CrowdStrike Falcon Reviews

My main use case for CrowdStrike Falcon is endpoint detection and response. We use CrowdStrike Falcon for our antivirus across our entire organization, as well as insight and investigation to event data, telemetry data, and a plethora of other use cases and visibility.

Their early warning detections, their ransomware protections, their endpoint detection and response capabilities, and the telemetry data that allows us deeper insight into identifying threats as well as utilizing that for troubleshooting purposes are the best features CrowdStrike Falcon offers. It is pretty useful to glean a lot of details of what's happening within a process when you're trying to figure out something in a more technical aspect of the problem.

Positively, we have been able to successfully maintain compliance within all of our security obligations within our industry. We have had next to zero downtime outside of larger widespread problems, which has allowed us to remain secure on all of our endpoints and be able to conduct business with a lot less worry. We have also been able to improve our response speed to potential threats and infiltrations into the firm, as well as hardening those areas and offering faster and more effective remediation methods based on the data found from CrowdStrike Falcon.

There are a number of areas that I only touch a handful of times, but when I get in there, I realize why I don't do that. The main area would be within the support area. The support bot is not really as smart as you would expect it, especially in this day and age of LLM and other capabilities that I know CrowdStrike Falcon is already capable of doing. Additionally, I would appreciate a little bit more easy to read insights of some of the dashboards or maybe manipulation of the dashboards. It is still a little cumbersome to build custom dashboards and it's not as intuitive as you would think.

Documentation is abysmal and needs to be improved dramatically. I know that there's a big effort to do this, however, even the new effort is honestly worse than it was before. Those are definitely major areas of improvement, just more in the usability of the features.

I have been using CrowdStrike Falcon since 2014.

We have put CrowdStrike Falcon at the top of our detection list, meaning we are now getting what we feel to be higher efficacy alerts and prevention capabilities to our entire fleet. That has helped speed up our response capabilities as well as improve our CIS benchmarking for different areas and different teams.

It has increased the speed in which we are able to address incidences and it has increased the deployment capabilities of our security solutions that we are subscribing to within CrowdStrike Falcon.

I feel CrowdStrike Falcon's AI capabilities are a lot better than they were even six months ago and after a lot of the sessions that I've sat in this week, I am optimistic that they are getting their heads wrapped around what is most important, obviously starting with discovery. Initially as AI was this budding landscape and budding technology, CrowdStrike Falcon was just there and it was a little easy to read through the marketing fluff. However, they really seem to have figured it out. They understand already because CrowdStrike Falcon is a great company. They've already gotten a head start in understanding the nuances and difficulties around security and staying on the bleeding edge. In terms of AI, I think that they really are defending the right areas to gain that appropriate visibility and then put the appropriate guardrails in place. I also appreciate how CrowdStrike Falcon is on the forefront of governance and actually helping define that across the industries to ensure that there is safe usage of AI and that education is disseminating out from them.

As with any AI output, I am a little hesitant to believe it outright as I do think that it still hallucinates quite a bit. I have not had the opportunity to play too much with the AI outside of the support AI, which again I already mentioned is not good and in my opinion is more a chatbot than anything else. The Charlotte AI, initially, and again, I have not tried it in the last year or so, but the Charlotte AI, I felt initially was more a glorified search engine. As the LLM models are maturing and becoming more efficient, I would still trust the output, but I would still validate whatever it would tell me and I would do that for anything. As I've worked with AI now for the last several years, all models suffer from the same problem and I don't think it is unique to CrowdStrike Falcon. I think it is something that as usage increases, so will the efficacy and capabilities of the models to be able to trust them even more. We get into that situation when should we do a full trust and will we ever? Living in a zero trust environment or mindset, we should never. We should still have some sort of checks and balances and controls in place with a human or another agent or multiple agents to do validation where needed.

I wasn't involved too much with the earlier methods prior to CrowdStrike Falcon's deployment, so I don't have the baseline of where we were prior. However, I can speak to the overall supportability of the tool and the software, ensuring that we are able to quickly update our versioning across a large number of endpoints much more efficiently and effectively than in the past. Our overall deployment and replacement of our previous EDR solution and AV was a much more painless and seamless process to actually be able to deploy within just a matter of weeks, as opposed to older, more legacy software where that might take months. We've also been able to systematically improve our versioning updates. Initially we were doing regular updates that would take several months to ensure that we were continually pushing forward and maintaining those updates and those updated versions. But now with more automation and capabilities to remain as vigilant and compliant as possible, we're now down to automating those updates and are able to complete that within a matter of hours.

We started with EDR and AV and have brought on multiple modules since then. We brought in device control, Falcon Complete, and Overwatch. We have a lot of the prevention and ransomware features enabled and we are eyeballing other features such as AIDR.

CrowdStrike Falcon is a cloud-based deployment that is faster to update and has higher efficacy in terms of their detection capabilities.

Don't get sticker shocked by the price. It does a lot for the money; it's a lot of bang for the buck. Build off of lower tiered offerings and as you mature your organization, see what capabilities and features you have to turn on. It makes it very easy to enable new features. Keep that in mind as you're evaluating products.

CrowdStrike Falcon is the industry leader and continues to maintain that leading the charge of all of this. Having these multiple security products in the same tool is helpful because we already have that peace of mind that they are able to do that proper security. Everything is under a single pane of glass, so we're able to take a look and we can scale, or we only have to offer access via roles and responsibilities via CrowdStrike Falcon platform. We can control everything in one spot, which is also very helpful. The downside of having everything on one platform is if it goes down, then everything is down. We want to really be a bit cautious about how we do that. I would rate this product an 8 out of 10 overall.

