal, and based on the reputation and other folks purchasing it in higher ed, we just really went back through it. We did not do a bake-off or anything.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by allowing us to focus on other things and not really worry about this. We only need to concentrate on these threats and indicators once they happen.

Having multiple security capabilities on a single platform has allowed us to work more effectively because I think the more things that you can consolidate into a single pane of glass allows the users to work more effectively without having to keep switching back and forth.

A security incident where CrowdStrike Falcon helped my team detect or stop a threat involved users getting phishing links that told them to download software, which actually downloads ScreenConnect remote access software to their workstations. CrowdStrike Falcon has been detecting these indicators, and we have been able to tell it that since it is not an authorized application within our university, we can have it stop, block, and isolate those instances and notify the SOC, which works pretty well because we are able to then isolate the user, educate the user through the help desk, and have the box re-imaged to make sure it is clean.

CrowdStrike Falcon has affected the workload or productivity of my security team by allowing us to concentrate on other things because this is very self-driven and keeps things moving.

The CrowdStrike Falcon sensor has had a positive impact on endpoint performance and my ability to deploy security at scale because we actually have not had any negative impacts at all. It has all been positive, with the exception of some maybe glitches on the Linux boxes, but there really have not been any performance or issues otherwise.

We are honestly probably not using AI within CrowdStrike Falcon as effectively as we could, but we do use it to help search for related incidents and similarities within the console to see what is there.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is the ease of use and the lightweight client, which seem to be the biggest advantages.

The best advice I could give to others looking into using CrowdStrike Falcon is to listen, understand what your options are, make sure you have a good idea of what your deployment is going to look like and plan for that, and then everything should flow freely. Do not buy it haphazardly. I would rate this review a 10 out of 10.

CrowdStrike Falcon is primarily used because we are a system integrator that sells a solution to our customers, so most of it is endpoint security.

We are not the one operating CrowdStrike Falcon, but when we do an implementation, once we install the agent and complete the implementation, we see what it has detected from day one of the implementation until the turnover to the operations team. The Falcon Complete dashboard is intuitive, especially OverWatch, which highlights every risk that we need to manage, and also the detection field and incident field where we can see the entire timeline and all the things that happened. There is also a network map where you can see, for example, if there is one detection on a workstation, which other users or other devices it communicated with.

We are primarily utilizing Charlotte AI within CrowdStrike Falcon platform. We use it extensively on CrowdStrike Falcon EDR, plus also NG-SIEM, because with Charlotte, it can help us create queries without doing it manually.

One of the key advantages of CrowdStrike Falcon is its lightweight sensor, so it is easy to deploy compared to other security solutions.

CrowdStrike Falcon provides results because, until now, no customer of ours has gotten ransomware or been infected.

The most common solutions that I compare CrowdStrike Falcon to in my country are Trend Micro, Sophos, and Palo Alto and SentinelOne. The really key advantage of CrowdStrike Falcon is its lightweight sensor. Some of the companies that I mentioned earlier had a hard time deploying because they have 400 to 500 MB of sensor, which if you deploy it on 3,000 or 4,000 endpoints, it will really slow down their network. Unlike with CrowdStrike Falcon, we can deploy, for example, 2,000 endpoints a day.

There is no impact on endpoint performance. On some of the other products that I compared CrowdStrike Falcon with, some of them cause high utilization. We have not experienced that with CrowdStrike Falcon.

For me as the one who implements CrowdStrike Falcon, it has a real impact because it is easy to deploy. Even though the customer does not have software deployment tools, you can deploy CrowdStrike Falcon by having a simple GPO, a Group Policy Object, load it there, and then you can install it easily.

For endpoint performance, it is great because it is very lightweight. It is not the traditional antivirus from before where when you do a scan and install it, the CPU and memory will spike up and the user cannot do anything about it. CrowdStrike Falcon is very lightweight. With that, users do not need to balance between usability and security because with CrowdStrike Falcon, you can have both.

