CrowdStrike Falcon Reviews

My main use case for CrowdStrike Falcon is endpoint detection and response. We use CrowdStrike Falcon for our antivirus across our entire organization, as well as insight and investigation to event data, telemetry data, and a plethora of other use cases and visibility.

Their early warning detections, their ransomware protections, their endpoint detection and response capabilities, and the telemetry data that allows us deeper insight into identifying threats as well as utilizing that for troubleshooting purposes are the best features CrowdStrike Falcon offers. It is pretty useful to glean a lot of details of what's happening within a process when you're trying to figure out something in a more technical aspect of the problem.

Positively, we have been able to successfully maintain compliance within all of our security obligations within our industry. We have had next to zero downtime outside of larger widespread problems, which has allowed us to remain secure on all of our endpoints and be able to conduct business with a lot less worry. We have also been able to improve our response speed to potential threats and infiltrations into the firm, as well as hardening those areas and offering faster and more effective remediation methods based on the data found from CrowdStrike Falcon.

There are a number of areas that I only touch a handful of times, but when I get in there, I realize why I don't do that. The main area would be within the support area. The support bot is not really as smart as you would expect it, especially in this day and age of LLM and other capabilities that I know CrowdStrike Falcon is already capable of doing. Additionally, I would appreciate a little bit more easy to read insights of some of the dashboards or maybe manipulation of the dashboards. It is still a little cumbersome to build custom dashboards and it's not as intuitive as you would think.

Documentation is abysmal and needs to be improved dramatically. I know that there's a big effort to do this, however, even the new effort is honestly worse than it was before. Those are definitely major areas of improvement, just more in the usability of the features.

I have been using CrowdStrike Falcon since 2014.

We have put CrowdStrike Falcon at the top of our detection list, meaning we are now getting what we feel to be higher efficacy alerts and prevention capabilities to our entire fleet. That has helped speed up our response capabilities as well as improve our CIS benchmarking for different areas and different teams.

It has increased the speed in which we are able to address incidences and it has increased the deployment capabilities of our security solutions that we are subscribing to within CrowdStrike Falcon.

I feel CrowdStrike Falcon's AI capabilities are a lot better than they were even six months ago and after a lot of the sessions that I've sat in this week, I am optimistic that they are getting their heads wrapped around what is most important, obviously starting with discovery. Initially as AI was this budding landscape and budding technology, CrowdStrike Falcon was just there and it was a little easy to read through the marketing fluff. However, they really seem to have figured it out. They understand already because CrowdStrike Falcon is a great company. They've already gotten a head start in understanding the nuances and difficulties around security and staying on the bleeding edge. In terms of AI, I think that they really are defending the right areas to gain that appropriate visibility and then put the appropriate guardrails in place. I also appreciate how CrowdStrike Falcon is on the forefront of governance and actually helping define that across the industries to ensure that there is safe usage of AI and that education is disseminating out from them.

As with any AI output, I am a little hesitant to believe it outright as I do think that it still hallucinates quite a bit. I have not had the opportunity to play too much with the AI outside of the support AI, which again I already mentioned is not good and in my opinion is more a chatbot than anything else. The Charlotte AI, initially, and again, I have not tried it in the last year or so, but the Charlotte AI, I felt initially was more a glorified search engine. As the LLM models are maturing and becoming more efficient, I would still trust the output, but I would still validate whatever it would tell me and I would do that for anything. As I've worked with AI now for the last several years, all models suffer from the same problem and I don't think it is unique to CrowdStrike Falcon. I think it is something that as usage increases, so will the efficacy and capabilities of the models to be able to trust them even more. We get into that situation when should we do a full trust and will we ever? Living in a zero trust environment or mindset, we should never. We should still have some sort of checks and balances and controls in place with a human or another agent or multiple agents to do validation where needed.

I wasn't involved too much with the earlier methods prior to CrowdStrike Falcon's deployment, so I don't have the baseline of where we were prior. However, I can speak to the overall supportability of the tool and the software, ensuring that we are able to quickly update our versioning across a large number of endpoints much more efficiently and effectively than in the past. Our overall deployment and replacement of our previous EDR solution and AV was a much more painless and seamless process to actually be able to deploy within just a matter of weeks, as opposed to older, more legacy software where that might take months. We've also been able to systematically improve our versioning updates. Initially we were doing regular updates that would take several months to ensure that we were continually pushing forward and maintaining those updates and those updated versions. But now with more automation and capabilities to remain as vigilant and compliant as possible, we're now down to automating those updates and are able to complete that within a matter of hours.

We started with EDR and AV and have brought on multiple modules since then. We brought in device control, Falcon Complete, and Overwatch. We have a lot of the prevention and ransomware features enabled and we are eyeballing other features such as AIDR.

CrowdStrike Falcon is a cloud-based deployment that is faster to update and has higher efficacy in terms of their detection capabilities.

Don't get sticker shocked by the price. It does a lot for the money; it's a lot of bang for the buck. Build off of lower tiered offerings and as you mature your organization, see what capabilities and features you have to turn on. It makes it very easy to enable new features. Keep that in mind as you're evaluating products.