My main use case for CrowdStrike Falcon is to monitor endpoint and end devices, find any anomalies, detect them, and provide a resolution to secure our endpoint devices.

I use CrowdStrike Falcon to examine different network traces and traffic around our Windows and Linux devices. CrowdStrike Falcon monitors how people are accessing our applications around those servers and logs, catching any blast radius such as a high volume of bombarding requests coming to a specific server or any unauthorized access to the server, whether internally or from disallowed external sources.

The best features CrowdStrike Falcon offers include endpoint device monitoring, protection from malware and external threats, and alerting on wrong policies being implemented or blocking such as an administrator applying certain policies, making CrowdStrike Falcon a great endpoint protection tool.

The feature I rely on most day to day is endpoint device protection, as CrowdStrike Falcon surpasses tools such as Symantec which do not have interactive monitoring or defensive methodology, allowing us to control and align policies across all servers in our organization.

CrowdStrike Falcon has positively impacted my organization by helping us to stay secure, resilient, and provide what our customers need all the time without impacting their data or disclosing their personal information.

I can share that CrowdStrike Falcon has prevented our end users from uploading malicious files to our applications on those servers, meaning our systems are well protected, and we avoid incidents or threats against our applications.

I chose nine out of ten because while CrowdStrike Falcon has the capabilities and features I want, the pricing for each different functionality or feature we want to add raises my concern about potentially having a compound or overall pricing increase.

I have been using CrowdStrike Falcon for five years.

CrowdStrike Falcon is stable, and I have not witnessed any performance impact on our endpoints due to the Falcon sensor as they are running smoothly without issues. The sensor is deployed through our imaging tool quickly to all endpoints.

CrowdStrike Falcon's scalability is excellent because it is software as a service, allowing us to deploy more agents without experiencing performance lags or issues.

The customer support is excellent. We receive reliable enterprise support when we have issues, and they provide all the guidance we need.

We previously used Symantec and Norton for some time before switching five or six years ago because they became obsolete and failed to keep pace with market advancements.

Using CrowdStrike Falcon has significantly helped our security team by allowing them to get alerts and perform blast radius detection in a straightforward manner, making the process more automated without the need to look through logs.

Since our initial deployment, our use of CrowdStrike Falcon has expanded significantly, starting with the basic Falcon sensor and then gradually including more capabilities around AIDR and other tools.

We utilize Charlotte AI within CrowdStrike Falcon to investigate endpoints and understand what certain actors did, allowing us to retrieve user and machine information quickly without manually browsing through CrowdStrike Falcon.

We have seen a return on investment with CrowdStrike Falcon as our security team has been optimized and scaled, allowing them to conduct more analyses around different security postures because CrowdStrike Falcon handles most of the groundwork.

I am not very knowledgeable about pricing, but I am aware it is quite expensive.

We did not evaluate other options before choosing CrowdStrike Falcon.

CrowdStrike Falcon has already improved significantly with its AI capability, Charlotte, and I am quite happy with what is being offered.

CrowdStrike Falcon's AI capabilities are remarkable, and I trust CrowdStrike to maintain governance, security, and data privacy with the tools they provide.

Regarding the AI capabilities, I have used Charlotte AI a couple of times, and I find it quite accurate, providing the right resiliency and detection during any investigation I perform.

Having multiple security capabilities on a single platform is excellent as it eliminates the need to navigate different tools to find anomalies or detect and analyze root causes, thereby saving time for analysts whenever security breaches or vulnerabilities are identified.

CrowdStrike Falcon helped our team detect a security incident where someone attempted a SQL injection on one of our secured Drupal-based application servers. CrowdStrike Falcon alerted our team, allowing us to block access and patch the vulnerability to avoid any future incidents.

CrowdStrike Falcon has significantly helped my security team reduce their efforts and time spent analyzing vulnerable resources or security mishaps and setting up enterprise policies across the organization.

My advice to others considering CrowdStrike Falcon is that it is a great product that reduces analyst time while providing greater security posture to meet industry standards. I gave this product a rating of nine out of ten.

My main use cases for CrowdStrike Falcon include endpoint defense, investigations, and triage.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by making it much more granular. It allows us to dive deep into the details of an investigation and gain a deep understanding of what is occurring.

I have seen benefits from having multiple security capabilities on a single platform. It makes the unity of all the detections and information being in one place far more beneficial than having to navigate between devices, assets, or tools. This significantly reduces dwell time.

The value I have seen from having endpoint identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is the same; having it all in one location truly benefits the time to remediation.

CrowdStrike Falcon has affected the workload and productivity of my security team by reducing it. We utilize CrowdStrike Falcon Complete as well, and having them serve as the front line for everything eliminates many false positives. When we receive an escalation from them, it is a clear directive stating 'Here is a problem you need to fix,' rather than uncertainty about whether something might be an issue.

CrowdStrike Falcon can be improved by addressing the side tabs and menu options, which represent the biggest area for enhancement.

I cannot identify any additional features that should be included in the next release unless they address that menu structure.

I have been using CrowdStrike Falcon for three months.

I would assess the stability and reliability of CrowdStrike Falcon as good. There appear to be occasional issues with their hosting infrastructure; US2 might experience downtime occasionally. Having greater focus on that from their side would be beneficial.

I have experienced the portal being unavailable to log into only occasionally, but beyond that, there has been no significant downtime, crashes, or performance issues.

