CrowdStrike Falcon Reviews

Our primary use for CrowdStrike is as an EDR system. We are protecting more then 9.000 devices.

I like the detection rates of mobile threats.

The policies allow us to define the level of protection.

The dashboards are good, as well as user management.

The management reporting functionality needs to be improved.

We would like to see more features for vulnerability management included.

We have been using CrowdStrike Falcon since one year.

This is a stable product.

We haven't had any problems with scalability and it expands with the company's needs.

We have 20,000 users and about 20 of them are administrators.

We have been in touch with technical support for a few issues. They are quite good and the response is fast.

We were using Cylance prior to CrowdStrike, and these two products overlapped for a time. We also use an on-premises solution called F-Secure.

CrowdStrike has a much lower rate of false positives than Cylance and the dashboard makes it easier to use.

The initial setup is very simple. It took two months to deploy for 20,000 clients.

Our in-house team handled the implementation and deployment. No maintenance is required.

The pricing is good and there are no costs in addition to the standard licensing fees. It is similar to that of Cylance and our on-premises solution.

This is a product that I absolutely recommend.

I would rate this solution a nine out of ten.

We have various use cases. We are protecting servers and endpoints that are utilizing this product to focus on advanced, persistent threats, with the goal of reducing the overhead on the endpoint for early detection.

Right now, we have not put enforcement, and we're moving to the next level of detection.

Using this solution has reduced my need for imaging. We can mitigate the issue and address it immediately, for people both on and off of the network.

The most valuable feature is that we don't need to re-image machines as much as we had to.

They need to strengthen the forensic capabilities of this product, for e-discovery.

We started testing and deploying CrowdStrike Falcon about a year and a half ago, in the early part of 2019.

In terms of stability, it's a great tool.

At this time, we have between 5,000 and 6,000 endpoints.

We have been in touch with CrowdStrike technical support and they have been very supportive.

Prior to CrowdSrike, we used a signature-based solution from Symantec.

The initial setup was very straightforward and very easy. We've been bringing stuff into the SWOT platform and getting that data. It has been pretty good.

The implementation was done in-house. We had, in part, help from a strategic partner, EY.

CrowdStrike is what we did for the time and for the moment. It is number two when you look at the magic quadrant, and we have implemented that for the time being. When we selected it, that was right for us to get away from a Symantec signature-based environment for endpoint detection response.

We have moved over to CrowdStrike for now. When you look at the quadrant, the number one is Microsoft. With Defender built into the operating system, there is less overhead on the endpoint. We will eventually, most likely, migrate to that.

I have experience with Cylance, as well. They gave that the advanced persistent threat leader title, at one point in the market. I implemented that for one client and now, being in this CISO role, I went with CrowdStrike over Cyberreason and Cylance/Blackberry. The main reason for CrowdStrike is the Falcon technologies and what they do with their strategy.

We're moving to Office 365, and it will make sense for me to adopt Microsoft Defender because it's integrated into the platform. One of the differences between Defender versus CrowdStrike or any other of them is that they have to sit outside. Microsoft Defender can go deep down into the kernel, and that's a good thing for the endpoint. You can do a lot and detect a lot, which makes it far safer against advanced persistent threats.

Overall, this product has been pretty good and I recommend it.

I would rate this solution a nine out of ten.

Our primary use case is for endpoint protection.

When we have detections, I get insight into the top-down view of where it thinks it saw the problem and what triggered the detection. This allows us to have insight into what it thinks it is compared to what could have we have really been doing.

It seems to do a pretty good job of protecting the host. Gives good insights when it has a detection. It's pretty incredible.

I have been using CrowdStrike Falcon for six months.

So far, it's been 100% stable. Besides the very lightweight agent, it's all Cloud-based, so I haven't had any downtime.

Scalability is super easy. The deployment was easy. It's all price based. Money is the biggest challenge, not deploying it. It requires one system engineer. 

We have around 400 users. There are five of us who manage it, including the help desk, system engineers, and the director.

We haven't needed to contact support yet. 

We previously used Cylance. We switched because they weren't innovative. It was the same product that we bought three years ago. They were a great product and they had a job and they did it well. They just didn't ever innovate and they never improved. It's the same products we bought for the same three years. CrowdStrike was more innovative and it seemed to be a better long-term product. They seem to be improving constantly.

The initial setup was very easy. The deployment took about 60 days. We had a few methods of deployment. We did a push method. We had an agent tell all the machines that we were able to script it and push the apps to that.

We used the project management of CrowdStrike's themselves for the deployment. They were really good. 

We haven't had any outages based on malware or ransomware. I can't put numbers to it, but not having that kind of an outbreak definitely has an ROI attached to it.