CrowdStrike Falcon can improve their supportability of legacy devices. This is where CrowdStrike Falcon has been edged out by other cybersecurity vendors because some of them support legacy operating systems, unlike CrowdStrike Falcon that primarily uses one level higher of operating system than others.

In the cybersecurity field, I have been working for more than ten years. We have been working with CrowdStrike Falcon since 2022 to now.

In terms of reliability, ever since I used CrowdStrike Falcon platform, I think it is still okay because the GUI, the dashboard, and the console are easy to use because all of their solutions are in one platform, so you will not get lost. They have OverWatch and a detection incident where all the detection is already consolidated there. Once you click it, you are going to see all the details.

The most common solutions that I compare CrowdStrike Falcon to in my country are Trend Micro, Sophos, and Palo Alto and SentinelOne. The really key advantage of CrowdStrike Falcon is its lightweight sensor. Some of those companies that I mentioned had a hard time deploying because they have 400 to 500 MB of sensor, which if you deploy it on 3,000 or 4,000 endpoints, it will really slow down their network. Unlike with CrowdStrike Falcon, we can deploy, for example, 2,000 endpoints a day.

When we had an issue, for example, on an agent installation because of one legacy device or when we were installing it with another endpoint application, we had CrowdStrike Falcon support come in with us. They are very helpful because they were able to resolve our issue.

We had one experience with one of our customers where at first, they were not a CrowdStrike Falcon user. They had a ransomware with a different solution, not CrowdStrike Falcon. After that, we asked them to try CrowdStrike Falcon and install it, then we could see other detections that their previous vendor or solution did not see. After we were able to help them clean their environment, they transitioned to CrowdStrike Falcon with Falcon Complete, with the managed detection and response of CrowdStrike Falcon.

The most common solution right now in my country is NG-SIEM. Before, they used a different SIEM, like Splunk, Rapid7, Exabeam, or QRadar, but now that they see the value of CrowdStrike Falcon XDR and they want it to work together, most of them are trying to move to NG-SIEM so that you can have your XDR and your SIEM in one platform, plus the telemetry that CrowdStrike Falcon endpoint provides. This will really help them secure their environment.

I think it is very great that we have a solution as CrowdStrike Falcon which has many different security functionalities because threats are evolving. As the defender, we need to evolve as well. We are fortunate to have CrowdStrike Falcon that is continuing to evolve, even now in the AI era because threats are more complex than before. Before you just needed to worry about the zero-day and the signature. Now it is different with AI. We are fortunate we have CrowdStrike Falcon with us.

I am confident that CrowdStrike Falcon is up to par to protect you and your customers from AI threats.

Most of our customers in my country use CrowdStrike Falcon, and ever since then, they do not have serious incidents, such as a ransomware that has taken effect on all their critical infrastructures, including servers.

One value or benefit that customers can have from CrowdStrike Falcon is not having their solutions in silos. If it works in silos, it is going to be hard to keep track of threats, especially now that AI is moving at AI speed. If we are working in silos or have different solutions, it is going to be hard to catch up. Did they get anything on the identity solution? Did they get anything on the cloud solution? With CrowdStrike Falcon, it is all in a single sensor and a single platform. Customers are going to have a single pane of glass that they can look at.

The impact of AI features such as Charlotte AI on our security operations makes our lives easier, not only for us but also for our customers. Before, when they were going to do a query, they needed to drill down multiple times before they got to the one event that they wanted to see. Now, if you ask Charlotte, it is one click of a button and enter, and Charlotte will give you everything. It is much faster than drilling down to all the events and all the reports.

Customers usually get Falcon EDR first, Falcon Pro. After that, they expand to Falcon Complete, meaning adding the MDR services, and now they are trying to go to NG-SIEM plus the identity. Now that they have heard about Falcon Guardian, they might look into that as well.

If I were to give advice for someone who is evaluating or considering CrowdStrike Falcon platform, I think they need to try it so they can feel the experience and the protection and the security that CrowdStrike Falcon provides. I rate this solution a ten out of ten.

Our main use cases for CrowdStrike Falcon are endpoint security and USB access, with endpoint security being our primary focus.