We have not noticed any hardware issues or strain from the CrowdStrike Falcon sensor on endpoint performance and our ability to deploy security at scale. It provides the fine details necessary for thorough investigations.

I would evaluate customer service and technical support as good. Since we are still in rollout and working with CrowdStrike Falcon Launch, we have not yet needed to use the actual on-demand support, but it appears to be solid.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools.

As we are still in the rollout phase, it will replace Palo XDR, to some degree Splunk, and Palo XSOAR. Having everything on one platform with a single login and single pane of glass would be truly beneficial. Those three have been the primary tools being replaced.

I would describe my experience with deploying CrowdStrike Falcon as relatively streamlined. I believe we make it difficult ourselves, but for the most part, it has been quite seamless.

Getting an endpoint removed and a new endpoint installed with a single reboot has presented some challenges.

I have seen a return on investment with CrowdStrike Falcon. The amount of alert fatigue that we would have experienced with other tools has decreased significantly.

With Palo XDR, we would constantly receive alerts, granted they were alerts we set up. However, because it lacked the granularity to specify certain conditions while excluding others, we received far more alerts. Now, escalations are very limited, which is beneficial.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that the crowd aspect of CrowdStrike is valuable because we gain insight from attack vectors and methods we do not experience ourselves, allowing us to build alerts or develop awareness for them.

My use of CrowdStrike Falcon has expanded since my initial deployment. The initial deployment focused strictly on endpoint defense. We now have endpoint, SOAR, SIEM, and even some asset inventory capabilities, which is beneficial.

Currently, we are using AI within CrowdStrike Falcon to build many of the SOAR playbooks within their SOAR solution.

The impact AI has had on my security operations allows us to investigate matters more deeply and build very specific exclusions or alerting rules, which is beneficial.

The advice I would give to other organizations considering CrowdStrike Falcon is that while there is much to tackle and accomplish, it is well worth the effort. I would rate this product 9 out of 10.

CrowdStrike Falcon is my main tool for threat detection in managed services, primarily focused on identity.

My team and I use CrowdStrike Falcon day-to-day for threat detection in managed services, mainly identity. Last week, we were onboarding a new customer who had Defender in place, but we rolled out CrowdStrike Falcon to find more threats and determine where the threat had gone.

In that scenario, the attacker used AMSI bypass to essentially nullify Defender when we tested the sandbox. CrowdStrike Falcon detected it, and our automations isolated devices straight away as soon as we detected anything.

CrowdStrike Falcon fits into my workflow and is positioned well on the market for us. We have had an attacker get in through a VPN, and as soon as they started doing reconnaissance on the platform, we isolated it immediately.

We use AI within CrowdStrike Falcon platform in our orchestration. We have an AI SOC analyst that does the initial triage and then posts into teams with recommendations on what it has found.

Since my initial deployment of CrowdStrike Falcon, my use has expanded. Initially, we just had EDR, but now we have cloud security, identity, Falcon Guardian, and Falcon Shield, so we use quite a lot of the products now.

CrowdStrike Falcon has positively impacted my organization by bringing my mean time to respond down to seconds. We measure that reduction in response time using our SOAR platform. Before implementing CrowdStrike Falcon, our response times were probably in minutes, and now we have moved to seconds.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats, allowing us to isolate or revoke sessions via SOAR automations, meaning that the threat is isolated while my team conducts its work.

CrowdStrike Falcon allows me to maintain a lean security team while still having fast response capabilities and handling incidents when they come in. CrowdStrike Falcon has allowed me to consolidate or replace other security tools.

The standout features of CrowdStrike Falcon for me are the visibility and the control it gives us during an incident. These features help us see where the threat originated, and we integrate with other tools to get compromised users or isolate the device.

Regarding CrowdStrike Falcon's AI capabilities, I think its governance and security are great. I have no problems at all with the accuracy and reliability of the AI output in CrowdStrike Falcon, and AIDR is a phenomenal product.

Having multiple security capabilities on a single platform allows us to track threats across multiple platforms. The value from having endpoint identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform helps us identify the source of the attack, allowing us to rotate all those passwords and address the issues effectively.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is its simplicity and ease of use. When CrowdStrike acquires another company such as Adaptive Shield, the migration into CrowdStrike Falcon is seamless and very easy to do.

The main area of improvement for CrowdStrike Falcon is making the names of the products and the licensing a little less confusing, as it can be quite confusing to know what the product stack is.

I have been using CrowdStrike Falcon for four years.

CrowdStrike Falcon is stable.

The Falcon sensor does not have any impact on endpoint performance or my ability to deploy security at scale. CrowdStrike Falcon's scalability is fine.

The customer support is great. I would rate the customer support a 10 on a scale of 1 to 10.

I previously used Cisco Secure Endpoint, and it just was not good enough.

I have seen a return on investment, as our SOC customer base has doubled in about 18 months.

My experience with pricing, setup cost, and licensing has been positive because we are an MSP and on the MSSP program. The pricing was great, and although it took a while to get onto the program, now that we are, the pricing is very simple for us, which was one of the benefits of choosing CrowdStrike Falcon as an MSSP.

Before choosing CrowdStrike Falcon, I evaluated other options, specifically SentinelOne and Microsoft Defender.

I would rate CrowdStrike Falcon a 10 on a scale of 1 to 10. I give it a 10 because we have evaluated and worked with other EDRs that customers have, and CrowdStrike Falcon is the best by a mile.