CrowdStrike Falcon is the industry leader and continues to maintain that leading the charge of all of this. Having these multiple security products in the same tool is helpful because we already have that peace of mind that they are able to do that proper security. Everything is under a single pane of glass, so we're able to take a look and we can scale, or we only have to offer access via roles and responsibilities via CrowdStrike Falcon platform. We can control everything in one spot, which is also very helpful. The downside of having everything on one platform is if it goes down, then everything is down. We want to really be a bit cautious about how we do that. I would rate this product an 8 out of 10 overall.

My main use case for CrowdStrike Falcon is to monitor endpoint and end devices, find any anomalies, detect them, and provide a resolution to secure our endpoint devices.

I use CrowdStrike Falcon to examine different network traces and traffic around our Windows and Linux devices. CrowdStrike Falcon monitors how people are accessing our applications around those servers and logs, catching any blast radius such as a high volume of bombarding requests coming to a specific server or any unauthorized access to the server, whether internally or from disallowed external sources.

The best features CrowdStrike Falcon offers include endpoint device monitoring, protection from malware and external threats, and alerting on wrong policies being implemented or blocking such as an administrator applying certain policies, making CrowdStrike Falcon a great endpoint protection tool.

The feature I rely on most day to day is endpoint device protection, as CrowdStrike Falcon surpasses tools such as Symantec which do not have interactive monitoring or defensive methodology, allowing us to control and align policies across all servers in our organization.

CrowdStrike Falcon has positively impacted my organization by helping us to stay secure, resilient, and provide what our customers need all the time without impacting their data or disclosing their personal information.

I can share that CrowdStrike Falcon has prevented our end users from uploading malicious files to our applications on those servers, meaning our systems are well protected, and we avoid incidents or threats against our applications.

I chose nine out of ten because while CrowdStrike Falcon has the capabilities and features I want, the pricing for each different functionality or feature we want to add raises my concern about potentially having a compound or overall pricing increase.

I have been using CrowdStrike Falcon for five years.

CrowdStrike Falcon is stable, and I have not witnessed any performance impact on our endpoints due to the Falcon sensor as they are running smoothly without issues. The sensor is deployed through our imaging tool quickly to all endpoints.

CrowdStrike Falcon's scalability is excellent because it is software as a service, allowing us to deploy more agents without experiencing performance lags or issues.

The customer support is excellent. We receive reliable enterprise support when we have issues, and they provide all the guidance we need.

We previously used Symantec and Norton for some time before switching five or six years ago because they became obsolete and failed to keep pace with market advancements.

Using CrowdStrike Falcon has significantly helped our security team by allowing them to get alerts and perform blast radius detection in a straightforward manner, making the process more automated without the need to look through logs.

Since our initial deployment, our use of CrowdStrike Falcon has expanded significantly, starting with the basic Falcon sensor and then gradually including more capabilities around AIDR and other tools.

We utilize Charlotte AI within CrowdStrike Falcon to investigate endpoints and understand what certain actors did, allowing us to retrieve user and machine information quickly without manually browsing through CrowdStrike Falcon.

We have seen a return on investment with CrowdStrike Falcon as our security team has been optimized and scaled, allowing them to conduct more analyses around different security postures because CrowdStrike Falcon handles most of the groundwork.

I am not very knowledgeable about pricing, but I am aware it is quite expensive.

We did not evaluate other options before choosing CrowdStrike Falcon.

CrowdStrike Falcon has already improved significantly with its AI capability, Charlotte, and I am quite happy with what is being offered.

CrowdStrike Falcon's AI capabilities are remarkable, and I trust CrowdStrike to maintain governance, security, and data privacy with the tools they provide.

Regarding the AI capabilities, I have used Charlotte AI a couple of times, and I find it quite accurate, providing the right resiliency and detection during any investigation I perform.

Having multiple security capabilities on a single platform is excellent as it eliminates the need to navigate different tools to find anomalies or detect and analyze root causes, thereby saving time for analysts whenever security breaches or vulnerabilities are identified.

CrowdStrike Falcon helped our team detect a security incident where someone attempted a SQL injection on one of our secured Drupal-based application servers. CrowdStrike Falcon alerted our team, allowing us to block access and patch the vulnerability to avoid any future incidents.

CrowdStrike Falcon has significantly helped my security team reduce their efforts and time spent analyzing vulnerable resources or security mishaps and setting up enterprise policies across the organization.

My advice to others considering CrowdStrike Falcon is that it is a great product that reduces analyst time while providing greater security posture to meet industry standards. I gave this product a rating of nine out of ten.

My main use cases for CrowdStrike Falcon include endpoint defense, investigations, and triage.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by making it much more granular. It allows us to dive deep into the details of an investigation and gain a deep understanding of what is occurring.

I have seen benefits from having multiple security capabilities on a single platform. It makes the unity of all the detections and information being in one place far more beneficial than having to navigate between devices, assets, or tools. This significantly reduces dwell time.

The value I have seen from having endpoint identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is the same; having it all in one location truly benefits the time to remediation.

CrowdStrike Falcon has affected the workload and productivity of my security team by reducing it. We utilize CrowdStrike Falcon Complete as well, and having them serve as the front line for everything eliminates many false positives. When we receive an escalation from them, it is a clear directive stating 'Here is a problem you need to fix,' rather than uncertainty about whether something might be an issue.

CrowdStrike Falcon can be improved by addressing the side tabs and menu options, which represent the biggest area for enhancement.

