CrowdStrike Falcon Complete MDR Reviews

The most valuable feature is that it has a zero-day approach. It does not work with the signature itself. It looks into what is happening on an endpoint and protects you better against threats that are not yet known but are captured in a signature. It provides far better detection than when it is only signature-based. You get much quicker protection against any new threat. This is the most important feature of the CrowdStrike solution.

They have very good knowledge of how to hunt for threats. It is all about the intelligence you put into a solution for detection. It is about making sure that if you see a number of things, you can interpret them correctly and take the right action against them. They're one of the best vendors because they come from that background. 

They are doing very well in continuously improving their product. The only thing is that it is completely cloud-based, and some customers don't really like that type of approach, but you can only provide such a solution when you have cloud-based intelligence. On the other end, we know that it is sometimes a breaking point for some of the customers. They could potentially have an on-prem or hybrid solution. Any antivirus needs to have its features updated. If there could be a relay between them, it would be helpful, but that's very hard to do. So, you either accept that approach and have the benefit with this little disadvantage. 

I have been working with this solution for three years.

We don't see any specific limitations on that at the moment. 

We have large implementations, and we don't really see any issues with the scalability of the solution. It seems to be able to scale up fairly quickly within the environment.

Their support is top-notch. They're very dedicated. Their experts are online when you need them. 

It is very straightforward. It takes very limited time to set it up. People get used to it very quickly.

Being a cloud-based solution, you don't really have to do a lot of installation. They have their own cloud. It is maintaining itself. There are automatic updates. That's one of the reasons why you want to go to the cloud-based approach. It is very easy in terms of maintenance.

I would advise anyone interested in such a solution to try it out. It is very easy to try it out. 

It is an absolute requirement to get an EDR solution in place. You should go with the ones that really have the most advanced capabilities for threat hunting. It is best to go with the experts. They've had some competition from Microsoft, which is not a bad solution, but Microsoft is not a security expert. CrowdStrike knows very well how to identify threats and link them to specific behavior. That's what you really want to have in there, and that's their strength. One of the reasons why they're still leading is that they are the only ones who can say, "We manage your network, and we would give you money back if we could not detect the issues upfront." That's one of their strong points.

If they don't do any specific scanning, they will adapt themselves to that. If it is a new system, they would need to learn that. If there is something new in there, it could be harder for them to detect it because they don't yet know the behavior, and they have to learn about it. That's the only negative element I see in it. 

They're doing quite a bit of work in improving it. They are doing a good job in evolving the product. I don't see any specific needs at this given moment on that. You could ask a lot, but in the end, you still need to make sure that the core is functioning well. They should stick with what they do best. Evolve that but not start doing everything. That's because it will not work. I'd rather have them stick to their niche.

I would rate it a nine out of 10.

We use the solution for protecting the endpoints.

The solution simplified our structure.

The Falcon Spotlight is a most valuable feature.

While the pricing does not bother us, it is a bit on the high side. It could be lower.

An MDM, Mobile Device Manager, should be added in the next release. 

We just started implementing CrowdStrike Falcon Complete a couple of weeks ago. 

We have only recently started to implement the solution, so I am not in a position to comment on its stability. 

We have not had occasion to contact technical support. 

We did not use a different solution in the past. 

The initial setup was easy.

We handled the initial setup on our own. We make use of CrowdStrike's help.

The pricing could be lower. The solution is a bit expensive. 

In addition to CrowdStrike Falcon Complete, we also looked at FireEye from Palo Alto and at other solutions from Symantec. We decided to go with CrowdStrike Falcon Complete.

I rate CrowdStrike Falcon Complete as an eight out of ten.

It's an EDR group solution. We use it for behavioral-based analysis.

On our endpoints, we have signature-based and behavioral-based analyses, and we use CrowdStrike Falcon Complete for behavioral-based analyses. 

I think it has very good features that help dig deeper while doing an investigation. Its IOCs alerting mechanism is good. I think it is AI based and categorizes behaviors which are unusual.

CrowdStrike Falcon Complete has good instrumentation, and the user interface is good too.

Pricing is definitely a problem. It could be cheaper for licensing.

I've been using CrowdStrike Falcon Complete for 5 years.

It is stable.