We looked at a few other solutions but the main competitor was Carbon Black. 

I would rate it an eight out of ten. It does what it needs to do but there's always room for improvement. 

We use this solution for threat protection and endpoint security.

Recently, we added on CrowdStrike OverWatch and Insightsoftware for better reporting. OverWatch monitors East-West issues that CrowdStrike Protect doesn't see. New next-generation endpoint security doesn't scan your PC. It doesn't scan files nightly. People have to get past that, it's so old school. 

I have 50 end-users, one hundred endpoints, and workers of all types, both in-house and remote workers.

With the addition of Overwatch and the Insight tool, the reporting has gotten better and I've gained some quality insight that helps me remedy compliance issues and maintain security posture; however, in a year and a half, we haven't had an actual positive detection across a hundred endpoints. The reason for that is mostly due to our employee training and the way that our complete security stack is configured. I hope that the way that I've got it configured right now is the sole reason that we literally aren't letting things in.

If the solution sees some issues, it reports them. Even though they're false positives, in a different scenario, what it's reporting could be a threat. Usually, they're just executables that were downloaded and installed by me. That's to be fully expected and maybe they came from a vendor, but it wasn't signed. 

It's given me a level of confidence that my network is secure — the fact that it's not finding anything; however, I am not experiencing the issues that competitors are saying I should be experiencing. I literally have to test it manually to know it's working.

Falcon Protect looks at processes and issues in real-time.

CrowdStrike Falcon by itself does not supply in-depth reporting. 

Falcon Protect does what it does. It's endpoint security — nothing more, nothing less. 

What it does, It does well. However, if you need more information on what it found and how it got there (including board reporting and compliance reporting), that's not there. Some of the other solutions that are available give you that, right out of the box.

I have been using CrowdStrike Falcon for the past year and a half.

We haven't experienced any issues regarding the stability of CrowdStrike Falcon.

CrowdStrike Falcon is scalable. I've only got one hundred endpoints and I know companies that are hundreds of times bigger who use it.

Trying to get somebody on the phone might not always be the easiest thing, but they usually respond in a fairly timely manner. I haven't had any issues where I've needed them to immediately fix things.

On a scale from one to ten, I would give their customer support a rating of nine.

We had a Vipre solution, but it was an On-Prem solution. The server was aging out and the software was up for renewal. It wasn't working well with our remote workers; they're not literally connected to my network so updating them was always a pain-point without a cloud-based solution.

We were going to transition to "cloud" and Vipre just wasn't really up to the level of CrowdStrike at the time.

The deployment literally took about 15 minutes across the wide area network. Regarding configuration, we took a look at it with their tech support and Implementation team. There's literally maybe a dozen settings and we basically maxed them out.

The price of CrowdStrike Falcon is a little high, but it can be negotiated.

If you're thinking about implementing this solution, I would suggest getting Overwatch and Insight along with it. Also, don't be afraid to try and negotiate for a better price.

On a scale from one to ten, I would give this solution a rating of nine.

The reporting is part of the Overwatch and Insight combination. It's doing what we want it to do and it's not causing a lot of overhead. Like I said earlier, maybe we're an anomaly. We don't have a lot of issues on our network.

I like that it's cloud-based instead of on-premise.

I miss a feature for the USB control that they have as an add-on. I haven't gotten to the point where I want to pay for it, but the features that I miss are available.

The biggest issue with Falcon as a standalone product is it doesn't have very much reporting.
Out of the box, the only weakness is the level of reporting.

All the analytics and the telemetry are there, it's just a matter of getting to it. Other vendors offer some of that stuff right out of the box.

CrowdStrike Falcon has been very low maintenance. There are features on it that I haven't touched yet. I've got a SIEM that I haven't really had time to explore fully. I have a patch management system that does what it does. I have a firewall and IDS that do what they do, and I have an endpoint security system that does what it does.

MSPs keep asking how one person can keep up to the different solutions and alerting, if you don't have any problems, then it's pretty easy to keep up. Everything does what it does.  I don't experience any of the issues that apparently a lot of people have on their network. How can I tell you what to improve if it's doing what it's supposed to do? 

I have been using CrowdStrike Falcon since June of 2019. 

The stability is good; we haven't experienced any glitches or bugs.

We're a small company so the scalability is fine for us.

I don't have to talk to their technical support often. When I need help, I contact them by email.  Sometimes it takes a little while to get through to them, but otherwise, when they respond the issue is resolved. Not a real concern. 

We had Vipre business on-premise, the product was being discontinued and I wanted to move away from an on-premise solution.  At the time Vipre did not seem to be quite as mature as other options.  I understand that they have improved quite a bit since I looked at them last.