I can describe a security incident where CrowdStrike Falcon helped my team detect and stop a threat. One of our IT help desk analysts downloaded a BIOS update from Dell without realizing it contained a critical vulnerability. CrowdStrike Falcon helped us block that download and alerted us to investigate it. We were able to follow up, see what process was running, and determine that our analyst needed to double-check that we were downloading and uploading up-to-date BIOS updates.

My use of CrowdStrike Falcon has expanded since my initial deployment from endpoint security to USB access. We were initially managing USB access through GPO, but we decided to transition to CrowdStrike Falcon because it provided us with greater visibility.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats because it gives us a lot of granularity on what goes on, what processes are being run, and what is actually being executed if anyone is trying to get onto our endpoints.

The benefits I have seen from having multiple security capabilities on a single platform is that it gives us more tools to investigate and specifically tells us what happened. Having all those tools at our disposal gives us the benefit of knowing exactly what happened, what time it happened, and what process or executable was being run.

The value I have seen from having endpoint identity, cloud, and other security telemetry in CrowdStrike Falcon is that it is good to have it all consolidated in one platform so we do not have to deal with logging in and going to multiple different sources. It is all consolidated, so it is good to have one platform that we can go to.

CrowdStrike Falcon has affected the workload or productivity of my security team by simplifying it significantly. It also gives us the flexibility to simplify our processes, but if we want to get granular, we can go in deeper, investigate, and get down to the details.

We are not currently using AI within CrowdStrike Falcon, but that is definitely something that we want to explore further because we know that CrowdStrike values the discovery of AI and ensuring you have full coverage.

CrowdStrike Falcon can be improved by strengthening the focus on AI and keeping up with responding to AI as it constantly evolves. It would be beneficial to have more information on that.

I have been using CrowdStrike Falcon for about eight months, ever since I started at Royal Business Bank back in January, and it has been really good to us so far.

I would assess the stability and reliability of CrowdStrike Falcon as very reliable. A lot of the information they provide us is accurate and delivered in real-time.

I have not experienced any downtime, crashes, or performance issues with CrowdStrike Falcon.

CrowdStrike Falcon has had a positive impact on endpoint performance and my ability to deploy security at scale. Everything has been smooth and happens autonomously. We do not have to be closely monitoring the sensor updates that get deployed. The simplicity of the process is a major advantage.

I would evaluate customer service and technical support as really good. They are very fast and usually respond within a few hours, providing us with all the information we need, including documentation, notes, and action items we need to take.

CrowdStrike Falcon has allowed us to consolidate or replace other security tools. We have had a few security tools that were redundant, and it helped us with the cost benefit of cutting those off and consolidating everything into one security tool.

We decided to cut Darktrace and stick with CrowdStrike Falcon because we realized we do not really need two platforms for the same process. Darktrace is more of a network security platform, and CrowdStrike Falcon does a little bit of both.

I would describe my experience with deploying CrowdStrike Falcon as good and simple. It has been really easy to deploy out, and if I ever need anything, the support is always really good.

What worked well during deployment was that CrowdStrike Falcon was really responsive when we faced some challenges with a recent Dell BIOS update that they were flagging. It created a lot of noise for us, but CrowdStrike Falcon had documentation on that specific type of update and let us know the response action that we needed to take.

I have seen a return on investment with CrowdStrike Falcon. The business has definitely seen a significant investment in it, particularly with the amount of visibility and the ability to triage and manage alerts that we now have.

My experience with pricing, setup cost, and licensing has been good with no complaints. It has been really simple, and they have been very honest and willing to work with us.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is the comparison with Arctic Wolf, which is a managed detection and response platform. The main difference was the granularity and the ability to give us more data to read and analyze.

I would rate CrowdStrike Falcon overall as a nine out of ten because it is a really good tool, and obviously nothing is perfect, but it is definitely a big player in the security industry. I would advise other organizations considering CrowdStrike Falcon that if you want to get more visibility and more data, then CrowdStrike Falcon is definitely something you should consider. I think their customer support is really good and their agents are very professional and smooth. If you are ever looking for more granular insights, CrowdStrike Falcon is the way to go.