It is scalable as well. It's a cloud-based solution, so I don't doubt the scalability. I think it's good.

We have 6,000 end users who are using it.

The technical support is good. You raise a complaint, and they respond immediately.

The installation was smooth and didn't take much time.

We did it by ourselves. We have two or three engineers who run it and perform the rolling, installation, and upgrades.

We have a yearly license, and it could be cheaper.

We evaluated Trend Micro and Sophos before choosing CrowdStrike Falcon Complete.

CrowdStrike Falcon Complete is great, and I would rate it at eight on a scale from one to ten.

If you go with this solution, I think that you should also obtain another service called Hybrid Analysis, the premium edition. I think with this, you'll get malware samples you can correlate, and it will be a good tool for the SOC team.

We implemented this solution to secure everything in our environment, such as our endpoints, servers, and network.

EDR and Next-Generation Antivirus (NGAV) are good features. The Spotlight feature is also good, and it also can detect patching-related vulnerabilities. 

We have also been using Cisco AMP for Endpoints for three years. We have received multiple detections in Cisco AMP for Endpoints, and we had to take some actions, whereas CrowdStrike has not detected anything critical since it has been implemented. Most of the incidents that it has detected are false positives. They should work on the false-positive issue. When it is implemented throughout the organization, it gets very difficult to check each false positive and investigate what is correct and what is not correct. It requires technical and manual intervention.

I have been using this solution for two months.

It is stable and reliable.

We have not scaled it, but we have implemented it across the company.

They have been very responsive. There are no concerns about their service. 

We also use Cisco AMP for Endpoints. Cisco AMP for Endpoints is signature-based, and CrowdStrike is behavior-based. We have received multiple detections in Cisco AMP for Endpoints, whereas CrowdStrike has not detected anything critical since it has been implemented. There are a lot of false positives.

Both Cisco AMP for Endpoints and CrowdStrike are agent-based, but with Cisco AMP for Endpoints, we get a much slower system because it requires a lot of processing power, whereas CrowdStrike doesn't require a lot of processing power. 

In terms of pricing, CrowdStrike Falcon Complete is 50% more expensive than Cisco AMP for Endpoints.

Its price is very high. CrowdStrike Falcon Complete is 50% more expensive than Cisco AMP for Endpoints.

I can recommend this solution. It is definitely one of the best products in the market, but so many false positives are its minus point. Cisco AMP for Endpoints is better than this.

I would rate CrowdStrike Falcon Complete a seven out of ten.

Currently, we're trying to understand which solution would be able to help us to block external ports on computers. We're looking at Crowdstrike and working to understand how they can help us handle this.

While I'm not directly on the team that deals with the solution daily, I would say that the solution is very stable.

The solution is quite flexible.

We haven't had any issues with the product so far. 

It's my understanding that the reporting aspect of the solution could be improved. It should be more flexible and robust.

The solution should include some sort of DLP capabilities.

I've been using the solution for a while. It's been about three years or so.

The stability of the solution is very good. There are no bugs or glitches. It doesn't crash or freeze. It's reliable. The performance is great.

We have more than 25,000 users on the solution currently. 

We are currently evaluating the solution to see if we will continue to use it or not going forward. Until that is done, I can't speak to if there are plans to increase usage.

I've never been in touch with technical support. A different team handles that aspect. I cannot speak to how helpful or responsive they are. I can't provide any useful insights at this time. 

The initial setup took place about three years ago. At the time it was installed I wasn't a part of the company. Therefore, I can't speak to how easy or difficult the solution is to set up and deploy. I wasn't a part of the process. 

We pay a licensing fee in order to use the solution, however, I can't speak to the overall cost. It's not an aspect of the solution I directly deal with.

My company is a customer and an end-user of the solution. It doesn't have any direct affiliation with Crowdstrike.

We're using the latest version of the solution at this time. I can't speak to what the actual version number is. 

I'd rate the solution, on a scale from one to ten, at an eight. We're mostly quite satisfied with the solution.

I'd recommend the solution to other users and organizations.

It is an advanced anti-malware solution. Our clients replace the existing traditional antivirus with this solution. We are an implementer. We sell this solution, and then I go and understand the existing environment to deploy it.

It is a major anti-malware solution. It can stop zero-day attacks and ransomware attacks. There are so many features in CrowdStrike. 