CrowdStrike Falcon is deployed in my organization both on-premises to endpoints and in the public cloud, specifically AWS and Azure. I use both AWS and Azure equally with CrowdStrike Falcon.

My advice to others looking into using CrowdStrike Falcon is to make sure you learn and understand where everything is on the platform and what else it can do.

My main use cases for CrowdStrike Falcon are endpoint security, using one sensor to deploy various different types of tools. The end goal is less agent on an endpoint where I could accomplish so much with just one sensor installed, and that truly impresses me.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats. Our response ratio, which was our end goal, has decreased significantly from what it used to be.

In security incidents where multiple malware activities have occurred, CrowdStrike Falcon has prevented them, which could have resulted in much greater costs.

The benefits I have seen from having multiple security capabilities on a single platform are that it made my team's life easier by deploying one less agent on an end host, where we have seen significant performance improvement.

The value I have seen from having endpoint, identity, cloud, and other security telemetry in CrowdStrike Falcon is that a single pane of glass has really helped us. The analysts are not fatigued by moving between different platforms. It's a single pane of glass that has helped us focus on our goal.

CrowdStrike Falcon could be improved in several areas. For the next release, I have seen exposure management and some new modules coming up. If I had to compare with other products, it's not there yet. I was wondering if modules could be enhanced, especially on SSPM and exposure management.

I have been using CrowdStrike Falcon for five years.

I assess the stability and reliability of CrowdStrike Falcon as approximately 99% uptime, so it's very good.

I have experienced only the July 19th incident as downtime, crashes, or performance issues.

The impact that CrowdStrike Falcon sensor has had on endpoint performance and my ability to deploy security at scale is significant. The performance improvements have been substantial. Deploying one less agent has been easier to maintain.

I evaluate customer service and technical support as excellent. I have seen better improvement than other vendors I have worked with.

CrowdStrike Falcon has allowed me to consolidate and replace other security tools.

We decommissioned Trellix by replacing it with EDR. We also replaced Qualys by implementing exposure management.

I would describe my experience with deploying CrowdStrike Falcon as very easy and straightforward. I had a very good experience compared to other EDRs I have worked with.

What worked well is that it was easier to reach our metrics. The challenges I faced were keeping up with the sensors and sensor version updates. The deployment pace was very fast, making it difficult to keep up with.

I have seen return on investment with CrowdStrike Falcon. Addressing downtimes based on malware activities, I think we have seen great improvement.

My experience with pricing, setup cost, and licensing is that the license is expensive since it is based on per host. It is more expensive than other solutions I have dealt with.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is mainly the performance, where we have seen a vast improvement.

The impact it has had on my security operations is that it has made it easier for me to accomplish a lot of our use cases and finish all those tasks.

My use of CrowdStrike Falcon has expanded since my initial deployment as we have purchased many additional modules. We started with EDR and expanded with different modules like CrowdStrike Falcon for IT and exposure management.

I am currently using AI within CrowdStrike Falcon to write queries.

The advice I would give to other organizations considering CrowdStrike Falcon is to move forward with it. I provide this review with an overall rating of 9 out of 10.

Our main use cases for CrowdStrike Falcon are that we are a Falcon Complete customer and we are likely expanding in the next year. We are going to go with Next Gen SIM. I am here because I already took my class. We are going to integrate Identity, and we might be doing AIDR as well.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats. I think this has a lot to do with some of the automation and the ability to see things before they happen, and it results in very few false positives. Normally, if we get alerted, there is something we need to address or look into immediately.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools. We are in the process of that right now by proof of concepting out Next Gen SIM, Identity, and AIDR. We are going to be probably discontinuing our current SIM to go to Next Gen and some of our identity monitoring tools will likely be sunsetted when we get Identity spun up.

The value I have seen from having endpoint, identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is fantastic. You are seeing potential attack points from many different angles while monitoring user activities and behaviors. It is absolutely a great product and a great platform.

CrowdStrike Falcon can be improved by continuing to keep everything on the cutting edge. The product works and is stable, as long as we do not have a rehash of what happened in the summer of 2024 because I dealt with that frontline. The product works well, is not a resource hog, and is the best in the class. Just keep progressing and adding new features as the IT field changes for the next ten to twenty years.

From my perspective on identity access management, there are additional features I would like to see included in the next release of CrowdStrike Falcon. I am just getting started with the Identity portion of CrowdStrike Falcon, so if you ask me this next year, I would probably give you a great answer, but right now I cannot.

I have been using CrowdStrike Falcon for a good five years, which is when we first started.

I assess the stability and reliability of CrowdStrike Falcon as high. There was only one issue, and we all know when that was, and we hope it does not happen again.

I have not experienced any downtime crashes or performance issues with CrowdStrike Falcon. The only downtime we have ever experienced was in June of 2024.

The impact of CrowdStrike Falcon sensor on endpoint performance and my ability to deploy security at scale is minimal. Loading the sensor is really a piece of cake. We have it scripted into new machine builds and it is very easy to manage and easy to get pushed out to the base.

I would evaluate customer service and technical support for CrowdStrike Falcon as very good. Our product teams, sales engineers, and support are always good. Support is very good across the board. Everybody is friendly, knowledgeable, and wants to help, and you can feel that they want to keep your business. Many companies in this era seem like they do not care. CrowdStrike does care.

My experience with deploying CrowdStrike Falcon is positive. Getting the agent out on the workstations and servers is easy. Once you get your tenant set up and you have your CIDs and everything, building it out becomes straightforward. We have now built out three or four different tenants and it gets easier every time.