I cannot identify any additional features that should be included in the next release unless they address that menu structure.

I have been using CrowdStrike Falcon for three months.

I would assess the stability and reliability of CrowdStrike Falcon as good. There appear to be occasional issues with their hosting infrastructure; US2 might experience downtime occasionally. Having greater focus on that from their side would be beneficial.

I have experienced the portal being unavailable to log into only occasionally, but beyond that, there has been no significant downtime, crashes, or performance issues.

We have not noticed any hardware issues or strain from the CrowdStrike Falcon sensor on endpoint performance and our ability to deploy security at scale. It provides the fine details necessary for thorough investigations.

I would evaluate customer service and technical support as good. Since we are still in rollout and working with CrowdStrike Falcon Launch, we have not yet needed to use the actual on-demand support, but it appears to be solid.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools.

As we are still in the rollout phase, it will replace Palo XDR, to some degree Splunk, and Palo XSOAR. Having everything on one platform with a single login and single pane of glass would be truly beneficial. Those three have been the primary tools being replaced.

I would describe my experience with deploying CrowdStrike Falcon as relatively streamlined. I believe we make it difficult ourselves, but for the most part, it has been quite seamless.

Getting an endpoint removed and a new endpoint installed with a single reboot has presented some challenges.

I have seen a return on investment with CrowdStrike Falcon. The amount of alert fatigue that we would have experienced with other tools has decreased significantly.

With Palo XDR, we would constantly receive alerts, granted they were alerts we set up. However, because it lacked the granularity to specify certain conditions while excluding others, we received far more alerts. Now, escalations are very limited, which is beneficial.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that the crowd aspect of CrowdStrike is valuable because we gain insight from attack vectors and methods we do not experience ourselves, allowing us to build alerts or develop awareness for them.

My use of CrowdStrike Falcon has expanded since my initial deployment. The initial deployment focused strictly on endpoint defense. We now have endpoint, SOAR, SIEM, and even some asset inventory capabilities, which is beneficial.

Currently, we are using AI within CrowdStrike Falcon to build many of the SOAR playbooks within their SOAR solution.

The impact AI has had on my security operations allows us to investigate matters more deeply and build very specific exclusions or alerting rules, which is beneficial.

The advice I would give to other organizations considering CrowdStrike Falcon is that while there is much to tackle and accomplish, it is well worth the effort. I would rate this product 9 out of 10.

CrowdStrike Falcon is my main tool for threat detection in managed services, primarily focused on identity.

My team and I use CrowdStrike Falcon day-to-day for threat detection in managed services, mainly identity. Last week, we were onboarding a new customer who had Defender in place, but we rolled out CrowdStrike Falcon to find more threats and determine where the threat had gone.

In that scenario, the attacker used AMSI bypass to essentially nullify Defender when we tested the sandbox. CrowdStrike Falcon detected it, and our automations isolated devices straight away as soon as we detected anything.

CrowdStrike Falcon fits into my workflow and is positioned well on the market for us. We have had an attacker get in through a VPN, and as soon as they started doing reconnaissance on the platform, we isolated it immediately.

We use AI within CrowdStrike Falcon platform in our orchestration. We have an AI SOC analyst that does the initial triage and then posts into teams with recommendations on what it has found.

Since my initial deployment of CrowdStrike Falcon, my use has expanded. Initially, we just had EDR, but now we have cloud security, identity, Falcon Guardian, and Falcon Shield, so we use quite a lot of the products now.

CrowdStrike Falcon has positively impacted my organization by bringing my mean time to respond down to seconds. We measure that reduction in response time using our SOAR platform. Before implementing CrowdStrike Falcon, our response times were probably in minutes, and now we have moved to seconds.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats, allowing us to isolate or revoke sessions via SOAR automations, meaning that the threat is isolated while my team conducts its work.

CrowdStrike Falcon allows me to maintain a lean security team while still having fast response capabilities and handling incidents when they come in. CrowdStrike Falcon has allowed me to consolidate or replace other security tools.

The standout features of CrowdStrike Falcon for me are the visibility and the control it gives us during an incident. These features help us see where the threat originated, and we integrate with other tools to get compromised users or isolate the device.

Regarding CrowdStrike Falcon's AI capabilities, I think its governance and security are great. I have no problems at all with the accuracy and reliability of the AI output in CrowdStrike Falcon, and AIDR is a phenomenal product.

Having multiple security capabilities on a single platform allows us to track threats across multiple platforms. The value from having endpoint identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform helps us identify the source of the attack, allowing us to rotate all those passwords and address the issues effectively.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is its simplicity and ease of use. When CrowdStrike acquires another company such as Adaptive Shield, the migration into CrowdStrike Falcon is seamless and very easy to do.

The main area of improvement for CrowdStrike Falcon is making the names of the products and the licensing a little less confusing, as it can be quite confusing to know what the product stack is.

I have been using CrowdStrike Falcon for four years.

CrowdStrike Falcon is stable.

The Falcon sensor does not have any impact on endpoint performance or my ability to deploy security at scale. CrowdStrike Falcon's scalability is fine.

The customer support is great. I would rate the customer support a 10 on a scale of 1 to 10.

I previously used Cisco Secure Endpoint, and it just was not good enough.

I have seen a return on investment, as our SOC customer base has doubled in about 18 months.