The initial setup was straightforward. Initial agent deployment took roughly 15 minutes.  SIEM integration required some coordination between vendors, but was relatively uneventful when support teams were involved.

Licensing cost is negotiable. There are no additional costs.

On a scale from one to ten, I would give this solution a rating of nine. I'm sure there's always something that can be improved.

We evaluated Vipre, Carbon Black, and a few others.

There are half a dozen players out there that are the best of the breed. Pick one.

When it came to CrowdStrike versus Carbon Black, configuration and setup were deciding, driving factors. CrowdStrike was much easier to configure, but overall, is it better or worse? I can't make that judgment call.

All I know is what I've been told by other vendors that are trying to get my business. They tell me about issues that I've never encountered with the products that I have. In summary, take what a vendor says about another vendor's product with a grain of salt.

We are using this solution for advanced threat protection, over and above any antivirus for approximately 1200 end-users, or endpoints. It is able to identify any anomalies and alert on that using the AI engine. That way, there's a small security team to make them more effective, to be able to get an alert, go in and look at what's going on. 

Since I have been here, I have been keying into when people fall for phishing attacks and they either get blocked going to a website or their credentials get compromised, and somebody logs in to their Office 365 account. We were able to forensically identify that in two of the cases. Most recently, since I've been here looking at the more active response, to be able to identify and act a little bit more quickly.

I was able to look through some rapid analysis when bad things happen. More so than having to get, especially in the distributed world of post-COVID, being able to have a central place to be able to see what's going on, on the landscape of endpoints at any given time.

The feature that I find to be the most valuable, is being able to look at the system analysis and being able to baseline what is installed on the system. What does it usually do, and is it doing anything differently?

The UI is great, and the performance was great. The way it gathers and presents the information was very good and it integrates well with things with a central log aggregator, such as Splunk. You can do more big data analytics that includes security. It seems to be fully featured in all of those areas.

I think there's an opportunity to enhance the AI or at least the traps to say, if something changes from this baseline, let us know and flag it. It's got a pretty good engine to do that on its own but it's one of the things that are important to us, so I'm just trying to increase the time-to-issue identification.

By comparison to buying into the Microsoft suite, it was definitely less costly. CrowdStrike can be costly.

I have had this solution for approximately three years.

It seems stable. The performance is good.

It's a scalable solution. They are running 1400 endpoints on it right now, and it seems to be fine.

There is only one person working at it right now and they are the security engineer/operator.

If you look at how they spend their day, a tool like that does a lot with a little and can make a one man band pretty effective or much more effective. It makes the response to an issue right when it happens way more possible with such small security. 

We haven't used technical support.

The initial setup was already completed before I started with this company.

When comparing to Microsoft, CrowdStrike Falcon is more expensive.

I'm going by the client and some of the things that are driving their decisions. 

It's typical when Microsoft throws things in and it seems really cheap, even though you're spending a million and a half dollars with them. You may as well increase the value of that million and a half.

My guess is that CrowdStrike is going to maintain parity or stay ahead of Microsoft.

As I came into this organization, they were moving away from CrowdStrike. 

They upgraded their license to E5 with the security bundle from Microsoft. The goal is to start to move things. 

They are paying twice for things right now, but that will be expiring. CrowdStrike comes up for renewal next year, and they want to be off of it by then.

I haven't gone into critiquing it. Since they've already made the decision and made the investment to go to defender ATP. I'm more concerned with, are we losing anything? Do we have parity when we go from one platform to another? And if any gaps emerge, what needs to be filled?

When we did go into it and walked through it with one of the security engineers, it was snappy, and it had a nice UI. 

I had never been inside the product. I think I got a demo years ago in my CSO role, but I had never delved into a practical use case. The practical use case looked pretty cool.

For anyone who is interested in implementing this solution, I would say don't look for the cost compared to smaller applications. Look at what you're trying to do, and what you're trying to accomplish. The typical first cardinal sin of IT is buying a product and then figuring out how to use it as opposed to having a set of requirements, placing a value on that set of requirements, and then pursuing a solution that covers them the best. 

I think they probably said we've got a gap here because something bad happened to my CrowdStrike. It's an industry leader. Three years after the issue that they were treating was over, and the pain was gone, suddenly, it seems really expensive. That is an IT 101 mistake that I've found in organizations, where it's a means to an end and then it turns this to just an eyesore on the balance sheet.

I would rate this solution an eight out of ten.

The primary use case is digital security investigations using the dashboard.

Every week, a manager would look at a detailed report to see what kind of CrowdStrike incidents we had.