My main use case for CrowdStrike Falcon is endpoint detection for the most part.

The other part would be all the other capabilities that we use it for, such as identity, detection, policies, response, RTR, and forensics.

The benefits I've seen from having multiple security capabilities on a single platform include a single pane of glass, the ability to contain, and eradicate threats easier.

The value I've seen from having endpoint, identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform makes it easy to use one path to focus on specific threats and be able to correlate them together, especially with advanced search and using the graph.

CrowdStrike Falcon has definitely decreased the workload and increased the productivity of my security team compared to if we were to use something else.

The Falcon sensor's impact on endpoint performance is that it does not necessarily affect it in a negative way; the agent does not. From a security perspective, it has a very high impact with ensuring things are secure.

The only downside is trying to figure out all the agents or all of the machines that do not have CrowdStrike Falcon on them, unlike SentinelOne which has a feature for that, along with a feature where you can roll back to detect ransomware if you ever get ransomware.

CrowdStrike Falcon can be improved by having the ability to scan the network to determine what machines do not have CrowdStrike Falcon on, which is a big one, and having the ability to roll back from the volume image if you get encrypted. Other than that, it is pretty solid; you have a monopoly on the field as of now.

I have been using CrowdStrike Falcon for seven or eight years.

I would assess the stability and reliability of CrowdStrike Falcon as a 10 out of 10.

I have not experienced any downtime, crashes, or performance issues with CrowdStrike Falcon.

My use of CrowdStrike Falcon platform has expanded significantly since my initial deployment; I started with Falcon when I worked for the government and then moved to the private sector. As an incident responder, the majority of clients did not have Falcon, and that is when I got compromised. After we installed Falcon, it made life much easier for them. As times changed, Falcon has come a long way from where it first started; I believe you switched your query language to make it faster, as one of the complaints back then was that it was too slow. Now it is much faster and scales at a large scale, so there are definitely many improvements since the first time I ever used it.

I would evaluate customer service and technical support as generally good, but we must mention 2024 because that was the issue with the blue screens; other than that, there were no other issues.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools; we replaced a couple when we added specific features.

One of the tools I replaced was Wiz; some of the Wiz sensors we replaced with CrowdStrike cloud Falcon sensor because it was cheaper, and then another one with Falcon Forensics would have been Axiom or FTK. However, we have a retainer, so we do not really dive into Falcon Forensics extensively. The identity one, I had a POC but did not prefer it for whatever reason, so I did not replace anything there that I can think of now.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that, from an EDR perspective, it has a tight grip on everything; in some aspects, such as Falcon Forensics, I have used Axiom in the past, and Axiom is probably better. For identity, there are better identity solutions out there, and for host management, Spotlight is one that we replaced Tenable with; it is pretty solid for vulnerability management, especially because it does automatic scanning. One challenge is trying to convince auditors that this is the solution now because they cannot keep up with the times. Overall, CrowdStrike Falcon is pretty amazing.

I would describe my experience with deploying CrowdStrike Falcon as pretty easy to deploy; I have not deployed it in a minute, but when I did, I just hooked it up in whatever automation platform the company at the time used and went from there.

In terms of deployment challenges, figuring out which machines do not have it is an issue I faced, while what worked well was being able to install it and having installers available for different operating systems, although legacy operating systems are difficult to get an installer for, such as 2008 and 2003.

I have seen return on investment with CrowdStrike Falcon.

Return on investment would be most likely just being able to consolidate tools; Spotlight was a big one, and asset discovery is a big one.

I do not deal with pricing, setup costs, and licensing, but I know that it is approximately 60 dollars per endpoint at MSRP, and they make deals based on that. Our sales reps are pretty good, so we just let the sales rep talk to us, and they sold us on it right there.

I would recommend CrowdStrike Falcon over Carbon Black, SentinelOne, Huntress, and any other main EDR solutions to another organization considering it.