My experience with pricing, setup cost, and licensing has been positive because we are an MSP and on the MSSP program. The pricing was great, and although it took a while to get onto the program, now that we are, the pricing is very simple for us, which was one of the benefits of choosing CrowdStrike Falcon as an MSSP.

Before choosing CrowdStrike Falcon, I evaluated other options, specifically SentinelOne and Microsoft Defender.

I would rate CrowdStrike Falcon a 10 on a scale of 1 to 10. I give it a 10 because we have evaluated and worked with other EDRs that customers have, and CrowdStrike Falcon is the best by a mile.

CrowdStrike Falcon is deployed in my organization both on-premises to endpoints and in the public cloud, specifically AWS and Azure. I use both AWS and Azure equally with CrowdStrike Falcon.

My advice to others looking into using CrowdStrike Falcon is to make sure you learn and understand where everything is on the platform and what else it can do.

A typical scenario of how I use CrowdStrike Falcon day-to-day is as a standard Falcon Endpoint for standard end-user and end-system security. It serves as our in-between and standard gateway for all data that goes into the platform.

In terms of my main use case, there is not much different from a standard office use point compared to other companies I have previously worked with. In our specific case, as the gateway solution and as the rollout, we even got success stories from our end users about the performance level. Since sometimes we have legacy systems that need to be in use, system resources are tight, and CrowdStrike Falcon provides a lean platform solution for this.

My use of CrowdStrike Falcon has expanded since the initial deployment, as it grows in the same way that the company grows. Since it is our main and only security platform for everything—servers as well as endpoints—it is just there and our go-to default standard solution for everything regarding IT security.

Regarding the time from issue to solution, for example, we had a pentest of our previous provider, which was Sophos with their MDR solution. During an official pentest, it took over four hours for them to react to a black box penetration attempt. In our scenario with CrowdStrike Falcon, we pretended to have a stolen laptop with stolen credentials and it took CrowdStrike Falcon six minutes to respond to the initial email and ten minutes until the user account was locked out, so it is much faster.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats, as it has gone really in the direction of low impact and almost no day-to-day use for us. Since we are a Complete customer, it is something that the CrowdStrike Falcon Complete team deals with fully, and we do not really have to deal with it ourselves.

I can describe a security incident where CrowdStrike Falcon helped my team detect a threat. We have seen one or two cases of leaked credentials to an outside factor that have been fully remediated automatically within minutes. We only recognized it after the fact by reading the CrowdStrike Falcon automatic solve emails, so it has been so peaceful to use or in using the system that we do not even notice the cases anymore since it just gets handled in the backend.

CrowdStrike Falcon has lessened the workload or productivity of my security team by a major factor. Most of my team members are relegated to more normal administration duties now in our normal day-to-day operations business, so real security only gets handled by a small group in comparison to a previously larger impact.

CrowdStrike Falcon has allowed us to consolidate and replace other security tools. We previously were a customer of Sophos and their MDR next and next-gen security solution, which has been fully replaced by CrowdStrike Falcon and Falcon Endpoint platform, making our security operations a lot leaner, faster, and less admin impacted than previously because of the general hands-off approach that CrowdStrike Falcon manages.

The aspect of low impact that stands out the most for me is speed and resource usage, as our users were so happy with the switch to Falcon Endpoint that they actually wrote in thank you emails to the IT operations team.

Regarding CrowdStrike Falcon's AI capabilities, I am very impressed with its accuracy and reliability of output based on what I have seen so far. I have previously recommended it to other contacts, and due to our company's partner, we have discussions with other prospective CrowdStrike Falcon customers and have recommended CrowdStrike Falcon to them in that regard.

The benefits we have seen from having multiple security capabilities on a single platform is the biggest impact or benefit being the low resource use and low resource impact.

The value from having endpoint, identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is that it makes you a one-stop shop for everything that is relevant to your security setup, with one interface to deal with everything. That is one of the reasons we are currently not quite happy with the Guardian scenario. However, for the current CrowdStrike Falcon platform as it stands, I would love to leave that in place for a long time.

CrowdStrike Falcon's scalability really has not been a factor for us since our growth is slow but steady. There was no real need to grow in scale at push of a button to a larger scenario.

The reason I rate it an eight is that there are just little things that are not really relevant at this time or at this point, since it is more a personal feelings issue and not a technical issue. Overall, objectively measured on a technical side, I would decently give it a ten, but for me personally it is an eight, more as I said, a feelings thing.

My advice to others looking into using CrowdStrike Falcon is to listen to your sales engineers when deploying it. If you have the option of having a proof of concept running, use it, see where your particular issues are, take that and deploy it at that time, see that it is good for you, and then keep it deployed and just buy it. Your users will thank you.

My main use case for CrowdStrike Falcon is endpoint detection, including endpoint telemetry, network detection, and cloud security.

In my day-to-day activities, CrowdStrike Falcon helps me detect any endpoint-related threats, such as suspicious execution, network data exfiltration, and lateral movements. As a SOC analyst, I investigate these detection types and alerts to remediate, triage, and investigate them.

Since we moved to CrowdStrike Falcon, we have been able to make a significant reduction in false positives and tune our true positive detection, and our response time has increased substantially. This has been a really great impact on our work and we have been able to make good progress. From an analyst's perspective, it has had a positive impact on our team.