The most valuable feature is the indicator of compromise, which shows you what file was either quarantined or removed. It shows you the malicious files in question, as well as the exact time, the machine, the endpoint, and the host IP address. Everything you need to know is right there in a single dashboard.

Any kind of integration that you want to do, such as using the API to connect to a SIEM, is complex and it will be expensive to do. It is quite a pricey product.

I used CrowdStrike Falcon in my last two cybersecurity jobs, over a period of at least two years.

The product is stable as a rock. I have never seen any crashes. When it came to patching updates, we were always notified. It is not Windows-based, but rather Linux or Unix-based. It was more stable than any Windows product.

We had a small shop, so we never had any reason to scale.

The technical support is pretty good. They're trained in their product and they have a system in place where if the first line of support does not resolve the issue, they are emailing us directly back and forth, and they'll hand over the problem from one shift to the next.

It is not very difficult to get in touch with the support team, although it does require clearance from whoever handles the money aspect. You have to be really careful because they will charge you fees for any kind of solution that they provide.

I have used them twice, once for each company that I was working for. The first time, we used the CrowdStrike service to do the investigation so that we could focus our time on other products. They have teams that will act like a managed service provider to take care of incidents. We handled major incidents in-house but we let them handle the minor ones.

With the second company, we had to do the investigations as the incidents came in, so it was two totally separate vantage points. Both worked extremely well in both manners and forms.

CrowdStrike was already in place before I arrived, at both places where I have used it.

We were also using Carbon Black, as well as other tools, but they were not being used to the same degree. I think that we were using Carbon Black for white-listing applications.

I also spent a lot of time using Nessus, which is a vulnerability scanner. I would look at scans to see what kind of vulnerabilities were present, and patch management updates with other teams.

I was not there for the initial setup, but what I did learn was that the implementation team came in and worked with our engineering team. They set it up and then our team verified that all of the endpoints where there and that we had the visibility we needed for all of the subnets in all of the locations.

When I spoke with my teammate, I was told that it was pretty much straightforward and out of the box. The fact that it is a cloud-based deployment made it easier, too.

Our licensing fees were between $50,000 and $60,000 per year, which was pretty expensive for a small business. It is not a one-time payment. Any upgrades that you want to do, you're going to have to pay multiple times.

My advice for anybody who is implementing CrowdStrike Falcon is to get in touch with the vendor and then follow best practices. They have a lot of documentation and everything is there. For the most part, I would suggest looking at the technical support documentation first and then contacting a representative at the vendor to continue the process.

Most companies have it integrated with the SIEM and with their ticketing system, although I did not use it in that capacity because it costs more money.

Most of the time, you're not going to have to lay a finger. Once it finds an infected file, you might have to reboot the computer if it can't immediately remove it, or other such minor stuff. In general, however, it's never given me any issues and it's never given me a headache. Overall, it's very straightforward and just one tool out of the whole.

I would rate this solution a nine out of ten.

We primarily use the solution for threat intelligence.

The threat intelligence on offer is the solution's most valuable aspect.

The solution is very stable.

The solution can scale easily.

The pricing is very competitive.

The solution overall is a good product, and we don't see too much room for improvement.

Support, particularly related to after-sales and after deployment, could be improved a bit. If you need to connect to support, it takes at least a day to reach the support team and get a proper reply.

The solution could use better device control.

I believe I've been using the solution for the past three years.

The solution is very stable. We don't find there are any bugs or glitches. We haven't had it crash or freeze on us. It's quite reliable.

The scalability of the solution is good. If a company needs to expand out, they can do so easily with this solution.

In our organization, we have about 2,500 people using the solution. We already use the solution at 100% capacity, meaning everyone in the company uses it. If new employees are onboarded, they also use the solution. Chances are, we will increase usage int he future.

Technical support could move a bit faster. We find that it takes time - at least a day - to reach support and then get a response. Therefore, we're not completely satisfied with the level of service provided to us. It's an area that could be improved upon for sure.

We used to use Carbon Black. We switched due to the fact that this solution offered us better partnership offers.

The initial setup is not complex. It's very, very easy.

You can set up and deploy the product in 30 to 40 minutes. It's straightforward.

You only need a few people to handle deployment and maintenance.

The price is very reasonable and quite competitive in the market.

Before choosing this solution, and switching from Carbon Black, we looked at Endgame and Kaspersky.

We are working with all the versions for the most part, due to the fact that we are partners of CrowdStrike and we position CrowdStrike to our customers. We also use the solution for our company.

I'd recommend the solution to others, however, I would advise that they try it first as a POC so that they can first see the value of the product.

Overall, I'd rate the solution eight out of ten. If technical support could be faster and there was more device control, I would rate the solution higher.