It is lightweight on the endpoints. It doesn't have any scanning mechanism. It works on artificial intelligence, static analysis, and dynamic analysis. There is no signature available on this.

It is a pretty easy solution. It is cloud-based, so there is no driver maintenance or anything like that. You can go anywhere in the world. If you have internet, you'll get connected to the cloud and the policies that it contains. It is pretty simple.

Its support should be improved. The product is amazing, but the problem is that their support team is overconfident about the product. If something happens, they don't listen. They keep arguing with the customer.

It should have more reporting. Reports are not that customizable. We need customizable reports for our customers, but they not there in CrowdStrike as well as SentinelOne.

I have been providing this solution for three years.

It is a 100% reliable solution. We had some small glitches with it, but we were able to rectify those issues by tuning it.

It is pretty good. We have four customers, and there are a total of 15,000 to 20,000 users.

One of our clients has been using this for over a year now, and they have acquired more companies. They will possibly buy more. They really like the product and are happy with the product.

The first level of support is with us. If I'm not able to solve an issue, then I'll raise a case to Falcon with the help of the customer. I get guidance from the customer to raise the ticket about the issue and everything. As a partner or a vendor, we cannot raise a case for another customer. 

Their support team is overconfident about the product. If something happens, they don't listen. They keep arguing with the customer.

I have got experience with SentinelOne Vigilance. The major difference between SentinelOne Vigilance and CrowdStrike Falcon is the pricing. CrowdStrike is more expensive. Otherwise, both work in almost the same manner. They are cloud-based, and they are next-generation endpoints. They block cyber attacks. 

Its initial setup is straightforward. It is pretty simple. It is a very powerful product that doesn't take much time to be set up. Unlike traditional antivirus, you don't need to create a lot of policies and build up the server. I have a link, and I enable the license and download the agent. That's it. It is pretty fast. 

The deployment duration depends on the environment and the number of clients. It could take from three days to one week depending upon the number of agents. In most cases, the customer will opt to deploy for 50 machines. A customer has around 6,000 endpoints, and I have also deployed for only 50. It depends upon the customer. 

We are a team of two. I and my colleague do the deployment. 

It definitely needs upgrade, fine-tuning, and exclusions. No security product is 100% accurate, so we need fine-tuning. I am responsible for the maintenance for our clients. They have something called an Annual Maintenance Contract (AMC). Every quarter, I need to do a health check of their endpoints. After that, I send a report to them about the fine-tuning findings and the fine-tuning steps that need to be performed.

Our clients have definitely seen ROI. They were attacked with ransomware, but CrowdStrike blocked it. They reported to us, and we reported to CrowdStrike.

CrowdStrike is more expensive than SentinelOne. Licensing works on the number of agents and the modules you buy. CrowdStrike has different modules, such as Falcon, Falcon Overwatch, Falcon Complete, etc. The pricing depends upon the module that the customer wants. They have different Incident Response (IR) teams, which are very expensive.

We definitely need to move to the next-generation solutions because these days attacks are pretty intense, and the traditional antivirus solutions are not going to stop them. CrowdStrike gives a proper security block. It is a 100% protector. 

There was a customer who was impacted by ransomware. We put SentinelOne over there, and we were able to catch the file that their antivirus couldn't. These solutions are 100% reliable and definitely good for any company that wants their enterprise to be protected on the endpoints. 

I would rate CrowdStrike Falcon Complete an eight out of ten.

We primarily use the solution for endpoint security. It is a very important aspect of security for us as the threat landscape is growing. There constantly needs to be better monitors of the activity on the endpoints and windows server. That's the main driver behind using this solution.

The AI and the group knowledge base that they get from having multiple clients in the cloud is very useful to us. It helps keep us safe from attacks as it allows them to apply a broader knowledge base to our protection for our company.

The solution doesn't actually scan desktops. They prevent execution and they do a very, very, very good job at that. However, if there is malware, et cetera, on an endpoint, there's not a scan feature to simply remove it. You have to go in and clean the registry and do the other stuff yourself. It would be ideal if there was some sort of scanning functionality built-in.