The response time has been excellent. Previously, we used to have a high increased number of mean time to detect. However, since we moved to CrowdStrike Falcon, the mean time to detect has been significantly reduced, which is a great improvement. Our response time has increased due to the AI workflow included and the investigation process has become much easier with simpler querying. Overall, the impact is really great.

Since we moved to CrowdStrike Falcon, the response time and the way we investigate and triage has significantly changed for the better. I believe this is one of the best ways a team can improve their detection and response time when it comes to threat detection.

For example, consider someone trying to execute a PowerShell script connecting to a malicious website. Even though it is an internal user, they are trying to execute a command that is from the internet or from a Reddit or GitHub portal, which may not always be legitimate. CrowdStrike Falcon detects these executions, reads the command line, identifies the domain and IOCs, and has made a significant impact by preventing the execution before something harmful happens.

Having one visibility into SIEM, cloud, and endpoint really makes it more convenient. We do not want to be navigating into multiple platforms. Having everything in one place has been excellent. An expert at all of this could really improve significant time and response time, so I would say this has been great for our work.

It has significantly reduced the workload due to the visibility we have. I would say that CrowdStrike Falcon is a great tool for us to save time and be productive.

Improving our response capabilities and being good at detection has had a big impact on the company. Trying to save us from attacks and being one step ahead of all these threat actors is a great impact on our organization.

We have been using different applications for different purposes, but CrowdStrike Falcon has helped us to be so accurate at endpoint detection and cloud security, which is really great.

The best features CrowdStrike Falcon offers, in my opinion, are the visibility into everything that is happening. The process tree is really great and provides complete visibility into the process executions. The query language is pretty useful and efficient because it resembles SQL and is convenient for beginners. The querying is not challenging and I appreciate how user-friendly it is, as it gives complete visibility of a detection and the next actions that should be taken.

Although I am not an expert at SQL, the query language that CrowdStrike Falcon uses, I use AI to make my own queries with whatever knowledge I have. I use the event names and the detection logic use cases that I need for my investigation and make sure that it suits my needs before applying it into my investigations. This approach is actually helping me triage and investigate faster than before.

Something that stands out is the clear picture of an incident or an alert, which includes host details, asset details, user information, command lines, and process trees. This is something I think lacks in other endpoint applications, but CrowdStrike Falcon stands out on all of these aspects.

We are still in the era of improving AI, so I would say the AI capabilities are good, though I would not say they are 100% accurate. The summaries and recommended next steps actually help a lot for an analyst. It is like AI agent workflows plus SOC, and it is really great.

The scale at which CrowdStrike Falcon can ingest data and integrate with other systems is highly commendable. However, I would also highlight visibility and convenience over other applications, and it is more efficient.

CrowdStrike Falcon could be made a little more user-friendly. Someone who is trying to explore CrowdStrike Falcon for the first time might feel overwhelmed because of the multiple features. Although it is a good thing, it is not really convenient or efficient for a beginner. Otherwise, I think it has everything that it needs, including AI, agentic workflows, Guardian in place, and automatic actions.

We have been using CrowdStrike Falcon for almost eight months now and we just started transitioning from Carbon Black to CrowdStrike Falcon.

I have experienced stability issues.

The scalability is pretty good. Considering its unique features, it is pretty good.

The customer service has been excellent. We have a dedicated customer relationship with the CrowdStrike team, which is one of the excellent features that we see. I would rate the customer service 10 out of 10.

We were previously using Carbon Black, and we switched from Carbon Black to CrowdStrike Falcon due to its heavy noise and lack of AI workflows. We moved to CrowdStrike Falcon to address these issues.

There is absolutely a return on investment. There is time saving and efficiency improvement as a team, and as a SOC team, it is a great return on investment.

I would rate CrowdStrike Falcon 10 out of 10 because of its convenience and the complete visibility into endpoints.

The visibility and the convenience of getting used to the endpoint logs stand out to me. The navigation is much easier and the UI is user-friendly. It may be a little complicated for a beginner, but as an analyst, I have been getting used to it. This is why it stands out to me compared to other endpoint platforms.

I would definitely recommend that organizations go ahead with CrowdStrike Falcon. It is an excellent platform to explore.

My main use cases for CrowdStrike Falcon are endpoint security, using one sensor to deploy various different types of tools. The end goal is less agent on an endpoint where I could accomplish so much with just one sensor installed, and that truly impresses me.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats. Our response ratio, which was our end goal, has decreased significantly from what it used to be.

In security incidents where multiple malware activities have occurred, CrowdStrike Falcon has prevented them, which could have resulted in much greater costs.

The benefits I have seen from having multiple security capabilities on a single platform are that it made my team's life easier by deploying one less agent on an end host, where we have seen significant performance improvement.

The value I have seen from having endpoint, identity, cloud, and other security telemetry in CrowdStrike Falcon is that a single pane of glass has really helped us. The analysts are not fatigued by moving between different platforms. It's a single pane of glass that has helped us focus on our goal.

CrowdStrike Falcon could be improved in several areas. For the next release, I have seen exposure management and some new modules coming up. If I had to compare with other products, it's not there yet. I was wondering if modules could be enhanced, especially on SSPM and exposure management.

I have been using CrowdStrike Falcon for five years.