What works well with CrowdStrike Falcon deployment is that we really did not face major challenges. The biggest challenge is always finding all of the machines in your environment because asset inventories are often not accurate, new machines are coming in, and old machines are going out. So that is really the biggest challenge and that really is not a CrowdStrike Falcon issue; that is just a corporate IT issue.

I have seen return on investment with CrowdStrike Falcon. I am sure this is the case because we are in the medical industry and keeping PHI and everything safe. We have to have cyber liability insurance, and knowing that we have CrowdStrike Falcon definitely helps when it comes to the bottom line and helping our insurance rates stay at a fair level.

My experience with pricing, setup costs, and licensing for CrowdStrike Falcon is that it is pretty fair. We are always able to get to a good price and the proper amount of licensing. It is very fair.

My advice to other organizations considering CrowdStrike Falcon is to definitely work with one of the good reselling partners. We use GuidePoint, and they are fantastic. I can also say that you should really get to know your CrowdStrike Falcon team once they are assigned to your company because they are definitely assets to leverage. I would rate this product as a nine overall.

My main use case for CrowdStrike Falcon is protecting high value assets and servers. For example, we typically have a lot of people doing click-through for downloads of remote management and ScreenConnect type software, so CrowdStrike Falcon is really good at identifying those user interactions, the clicks, and the hacker trying to come in and log in using that ScreenConnect software; we do see that a lot.

The best features CrowdStrike Falcon offers include the time to discovery, the cost and effectiveness of the software, and the ability to isolate machines and allow for remediation.

The ability to isolate machines has positively impacted my operations because it can take the threats offline quickly and allow us the time that we need to be able to interact with them and get them back online properly.

CrowdStrike Falcon has positively impacted my organization by allowing our admins and our Security Operations Center folks to be able to focus on other things, giving them enough time to not just be dealing with these incidents on a regular basis, but allowing us to free that time and use it in other places more effectively.

I am pretty happy with CrowdStrike Falcon where it is. I do like some of the new features being added to it with some of the AI pieces and the SIM, and we have not really broached those pieces yet, but I think we are really interested in at some point expanding our portfolio.

Regarding CrowdStrike Falcon's AI capabilities, I think it still needs a little bit of time to learn and improve itself in the environment, but overall it has been pretty accurate.

I have been using CrowdStrike Falcon for approximately four years.

CrowdStrike Falcon is very stable.

CrowdStrike Falcon's scalability has been good because we have not had any issues. We are using automated deployment methods such as Jamf for Macs and adding AD groups, so members just get joined to an AD group, and the agent is deploying effectively, allowing us to do dozens of machines at a time without any issue.

Customer support has been good. We do have a third-party MSP that is assisting us with some of those issues, so between that and the MSP, we are actually doing pretty good.

We were primarily using Microsoft Defender before choosing CrowdStrike Falcon. It just was not very effective, especially on things like Linux and Mac.

My experience with pricing, setup cost, and licensing has been pretty seamless. We are purchasing from multiple sources for various reasons, but working with CrowdStrike Falcon directly through a third-party VAR has actually been working out really well without any issues or hiccups.

CrowdStrike Falcon has allowed us to consolidate or replace other security tools, and we have actually replaced traditional antivirus in most of our deployment cases, not requiring to have paid extra money for the high-level Defender or a third-party software for our Macs. We are able to almost ubiquitously deploy CrowdStrike Falcon to all of our Linux, Macs, and Windows boxes easily.

I think we have seen a return on investment from CrowdStrike Falcon, as generally the amount of time saved not having to threat hunt and look for these issues as they pop up saves us if we can catch it early enough from having to disable multiple users, which may be part of a later phishing event or disruption event in our environment.

Before choosing CrowdStrike Falcon, we really did not look around a lot, as we actually got such a good deal, and based on the reputation and other folks purchasing it in higher ed, we just really went back through it. We did not do a bake-off or anything.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by allowing us to focus on other things and not really worry about this. We only need to concentrate on these threats and indicators once they happen.

Having multiple security capabilities on a single platform has allowed us to work more effectively because I think the more things that you can consolidate into a single pane of glass allows the users to work more effectively without having to keep switching back and forth.

A security incident where CrowdStrike Falcon helped my team detect or stop a threat involved users getting phishing links that told them to download software, which actually downloads ScreenConnect remote access software to their workstations. CrowdStrike Falcon has been detecting these indicators, and we have been able to tell it that since it is not an authorized application within our university, we can have it stop, block, and isolate those instances and notify the SOC, which works pretty well because we are able to then isolate the user, educate the user through the help desk, and have the box re-imaged to make sure it is clean.

CrowdStrike Falcon has affected the workload or productivity of my security team by allowing us to concentrate on other things because this is very self-driven and keeps things moving.

The CrowdStrike Falcon sensor has had a positive impact on endpoint performance and my ability to deploy security at scale because we actually have not had any negative impacts at all. It has all been positive, with the exception of some maybe glitches on the Linux boxes, but there really have not been any performance or issues otherwise.

We are honestly probably not using AI within CrowdStrike Falcon as effectively as we could, but we do use it to help search for related incidents and similarities within the console to see what is there.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is the ease of use and the lightweight client, which seem to be the biggest advantages.

The best advice I could give to others looking into using CrowdStrike Falcon is to listen, understand what your options are, make sure you have a good idea of what your deployment is going to look like and plan for that, and then everything should flow freely. Do not buy it haphazardly. I would rate this review a 10 out of 10.