The logging features aren't robust and the information isn't kept long enough. The active logs are only retained for seven days. It would be better if it was available for, let's say, 30 days. If we were going to do any forensics, we would have the time to execute them.

We have been using the solution for about two years at this point. We plan to use it at least until the end of this year. It hasn't been very long.

We have looked at Carbon Black previously, as well as Cybereason. We were looking for alternatives to Crowdstrike, however, we decided we would keep this solution until the end of the year.

The reason we didn't switch yet is mostly due to time constraints. We had to renew or implement a new solution and it wasn't going to happen in the timeframe we were looking at. Therefore, we had to put it off. 

The Carbon Black is not as advanced as CrowdStrike. Also, Cybereason lags too far behind on Mac OS upgrades. We wouldn't have been able to roll out Cybereason, even though it looks like a very good product, as it didn't support Big Sur and wouldn't for another five or six months, which meant we would have machines that wouldn't be covered

We are a customer and an end-user of the product. We don't have a business relationship of any kind with Crowdstrike.

The solution is deployed from the cloud. We put it on our endpoints, however, the core application is in CrowdStrike's cloud. It's a cloud app.

Overall, I would rate the solution at a seven out of ten.

Our primary use case is an ordinary antivirus. We also use it to watch the activity on the machine.

It has good visibility, works well, and it is fast.

It is easy to see what is happening and the reporting is good, although I still don't understand everything. We are still trying to understand all of the information that we receive. When a problem is being investigated, the product does a deep inspection and this is something that we really like. You can see things like which file is connected with which services. The deep inspection is something that we don't have in any other of our other tools.

The central console is good and it is easy to work with.

This product is easy to maintain on a daily basis.

There are some parts of this solution that are too slow. The performance slows down by between 10% and 40%, depending on what type of work the machine is doing. For example, we had to shut down our backup because it was too slow and it started to overlap with other tasks. We did not try to use our SQL database because there was too much of an impact. This is not on the network but on the machine and even a few percentage points difference is significant for us because of the volume of transactions.

 Integration slows down the system a bit.

I would like to have an alternate dashboard view, which is somewhat simpler. The one it presents now is like Splunk, and it is very good, but it would be helpful to have a simpler one that only shows the basics like what you have and what it has found. As it is now, it takes time to get used to it. After a while, it won't be a problem for me or other users in the company. When you're working with a regular antivirus, it is much easier to set up and start using.

We have been working with CrowdStrike Falcon Complete for two months. We are still deploying and integrating it into our environment.

Because we are still in the process of initial integration, it is our partner who is in contact with technical support. We're still waiting for them to answer with respect to one issue, and now after waiting for two weeks, I cannot say that I'm very happy with that. However, given that it is the holiday season, it's pretty understandable.

I expect that it will be complete in January when we are fully operational. During New Year and Christmas, it is a bit of a lazy time for everybody.

We have several solutions in place. We have a firewall, antivirus, and email antivirus systems, and there are still things that pass through. This product is our fourth layer of defense.

The initial setup was straightforward for us because we had assistance. On our own, this would not have been as easy.

We had CrowdStrike partners who assisted us with the implementation. They asked us things like what should be protected and what should not be. It was a lot of work for our partner to complete the deployment.

At approximately €60 per machine, per year, I think that it's a good price point. When you compare this to Windows Defender for Endpoints, the price of that solution is about €50 Euro per month per user.

There are people who spend a lot of time trying to find the right price to sell new products at, so I always think that people know the value of their product and what price they can sell it at.

Every solution has pros and cons. I don't see anything that is more advanced than other solutions, and it's just an ordinary spy product. I have to wait for some time to see how well it works in the real world, but it finds some malware and it finds some things that pass through as normal. 

At this point in time, I can't yet say for the general case whether I would recommend this product. We are still having a problem with the slowness and the impact on the performance of the system. For workstations or servers that do not have a high load on them, I would certainly recommend buying it. In our case, we had to remove it from our backup servers. So, if you're already using a backup, or hosting servers for VMware or Hyper-V, or using a SQL database, then you should consider testing it first. I'm still not sure what will happen in our case.

At this point, I cannot rate it an eight or higher because we still don't have an answer on improving the performance. If ultimately they resolve our problem then I would rate this solution an eight or a nine out of ten.

I would rate this solution a seven out of ten.