I assess the stability and reliability of CrowdStrike Falcon as approximately 99% uptime, so it's very good.

I have experienced only the July 19th incident as downtime, crashes, or performance issues.

The impact that CrowdStrike Falcon sensor has had on endpoint performance and my ability to deploy security at scale is significant. The performance improvements have been substantial. Deploying one less agent has been easier to maintain.

I evaluate customer service and technical support as excellent. I have seen better improvement than other vendors I have worked with.

CrowdStrike Falcon has allowed me to consolidate and replace other security tools.

We decommissioned Trellix by replacing it with EDR. We also replaced Qualys by implementing exposure management.

I would describe my experience with deploying CrowdStrike Falcon as very easy and straightforward. I had a very good experience compared to other EDRs I have worked with.

What worked well is that it was easier to reach our metrics. The challenges I faced were keeping up with the sensors and sensor version updates. The deployment pace was very fast, making it difficult to keep up with.

I have seen return on investment with CrowdStrike Falcon. Addressing downtimes based on malware activities, I think we have seen great improvement.

My experience with pricing, setup cost, and licensing is that the license is expensive since it is based on per host. It is more expensive than other solutions I have dealt with.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is mainly the performance, where we have seen a vast improvement.

The impact it has had on my security operations is that it has made it easier for me to accomplish a lot of our use cases and finish all those tasks.

My use of CrowdStrike Falcon has expanded since my initial deployment as we have purchased many additional modules. We started with EDR and expanded with different modules like CrowdStrike Falcon for IT and exposure management.

I am currently using AI within CrowdStrike Falcon to write queries.

The advice I would give to other organizations considering CrowdStrike Falcon is to move forward with it. I provide this review with an overall rating of 9 out of 10.

Our main use cases for CrowdStrike Falcon are that we are a Falcon Complete customer and we are likely expanding in the next year. We are going to go with Next Gen SIM. I am here because I already took my class. We are going to integrate Identity, and we might be doing AIDR as well.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats. I think this has a lot to do with some of the automation and the ability to see things before they happen, and it results in very few false positives. Normally, if we get alerted, there is something we need to address or look into immediately.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools. We are in the process of that right now by proof of concepting out Next Gen SIM, Identity, and AIDR. We are going to be probably discontinuing our current SIM to go to Next Gen and some of our identity monitoring tools will likely be sunsetted when we get Identity spun up.

The value I have seen from having endpoint, identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is fantastic. You are seeing potential attack points from many different angles while monitoring user activities and behaviors. It is absolutely a great product and a great platform.

CrowdStrike Falcon can be improved by continuing to keep everything on the cutting edge. The product works and is stable, as long as we do not have a rehash of what happened in the summer of 2024 because I dealt with that frontline. The product works well, is not a resource hog, and is the best in the class. Just keep progressing and adding new features as the IT field changes for the next ten to twenty years.

From my perspective on identity access management, there are additional features I would like to see included in the next release of CrowdStrike Falcon. I am just getting started with the Identity portion of CrowdStrike Falcon, so if you ask me this next year, I would probably give you a great answer, but right now I cannot.

I have been using CrowdStrike Falcon for a good five years, which is when we first started.

I assess the stability and reliability of CrowdStrike Falcon as high. There was only one issue, and we all know when that was, and we hope it does not happen again.

I have not experienced any downtime crashes or performance issues with CrowdStrike Falcon. The only downtime we have ever experienced was in June of 2024.

The impact of CrowdStrike Falcon sensor on endpoint performance and my ability to deploy security at scale is minimal. Loading the sensor is really a piece of cake. We have it scripted into new machine builds and it is very easy to manage and easy to get pushed out to the base.

I would evaluate customer service and technical support for CrowdStrike Falcon as very good. Our product teams, sales engineers, and support are always good. Support is very good across the board. Everybody is friendly, knowledgeable, and wants to help, and you can feel that they want to keep your business. Many companies in this era seem like they do not care. CrowdStrike does care.

My experience with deploying CrowdStrike Falcon is positive. Getting the agent out on the workstations and servers is easy. Once you get your tenant set up and you have your CIDs and everything, building it out becomes straightforward. We have now built out three or four different tenants and it gets easier every time.

What works well with CrowdStrike Falcon deployment is that we really did not face major challenges. The biggest challenge is always finding all of the machines in your environment because asset inventories are often not accurate, new machines are coming in, and old machines are going out. So that is really the biggest challenge and that really is not a CrowdStrike Falcon issue; that is just a corporate IT issue.

I have seen return on investment with CrowdStrike Falcon. I am sure this is the case because we are in the medical industry and keeping PHI and everything safe. We have to have cyber liability insurance, and knowing that we have CrowdStrike Falcon definitely helps when it comes to the bottom line and helping our insurance rates stay at a fair level.

My experience with pricing, setup costs, and licensing for CrowdStrike Falcon is that it is pretty fair. We are always able to get to a good price and the proper amount of licensing. It is very fair.

My advice to other organizations considering CrowdStrike Falcon is to definitely work with one of the good reselling partners. We use GuidePoint, and they are fantastic. I can also say that you should really get to know your CrowdStrike Falcon team once they are assigned to your company because they are definitely assets to leverage. I would rate this product as a nine overall.