Hybrid Cloud

Amazon Web Services (AWS)

CrowdStrike Falcon is primarily used because we are a system integrator that sells a solution to our customers, so most of it is endpoint security.

We are not the one operating CrowdStrike Falcon, but when we do an implementation, once we install the agent and complete the implementation, we see what it has detected from day one of the implementation until the turnover to the operations team. The Falcon Complete dashboard is intuitive, especially OverWatch, which highlights every risk that we need to manage, and also the detection field and incident field where we can see the entire timeline and all the things that happened. There is also a network map where you can see, for example, if there is one detection on a workstation, which other users or other devices it communicated with.

We are primarily utilizing Charlotte AI within CrowdStrike Falcon platform. We use it extensively on CrowdStrike Falcon EDR, plus also NG-SIEM, because with Charlotte, it can help us create queries without doing it manually.

One of the key advantages of CrowdStrike Falcon is its lightweight sensor, so it is easy to deploy compared to other security solutions.

CrowdStrike Falcon provides results because, until now, no customer of ours has gotten ransomware or been infected.

The most common solutions that I compare CrowdStrike Falcon to in my country are Trend Micro, Sophos, and Palo Alto and SentinelOne. The really key advantage of CrowdStrike Falcon is its lightweight sensor. Some of the companies that I mentioned earlier had a hard time deploying because they have 400 to 500 MB of sensor, which if you deploy it on 3,000 or 4,000 endpoints, it will really slow down their network. Unlike with CrowdStrike Falcon, we can deploy, for example, 2,000 endpoints a day.

There is no impact on endpoint performance. On some of the other products that I compared CrowdStrike Falcon with, some of them cause high utilization. We have not experienced that with CrowdStrike Falcon.

For me as the one who implements CrowdStrike Falcon, it has a real impact because it is easy to deploy. Even though the customer does not have software deployment tools, you can deploy CrowdStrike Falcon by having a simple GPO, a Group Policy Object, load it there, and then you can install it easily.

For endpoint performance, it is great because it is very lightweight. It is not the traditional antivirus from before where when you do a scan and install it, the CPU and memory will spike up and the user cannot do anything about it. CrowdStrike Falcon is very lightweight. With that, users do not need to balance between usability and security because with CrowdStrike Falcon, you can have both.

CrowdStrike Falcon can improve their supportability of legacy devices. This is where CrowdStrike Falcon has been edged out by other cybersecurity vendors because some of them support legacy operating systems, unlike CrowdStrike Falcon that primarily uses one level higher of operating system than others.

In the cybersecurity field, I have been working for more than ten years. We have been working with CrowdStrike Falcon since 2022 to now.

In terms of reliability, ever since I used CrowdStrike Falcon platform, I think it is still okay because the GUI, the dashboard, and the console are easy to use because all of their solutions are in one platform, so you will not get lost. They have OverWatch and a detection incident where all the detection is already consolidated there. Once you click it, you are going to see all the details.

The most common solutions that I compare CrowdStrike Falcon to in my country are Trend Micro, Sophos, and Palo Alto and SentinelOne. The really key advantage of CrowdStrike Falcon is its lightweight sensor. Some of those companies that I mentioned had a hard time deploying because they have 400 to 500 MB of sensor, which if you deploy it on 3,000 or 4,000 endpoints, it will really slow down their network. Unlike with CrowdStrike Falcon, we can deploy, for example, 2,000 endpoints a day.

When we had an issue, for example, on an agent installation because of one legacy device or when we were installing it with another endpoint application, we had CrowdStrike Falcon support come in with us. They are very helpful because they were able to resolve our issue.

We had one experience with one of our customers where at first, they were not a CrowdStrike Falcon user. They had a ransomware with a different solution, not CrowdStrike Falcon. After that, we asked them to try CrowdStrike Falcon and install it, then we could see other detections that their previous vendor or solution did not see. After we were able to help them clean their environment, they transitioned to CrowdStrike Falcon with Falcon Complete, with the managed detection and response of CrowdStrike Falcon.

The most common solution right now in my country is NG-SIEM. Before, they used a different SIEM, like Splunk, Rapid7, Exabeam, or QRadar, but now that they see the value of CrowdStrike Falcon XDR and they want it to work together, most of them are trying to move to NG-SIEM so that you can have your XDR and your SIEM in one platform, plus the telemetry that CrowdStrike Falcon endpoint provides. This will really help them secure their environment.

I think it is very great that we have a solution as CrowdStrike Falcon which has many different security functionalities because threats are evolving. As the defender, we need to evolve as well. We are fortunate to have CrowdStrike Falcon that is continuing to evolve, even now in the AI era because threats are more complex than before. Before you just needed to worry about the zero-day and the signature. Now it is different with AI. We are fortunate we have CrowdStrike Falcon with us.

I am confident that CrowdStrike Falcon is up to par to protect you and your customers from AI threats.

Most of our customers in my country use CrowdStrike Falcon, and ever since then, they do not have serious incidents, such as a ransomware that has taken effect on all their critical infrastructures, including servers.

One value or benefit that customers can have from CrowdStrike Falcon is not having their solutions in silos. If it works in silos, it is going to be hard to keep track of threats, especially now that AI is moving at AI speed. If we are working in silos or have different solutions, it is going to be hard to catch up. Did they get anything on the identity solution? Did they get anything on the cloud solution? With CrowdStrike Falcon, it is all in a single sensor and a single platform. Customers are going to have a single pane of glass that they can look at.

