Try our new research platform with insights from 80,000+ expert users

CrowdStrike Falcon Sandbox vs Deep Instinct Prevention Platform comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 3, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

CrowdStrike Falcon Sandbox
Ranking in Anti-Malware Tools
15th
Average Rating
8.2
Reviews Sentiment
7.5
Number of Reviews
6
Ranking in other categories
No ranking in other categories
Deep Instinct Prevention Pl...
Ranking in Anti-Malware Tools
16th
Average Rating
8.6
Reviews Sentiment
7.4
Number of Reviews
18
Ranking in other categories
Endpoint Protection Platform (EPP) (41st)
 

Mindshare comparison

As of May 2025, in the Anti-Malware Tools category, the mindshare of CrowdStrike Falcon Sandbox is 1.3%, up from 0.6% compared to the previous year. The mindshare of Deep Instinct Prevention Platform is 1.4%, down from 2.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Anti-Malware Tools
 

Featured Reviews

Abhimanyu Raj - PeerSpot reviewer
Alerts and notifications have enhanced malware detection capabilities
These features are probably the most essential for me. I find the notifications and alerts received from CrowdStrike server to be invaluable. They analyze Falcon and provide output regarding any kind of infected malware devices or files. We have seen returns on our investment in more than thousands of instances, which is the most important part for us.
Elena Yau - PeerSpot reviewer
Prevention, in advance, saves us remediation time
We have a PHI (protected health information) committee, and some of the things that we review on a weekly basis are incidents. For example, if there was malware or adware or some kind of phishing attempt, or even ransomware, we would have to investigate and see if there was any PHI impact. We've seen small things because some kind of adware made its way through the browser from some malicious link, and it's really hard to prevent those. We're putting more levels of filtering around that. There are some product development ideas that we have been working on alongside the DI team, and they've been super helpful. There are definitely a lot more little areas of improvement for the interface. Also, we have talked with the DI team about adding the forensic piece, which is what we do a lot. That would be added value and they've just recently provided more individuals to think about the roadmap. That's part of their strategy and one of the good features that they want to bring on. Hopefully, they can bring that to fruition and that will ease our workflow a little bit more. The additional predictive and prevention capabilities in the 3.0 version, that don't require special rules and configuration, help our organization. The only caveat is that when things get done automatically, I would appreciate more logging of what's happening in the background, if it is doing some kind of intervention. If we need to do some forensics, we should be able to backtrack from the log that gets uploaded to our cloud instance and see, forensically, what the root cause was. We should be able to see what instigated that trigger by DI and what exactly was done. That's a missing piece. It does a good job of preventing, but then we don't know what were the symptoms of the prevention. Let's say that there was like a PowerShell block. We'll see an indicator on the dashboard and we'll look at the logs and investigate. Sometimes we find that the logs that are captured locally on the endpoint itself are not very thorough. We were coached through our training with DI that, when troubleshooting, the DI team would always ask for the logs from the endpoint. We know what we need to do to look at something. But the logging for DI doesn't capture everything. There are some things that are missing. When it comes to root-cause analysis, or kill-chain analysis, and figuring out exactly what happened, it's very hard to do that right now on the product. I have used Carbon Black before and they're pretty good with the forensic analysis. That does save some efforts of my one engineer and myself when we have to go through the PHI committee. Right now, with Di, that feels like a blind spot. Another area for development is making the license clean-up a little bit easier. We always have to manually uninstall agents. If there were some way to remove the licensing and do better license management on the platform, that would help my team as well.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I don't have any suggestions, because the solution is company-maintained and I believe the company is adopting every feature based on their needs and requirements."
"CrowdStrike is an excellent tool for managing all endpoint-related security tasks."
"It provides a safe way to analyze and review documents that may have sensitive information without uploading them to a public platform. Additionally, provides an easy way to spin up a VM without requiring additional resources and patching of personal or team-managed virtualization."
"We have seen returns on our investment in more than thousands of instances, which is the most important part for us."
"I find the notifications and alerts received from CrowdStrike server to be invaluable."
"CrowdStrike is an excellent tool for managing all endpoint-related security tasks."
"The tool helps to obtain information about potential company breaches. The malware analysis capability is very effective. We check files from various sources, such as emails, USBs, and cloud drives."
"The most valuable features include malware detection, threat rating related to files, studying the metadata of the files, and providing threat feeds to the endpoint."
"The product offers integration capabilities and is also easy to use."
"It has the lowest false-positive ratio that I have come across. I have only had one which was a legitimate file that I had to whitelist. It was for one of the applications I was trying to install and integrate. But the false positive ratio is very low."
"This solution is good at catching viruses and it's very effective and lightweight, which are all things that you want in an antivirus product."
"When we were looking at Carbon Black and Sophos, the prevention pieces weren't as strong when compared to DI, which is why we decided to go with DI... I would rather have a product that does the prevention up front and saves me the effort of having to wipe someone's workstation."
"The most valuable feature is its ability to detect and eradicate ransomware using non-signature-based methods."
"Good detections for PowerShell. and good user interface."
"I like the dashboard. It looks very simple."
"The most valuable features are the static/dynamic analyses. Deep Instinct's predictive model has very high accuracy and provides threat information for unknown malware, such as malware classification, static analysis information, and sandbox information."
 