My main use case for CrowdStrike Falcon is protecting high value assets and servers. For example, we typically have a lot of people doing click-through for downloads of remote management and ScreenConnect type software, so CrowdStrike Falcon is really good at identifying those user interactions, the clicks, and the hacker trying to come in and log in using that ScreenConnect software; we do see that a lot.

The best features CrowdStrike Falcon offers include the time to discovery, the cost and effectiveness of the software, and the ability to isolate machines and allow for remediation.

The ability to isolate machines has positively impacted my operations because it can take the threats offline quickly and allow us the time that we need to be able to interact with them and get them back online properly.

CrowdStrike Falcon has positively impacted my organization by allowing our admins and our Security Operations Center folks to be able to focus on other things, giving them enough time to not just be dealing with these incidents on a regular basis, but allowing us to free that time and use it in other places more effectively.

I am pretty happy with CrowdStrike Falcon where it is. I do like some of the new features being added to it with some of the AI pieces and the SIM, and we have not really broached those pieces yet, but I think we are really interested in at some point expanding our portfolio.

Regarding CrowdStrike Falcon's AI capabilities, I think it still needs a little bit of time to learn and improve itself in the environment, but overall it has been pretty accurate.

I have been using CrowdStrike Falcon for approximately four years.

CrowdStrike Falcon is very stable.

CrowdStrike Falcon's scalability has been good because we have not had any issues. We are using automated deployment methods such as Jamf for Macs and adding AD groups, so members just get joined to an AD group, and the agent is deploying effectively, allowing us to do dozens of machines at a time without any issue.

Customer support has been good. We do have a third-party MSP that is assisting us with some of those issues, so between that and the MSP, we are actually doing pretty good.

We were primarily using Microsoft Defender before choosing CrowdStrike Falcon. It just was not very effective, especially on things like Linux and Mac.

My experience with pricing, setup cost, and licensing has been pretty seamless. We are purchasing from multiple sources for various reasons, but working with CrowdStrike Falcon directly through a third-party VAR has actually been working out really well without any issues or hiccups.

CrowdStrike Falcon has allowed us to consolidate or replace other security tools, and we have actually replaced traditional antivirus in most of our deployment cases, not requiring to have paid extra money for the high-level Defender or a third-party software for our Macs. We are able to almost ubiquitously deploy CrowdStrike Falcon to all of our Linux, Macs, and Windows boxes easily.

I think we have seen a return on investment from CrowdStrike Falcon, as generally the amount of time saved not having to threat hunt and look for these issues as they pop up saves us if we can catch it early enough from having to disable multiple users, which may be part of a later phishing event or disruption event in our environment.

Before choosing CrowdStrike Falcon, we really did not look around a lot, as we actually got such a good deal, and based on the reputation and other folks purchasing it in higher ed, we just really went back through it. We did not do a bake-off or anything.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by allowing us to focus on other things and not really worry about this. We only need to concentrate on these threats and indicators once they happen.

Having multiple security capabilities on a single platform has allowed us to work more effectively because I think the more things that you can consolidate into a single pane of glass allows the users to work more effectively without having to keep switching back and forth.

A security incident where CrowdStrike Falcon helped my team detect or stop a threat involved users getting phishing links that told them to download software, which actually downloads ScreenConnect remote access software to their workstations. CrowdStrike Falcon has been detecting these indicators, and we have been able to tell it that since it is not an authorized application within our university, we can have it stop, block, and isolate those instances and notify the SOC, which works pretty well because we are able to then isolate the user, educate the user through the help desk, and have the box re-imaged to make sure it is clean.

CrowdStrike Falcon has affected the workload or productivity of my security team by allowing us to concentrate on other things because this is very self-driven and keeps things moving.

The CrowdStrike Falcon sensor has had a positive impact on endpoint performance and my ability to deploy security at scale because we actually have not had any negative impacts at all. It has all been positive, with the exception of some maybe glitches on the Linux boxes, but there really have not been any performance or issues otherwise.

We are honestly probably not using AI within CrowdStrike Falcon as effectively as we could, but we do use it to help search for related incidents and similarities within the console to see what is there.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is the ease of use and the lightweight client, which seem to be the biggest advantages.

The best advice I could give to others looking into using CrowdStrike Falcon is to listen, understand what your options are, make sure you have a good idea of what your deployment is going to look like and plan for that, and then everything should flow freely. Do not buy it haphazardly. I would rate this review a 10 out of 10.

Hybrid Cloud

Amazon Web Services (AWS)

CrowdStrike Falcon is primarily used because we are a system integrator that sells a solution to our customers, so most of it is endpoint security.

We are not the one operating CrowdStrike Falcon, but when we do an implementation, once we install the agent and complete the implementation, we see what it has detected from day one of the implementation until the turnover to the operations team. The Falcon Complete dashboard is intuitive, especially OverWatch, which highlights every risk that we need to manage, and also the detection field and incident field where we can see the entire timeline and all the things that happened. There is also a network map where you can see, for example, if there is one detection on a workstation, which other users or other devices it communicated with.

We are primarily utilizing Charlotte AI within CrowdStrike Falcon platform. We use it extensively on CrowdStrike Falcon EDR, plus also NG-SIEM, because with Charlotte, it can help us create queries without doing it manually.

One of the key advantages of CrowdStrike Falcon is its lightweight sensor, so it is easy to deploy compared to other security solutions.