The impact of AI features such as Charlotte AI on our security operations makes our lives easier, not only for us but also for our customers. Before, when they were going to do a query, they needed to drill down multiple times before they got to the one event that they wanted to see. Now, if you ask Charlotte, it is one click of a button and enter, and Charlotte will give you everything. It is much faster than drilling down to all the events and all the reports.

Customers usually get Falcon EDR first, Falcon Pro. After that, they expand to Falcon Complete, meaning adding the MDR services, and now they are trying to go to NG-SIEM plus the identity. Now that they have heard about Falcon Guardian, they might look into that as well.

If I were to give advice for someone who is evaluating or considering CrowdStrike Falcon platform, I think they need to try it so they can feel the experience and the protection and the security that CrowdStrike Falcon provides. I rate this solution a ten out of ten.

My main use case for CrowdStrike Falcon is endpoint detection. I want to ensure that all of our endpoints are protected and detect any malicious activity or any unauthorized activity on our endpoints for endpoint detection in my day-to-day work.

We have recently started using Identity Protection next to CrowdStrike Falcon EDR, We also use the next-gen SIEM a little bit, primarily during incidents to look for evidence on CrowdStrike.

We are not using AI much within CrowdStrike Falcon, apart from a little bit of Charlotte, but I am planning to explore that avenue further.

My use of CrowdStrike Falcon has expanded since the initial deployment with additions such as Identity Protection and firewalls.

Since implementing CrowdStrike Falcon, we do feel safer, as we detect unauthorized activities and can react quickly.

Although I do not have the numbers, I can say that when we have an incident, we see the processes, the graph, the timelines, and the adversary's actions, allowing us to make quick decisions and contain the device then and there.

Using CrowdStrike Falcon made our life much easier because we now have one place for the endpoints where we can go and find all the answers that we need.

We had an incident involving aphishing ; we looked at the files and discovered it was a Microsoft OneDrive link and users download the malicious file and executing a script. CrowdStrike Falcon not only prevented it but also helped us trace it back to that link, enabling us to understand where it came from, stopping access at that level, and preventing the script from running saved us massively.

We are a very small team, and CrowdStrike Falcon is a real help, with automation being a key factor that helps us leverage our limited resources to take more action despite having fewer people.

CrowdStrike Falcon offers very good protection, and I will see all the information in one place, which is quite handy and reliable.

When I say all the information is in one place, it helps us in practice because we see all the processes and activities on the endpoints related to an event or incident, and we can pivot to see more data by going deep into the data available and exported from the endpoint.

The detection capabilities are really good, as it understands the behavior of Windows machines, although it is not as great on Mac OS and Linux.

I really appreciate the identity part, which fits nicely with our endpoint detection using CrowdStrike Falcon EDR, and I see some benefits already from deploying it recently, allowing me to trace back from one identity to one endpoint and back again.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that it understands detection and response exceptionally well, proven by its good telemetry collection and actionable insights, so I do not have to worry about creating detection rules, with fewer false positives than other platforms.

I think CrowdStrike Falcon UI is a little bit slow to react and they keep moving the options and modules. we have to jump from one module to another this is a real painn requiring multiple tabs open for investigations. It would be easier if it consolidated the information on one page instead of opening new tabs in the browser.

Session timeout bothers us because investigations sometimes take time, and when we jump to another platform to continue, our session expires and all of tabs are time out. If I have not tagged or saved them, I have to redo that work, which occurs quite often.

So far, I have mix feeling about Charlotte AI, sometimes makes mistakes and misses context, however it never forget to consume tokens, which affects its reliability.

CrowdStrike has expanded far beyond what we were used to in traditional securitydetection and response now it needs to be more easily accessible, and we should not have to jump into so many modules and hopes to complete an investigation

CrowdStrike Falcon itself does not pose a problem regarding endpoint performance; it reliable and doesn't spike the device performance. However, the device control related to USB blocking is a significant challenge for us, it defiantly requiring improvement, as it mistakenly disables usb cameras and is difficult to track in logs. CrowdStrike claims it has not blocked anything, yet the USB and camera non-functionality persists until removal of CrowdStrike.

I have used CrowdStrike Falcon since three years ago in my recent job, although I have used CrowdStrike Falcon well from my previous roles since 2018.

CrowdStrike Falcon is stable in my experience, with only one significant glitch and the persistent USB issue, but otherwise it works well.

CrowdStrike Falcon's scalability allows for easy scaling without issues.

Customer support with CrowdStrike is very poor; they often respond with scripted answers, as it has become an AI chat support system made it even worse. Overall, it does not provide a great experience, especially with sales and support staff not being attentive,

When you have issue take time to explain it to them and then they say ohh it's over 7 days we don't have logs. That usb issues, every time they ask for logs but nothing comes out of it. I have stopped raising issues it to them unless if we are really need them

We previously used another ePO EDR, ; it was challenging with detections and due to false positives. managing exclusions was time-consuming This inefficiency is why we made the switch.

CrowdStrike Falcon is deployed in our organization on a public cloud, where we have our own tenants.

No you can do it yourself, but spend time configuring all policies, integration and automation  before leave it to run on it own

Although I cannot provide solid metrics on return on investment, I can say that I have a small team and definitely need CrowdStrike Falcon, so I cannot get away from it.

We have an enterprise contract, as the parent company purchased CrowdStrike.