The impact of Charlotte AI on my security operations is high from the perspective of being able to find things quicker, but if you ask it to do complex tasks, it is not necessarily the best. I would rate this review an 8 out of 10 overall.

My main use cases for CrowdStrike Falcon mostly center around their Falcon EDR offering and the suite around it, such as what used to be called Spotlight and Complete, OverWatch, and all those capabilities.

Using CrowdStrike Falcon has provided significantly more visibility than previous tools I used, as well as a more streamlined management of exceptions. There are fewer exceptions that are required for the sensor to run. It also runs significantly lighter than the previous providers that I have used in this space.

The benefits I have seen from having multiple security capabilities on a single platform are that it makes monitoring everything significantly easier. It significantly reduces the amount of time needed to do it. When I can see vulnerabilities as well as detections and identity risks all in one spot, it makes it significantly easier to manage and correlate events.

I have seen value from having endpoint, identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform. While we have not implemented cloud yet, having identity in the same platform has definitely helped me correlate events with potentially risky identities as well as see a path from potentially compromised devices to a higher privileged identity through having that link together.

I do not have much to offer regarding how CrowdStrike Falcon can be improved.

I have been using CrowdStrike Falcon for about three or four years.

I would assess the stability and reliability of CrowdStrike Falcon as very smooth. Outside of the one blackout we experienced, everything has been working well.

I have not experienced any downtime, crashes, or performance issues outside of that event.

The impact of the CrowdStrike Falcon sensor on endpoint performance and my ability to deploy security at scale has been positive. Considering that we transitioned from a previous provider and not from a blank slate that did not have an EDR on it, we saw performance improvements when implementing CrowdStrike Falcon on systems. It was also a very easy deployment, both through N-central and Amybot for at-scale deployments. It has been very efficient at doing so.

My evaluation of customer service and technical support has overall been fairly good. We were able to resolve a couple of tickets, both at the previous employer and at this one, very smoothly and fairly quickly.

I had previously been using SentinelOne EDR alongside another EDR for its network security aspect and compliance profiles. We have essentially been able to replace SentinelOne with CrowdStrike Falcon and still get all the same visibility that I needed.

My experience with deploying CrowdStrike Falcon was very simple and straightforward. The silent install worked well. I do not think it has failed, or if it has, it was in an extremely minimal amount of cases, especially relative to other deployments that needed significantly more handholding. The one sensor that gets installed across all systems, whether Windows end-user or server device, has made deployment very simple. Deployments on Mac and Linux have also been very problem-free.

I have seen return on investment with CrowdStrike Falcon. We have saved a lot of time and significantly reduced the resources we are using, both on servers and end-user devices, which certainly has increased productivity for everyone.

Regarding my experience with pricing, setup cost, and licensing, I can speak from different perspectives. At my previous employer, we were closer to a medium-sized business, and I could easily see the value of adding CrowdStrike Falcon. I can also discuss the perspective of smaller customers who find it challenging to motivate the acquisition of CrowdStrike Falcon due to higher pricing compared to other players in the field. However, we have been fairly successful so far. On bigger enterprises, there is a very easy way to show ROI and value in implementing CrowdStrike Falcon over a competitor.

I still need a separate vendor for next-gen firewalls, for example, which CrowdStrike Falcon does not provide. However, it has allowed me to definitely consolidate on the endpoint stack between compliance, vulnerability, and actual endpoint protection.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools significantly.

My advice to other organizations considering CrowdStrike Falcon is that if the organization has the size to seriously evaluate the Complete offer, the pricing difference is usually more than justified in acquiring it.

The impact on my security operations has been that it has made us more confident in the delivery of security, both within client environments and within our own.

Reducing the workload around it enables us to do more valuable work in that space and provide security that we feel is more adequate and that we are more confident in.

I can describe a security incident where CrowdStrike Falcon helped my team detect a threat. We had an issue with a stealer log that somehow ended up on a server machine, which we were able to trace back to the administrator who accidentally uploaded it through a Samba share.

I have given this review a rating of ten out of ten.