CrowdStrike Falcon provides results because, until now, no customer of ours has gotten ransomware or been infected.

The most common solutions that I compare CrowdStrike Falcon to in my country are Trend Micro, Sophos, and Palo Alto and SentinelOne. The really key advantage of CrowdStrike Falcon is its lightweight sensor. Some of the companies that I mentioned earlier had a hard time deploying because they have 400 to 500 MB of sensor, which if you deploy it on 3,000 or 4,000 endpoints, it will really slow down their network. Unlike with CrowdStrike Falcon, we can deploy, for example, 2,000 endpoints a day.

There is no impact on endpoint performance. On some of the other products that I compared CrowdStrike Falcon with, some of them cause high utilization. We have not experienced that with CrowdStrike Falcon.

For me as the one who implements CrowdStrike Falcon, it has a real impact because it is easy to deploy. Even though the customer does not have software deployment tools, you can deploy CrowdStrike Falcon by having a simple GPO, a Group Policy Object, load it there, and then you can install it easily.

For endpoint performance, it is great because it is very lightweight. It is not the traditional antivirus from before where when you do a scan and install it, the CPU and memory will spike up and the user cannot do anything about it. CrowdStrike Falcon is very lightweight. With that, users do not need to balance between usability and security because with CrowdStrike Falcon, you can have both.

CrowdStrike Falcon can improve their supportability of legacy devices. This is where CrowdStrike Falcon has been edged out by other cybersecurity vendors because some of them support legacy operating systems, unlike CrowdStrike Falcon that primarily uses one level higher of operating system than others.

In the cybersecurity field, I have been working for more than ten years. We have been working with CrowdStrike Falcon since 2022 to now.

In terms of reliability, ever since I used CrowdStrike Falcon platform, I think it is still okay because the GUI, the dashboard, and the console are easy to use because all of their solutions are in one platform, so you will not get lost. They have OverWatch and a detection incident where all the detection is already consolidated there. Once you click it, you are going to see all the details.

The most common solutions that I compare CrowdStrike Falcon to in my country are Trend Micro, Sophos, and Palo Alto and SentinelOne. The really key advantage of CrowdStrike Falcon is its lightweight sensor. Some of those companies that I mentioned had a hard time deploying because they have 400 to 500 MB of sensor, which if you deploy it on 3,000 or 4,000 endpoints, it will really slow down their network. Unlike with CrowdStrike Falcon, we can deploy, for example, 2,000 endpoints a day.

When we had an issue, for example, on an agent installation because of one legacy device or when we were installing it with another endpoint application, we had CrowdStrike Falcon support come in with us. They are very helpful because they were able to resolve our issue.

We had one experience with one of our customers where at first, they were not a CrowdStrike Falcon user. They had a ransomware with a different solution, not CrowdStrike Falcon. After that, we asked them to try CrowdStrike Falcon and install it, then we could see other detections that their previous vendor or solution did not see. After we were able to help them clean their environment, they transitioned to CrowdStrike Falcon with Falcon Complete, with the managed detection and response of CrowdStrike Falcon.

The most common solution right now in my country is NG-SIEM. Before, they used a different SIEM, like Splunk, Rapid7, Exabeam, or QRadar, but now that they see the value of CrowdStrike Falcon XDR and they want it to work together, most of them are trying to move to NG-SIEM so that you can have your XDR and your SIEM in one platform, plus the telemetry that CrowdStrike Falcon endpoint provides. This will really help them secure their environment.

I think it is very great that we have a solution as CrowdStrike Falcon which has many different security functionalities because threats are evolving. As the defender, we need to evolve as well. We are fortunate to have CrowdStrike Falcon that is continuing to evolve, even now in the AI era because threats are more complex than before. Before you just needed to worry about the zero-day and the signature. Now it is different with AI. We are fortunate we have CrowdStrike Falcon with us.

I am confident that CrowdStrike Falcon is up to par to protect you and your customers from AI threats.

Most of our customers in my country use CrowdStrike Falcon, and ever since then, they do not have serious incidents, such as a ransomware that has taken effect on all their critical infrastructures, including servers.

One value or benefit that customers can have from CrowdStrike Falcon is not having their solutions in silos. If it works in silos, it is going to be hard to keep track of threats, especially now that AI is moving at AI speed. If we are working in silos or have different solutions, it is going to be hard to catch up. Did they get anything on the identity solution? Did they get anything on the cloud solution? With CrowdStrike Falcon, it is all in a single sensor and a single platform. Customers are going to have a single pane of glass that they can look at.

The impact of AI features such as Charlotte AI on our security operations makes our lives easier, not only for us but also for our customers. Before, when they were going to do a query, they needed to drill down multiple times before they got to the one event that they wanted to see. Now, if you ask Charlotte, it is one click of a button and enter, and Charlotte will give you everything. It is much faster than drilling down to all the events and all the reports.

Customers usually get Falcon EDR first, Falcon Pro. After that, they expand to Falcon Complete, meaning adding the MDR services, and now they are trying to go to NG-SIEM plus the identity. Now that they have heard about Falcon Guardian, they might look into that as well.

If I were to give advice for someone who is evaluating or considering CrowdStrike Falcon platform, I think they need to try it so they can feel the experience and the protection and the security that CrowdStrike Falcon provides. I rate this solution a ten out of ten.