It is really good to have multiple capabilities on a single platform, but when they are fragmented into different modules and sold at a very expensive rate, people end up having one or two modules and miss out on the holistic approach that CrowdStrike Falcon offers. I think an endpoint should be an endpoint, regardless of being in the cloud or on-prem, Crowdstrike consider a container a different cost, so is the cloud, and endpoints, and mobile; this approach makes it difficult as we have to pick and choose. That's not included other modules, 

I believe those that are related to security operation and detection and reaponse all should be part of same package, although I understand some modules such as AI, cloud config posture, and vulnerability can be different

Licensing is a real challenge with CrowdStrike Falcon, as it is the main reason that makes us reconsider moving further with it new capabilities.

Defender was another option we considered. We found Crowdstrike was much easier to work with and navigate and information were presented much clearer. 

I rate it an eight because, it's a very high and respectable number,  in terms of technology, CrowdStrike Falcon focus primarily at endpoints, believing everything evolves from there. However, we do have network activities that CrowdStrike Falcon does not account for, which makes it a bit difficult to rate it a ten; it is not all-encompassing, but it is really good.

The AI capabilities of CrowdStrike Falcon are new, so I need to use this to get more insight. From what I have seen, it is interesting, but I will see how it evolves.

I have not consolidated or replaced other security tools with CrowdStrike Falcon, as not much has been done in that area.

My advice for others looking into using CrowdStrike Falcon is to invest time and money to customise the platform so that it can work cohesively across different modules, ensuring it is not just a single alerting tool but rather an integrated system that correlates data and reaponse across the enterprise.

Our main use cases for CrowdStrike Falcon are endpoint security and USB access, with endpoint security being our primary focus.

I can describe a security incident where CrowdStrike Falcon helped my team detect and stop a threat. One of our IT help desk analysts downloaded a BIOS update from Dell without realizing it contained a critical vulnerability. CrowdStrike Falcon helped us block that download and alerted us to investigate it. We were able to follow up, see what process was running, and determine that our analyst needed to double-check that we were downloading and uploading up-to-date BIOS updates.

My use of CrowdStrike Falcon has expanded since my initial deployment from endpoint security to USB access. We were initially managing USB access through GPO, but we decided to transition to CrowdStrike Falcon because it provided us with greater visibility.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats because it gives us a lot of granularity on what goes on, what processes are being run, and what is actually being executed if anyone is trying to get onto our endpoints.

The benefits I have seen from having multiple security capabilities on a single platform is that it gives us more tools to investigate and specifically tells us what happened. Having all those tools at our disposal gives us the benefit of knowing exactly what happened, what time it happened, and what process or executable was being run.

The value I have seen from having endpoint identity, cloud, and other security telemetry in CrowdStrike Falcon is that it is good to have it all consolidated in one platform so we do not have to deal with logging in and going to multiple different sources. It is all consolidated, so it is good to have one platform that we can go to.

CrowdStrike Falcon has affected the workload or productivity of my security team by simplifying it significantly. It also gives us the flexibility to simplify our processes, but if we want to get granular, we can go in deeper, investigate, and get down to the details.

We are not currently using AI within CrowdStrike Falcon, but that is definitely something that we want to explore further because we know that CrowdStrike values the discovery of AI and ensuring you have full coverage.

CrowdStrike Falcon can be improved by strengthening the focus on AI and keeping up with responding to AI as it constantly evolves. It would be beneficial to have more information on that.

I have been using CrowdStrike Falcon for about eight months, ever since I started at Royal Business Bank back in January, and it has been really good to us so far.

I would assess the stability and reliability of CrowdStrike Falcon as very reliable. A lot of the information they provide us is accurate and delivered in real-time.

I have not experienced any downtime, crashes, or performance issues with CrowdStrike Falcon.

CrowdStrike Falcon has had a positive impact on endpoint performance and my ability to deploy security at scale. Everything has been smooth and happens autonomously. We do not have to be closely monitoring the sensor updates that get deployed. The simplicity of the process is a major advantage.

I would evaluate customer service and technical support as really good. They are very fast and usually respond within a few hours, providing us with all the information we need, including documentation, notes, and action items we need to take.

CrowdStrike Falcon has allowed us to consolidate or replace other security tools. We have had a few security tools that were redundant, and it helped us with the cost benefit of cutting those off and consolidating everything into one security tool.

We decided to cut Darktrace and stick with CrowdStrike Falcon because we realized we do not really need two platforms for the same process. Darktrace is more of a network security platform, and CrowdStrike Falcon does a little bit of both.

I would describe my experience with deploying CrowdStrike Falcon as good and simple. It has been really easy to deploy out, and if I ever need anything, the support is always really good.

What worked well during deployment was that CrowdStrike Falcon was really responsive when we faced some challenges with a recent Dell BIOS update that they were flagging. It created a lot of noise for us, but CrowdStrike Falcon had documentation on that specific type of update and let us know the response action that we needed to take.

I have seen a return on investment with CrowdStrike Falcon. The business has definitely seen a significant investment in it, particularly with the amount of visibility and the ability to triage and manage alerts that we now have.

My experience with pricing, setup cost, and licensing has been good with no complaints. It has been really simple, and they have been very honest and willing to work with us.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is the comparison with Arctic Wolf, which is a managed detection and response platform. The main difference was the granularity and the ability to give us more data to read and analyze.

I would rate CrowdStrike Falcon overall as a nine out of ten because it is a really good tool, and obviously nothing is perfect, but it is definitely a big player in the security industry. I would advise other organizations considering CrowdStrike Falcon that if you want to get more visibility and more data, then CrowdStrike Falcon is definitely something you should consider. I think their customer support is really good and their agents are very professional and smooth. If you are ever looking for more granular insights, CrowdStrike Falcon is the way to go.