Cons

"The product needs integration with SOAR products to add more integration points, which is important for various clients."
"One of the valuable features of the solution is to impressively detect threats without any impact on the end point performance. The solution ensures that the end users have a seamless experience."
"While CrowdStrike is a powerful tool, the user interface is cluttered with many features, making it challenging to navigate."
"The detailed report is very valuable, but not always accurate. This is a great resource to share amongst team members and stakeholders after analysis."
"The technical support is medium - they could improve, as communication is sometimes slow or late. There are missing detections that other tools catch. For improvements, we need easier ways to view full incident information and better presentation of data. Adding risk indicators for incidents would help decide on immediate actions. The platform should provide more information about incident risks to help less knowledgeable staff make decisions."
"While CrowdStrike is a powerful tool, the user interface is cluttered with many features, making it challenging to navigate."
"As of now, there is nothing specific in need of improvement."
"It would be nice if there were options where, if I have to do SIEM integration, I could do so from the UI: Just pick and choose what SIEM solutions the customers use and have options to have out-of-the-box connection facility."
"There's an issue in the installation process where you can't install it unless you disable the built-in Windows Bitdefender antivirus. So, you have to manually disable Microsoft Bitdefender in order to install Deep Instinct. So, that makes it impossible to do a network rollout unless you manually visit each computer, which is ridiculous."
"If they can bring some additional, complementary solutions, like network scanning and the like, that will help. If they had some sort of a firewall which could help detect DDoS attacks and other things, it would be an improvement"
"The Deep Instinct client stops working when you have two servers and you add high availability or Windows Failover Cluster mode. It doesn't work in a clustered mode. I haven't yet had time to go back and talk with their support and get it fixed. It would be good if they can make the installation independent of an actual user. Currently, its installation is dependent on the actual user being logged in. For example, a computer has to be logged in for the installation to happen. If it is not logged in, then on the cloud platform, it is going to show that the client is offline. On the management side of the cloud platform, we would like to have the administrators segregated by logical entities. We have told them that on their cloud management platform, we would like to be able to segregate clients into different logical entities or organizations so that the administrators are able to manage only those entities that are within their designated organization."
"The interface on the endpoint could be a little more descriptive and more valuable. It doesn't always tell you the data you need to see. Improvement there would be very helpful."
"I would like to see improvement in the user interface so that the user has more control. For example, it would be good if a user could change their grouping if they want to be part of another group. Or if I want to right-click and scan a specific file that I just imported, that would be helpful. Sometimes you just want to do an extra scan to make sure you're safe."
"Reporting on incidents needs improvement."
"I would like a little more training for the admins."
 

Pricing and Cost Advice

"Price-wise, the tool is a bit above mid-range, maybe 7 out of 10, where 10 is the most expensive."
"CrowdStrike Falcon Sandbox is not cheap; however, whether it should be more affordable is a decision best left to the company."
"One thing about their licensing program that I like is that just one covers the server as well as on the endpoint as well as mobile devices. There is no complexity in calculating how many SKUs I need for mobile, for laptop, for desktop, and for servers. It's very simple and that makes it much easier to budget."
"There is a need for customers of the product to pay towards the licensing costs of the tool."
"We are a nonprofit. The MSP had provides pretty decent nonprofit rates for us. This was one of the key factors that made us choose Deep Instinct over its competitors who were significantly more expensive."
"In comparison to the other products out there, it's exceptionally competitively priced. When you consider the lower administrative overhead that it facilitates, it's an absolute value."
"If I include the false positive rate and the detection rate in the comparison, Deep Instinct is worth its price."
"There are no additional costs on the price, and our company has a support contract, which bundles in those services anyway."
"The pricing is a little bit expensive but we are satisfied with DI's performance."
"Their pricing is very competitive. It is good, fair, and a lot cheaper than what we were doing with Cylance."
report
Use our free recommendation engine to learn which Anti-Malware Tools solutions are best for your needs.
849,686 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
18%
Computer Software Company
13%
Comms Service Provider
12%
Educational Organization
9%
Computer Software Company
22%
Financial Services Firm
11%
Healthcare Company
7%
Manufacturing Company
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What do you like most about CrowdStrike Falcon Sandbox?
I don't have any suggestions, because the solution is company-maintained and I believe the company is adopting every feature based on their needs and requirements.
What is your experience regarding pricing and costs for CrowdStrike Falcon Sandbox?
Pricing is based on the number of endpoints and the features I need, operating on a usage-based cost structure.
What needs improvement with CrowdStrike Falcon Sandbox?
As of now, there is nothing specific in need of improvement.
What do you like most about Deep Instinct?
The product offers integration capabilities and is also easy to use.
What is your experience regarding pricing and costs for Deep Instinct?
There is a need for customers of the product to pay towards the licensing costs of the tool.
What needs improvement with Deep Instinct?
The solution's stability is good. If the tool was able to provide fine-tuning capabilities from the product's end depending on the environment of its user, then it would be a good improvement in th...
 

Overview

Find out what your peers are saying about CrowdStrike Falcon Sandbox vs. Deep Instinct Prevention Platform and other solutions. Updated: April 2025.
849,686 professionals have used our research since 2012.