CrowdStrike Falcon Reviews

My main use case for CrowdStrike Falcon is endpoint detection. I want to ensure that all of our endpoints are protected and detect any malicious activity or any unauthorized activity on our endpoints for endpoint detection in my day-to-day work.

We have recently started using Identity Protection next to CrowdStrike Falcon EDR, We also use the next-gen SIEM a little bit, primarily during incidents to look for evidence on CrowdStrike.

We are not using AI much within CrowdStrike Falcon, apart from a little bit of Charlotte, but I am planning to explore that avenue further.

My use of CrowdStrike Falcon has expanded since the initial deployment with additions such as Identity Protection and firewalls.

Since implementing CrowdStrike Falcon, we do feel safer, as we detect unauthorized activities and can react quickly.

Although I do not have the numbers, I can say that when we have an incident, we see the processes, the graph, the timelines, and the adversary's actions, allowing us to make quick decisions and contain the device then and there.

Using CrowdStrike Falcon made our life much easier because we now have one place for the endpoints where we can go and find all the answers that we need.

We had an incident involving aphishing ; we looked at the files and discovered it was a Microsoft OneDrive link and users download the malicious file and executing a script. CrowdStrike Falcon not only prevented it but also helped us trace it back to that link, enabling us to understand where it came from, stopping access at that level, and preventing the script from running saved us massively.

We are a very small team, and CrowdStrike Falcon is a real help, with automation being a key factor that helps us leverage our limited resources to take more action despite having fewer people.

CrowdStrike Falcon offers very good protection, and I will see all the information in one place, which is quite handy and reliable.

When I say all the information is in one place, it helps us in practice because we see all the processes and activities on the endpoints related to an event or incident, and we can pivot to see more data by going deep into the data available and exported from the endpoint.

The detection capabilities are really good, as it understands the behavior of Windows machines, although it is not as great on Mac OS and Linux.

I really appreciate the identity part, which fits nicely with our endpoint detection using CrowdStrike Falcon EDR, and I see some benefits already from deploying it recently, allowing me to trace back from one identity to one endpoint and back again.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that it understands detection and response exceptionally well, proven by its good telemetry collection and actionable insights, so I do not have to worry about creating detection rules, with fewer false positives than other platforms.

I think CrowdStrike Falcon UI is a little bit slow to react and they keep moving the options and modules. we have to jump from one module to another this is a real painn requiring multiple tabs open for investigations. It would be easier if it consolidated the information on one page instead of opening new tabs in the browser.

Session timeout bothers us because investigations sometimes take time, and when we jump to another platform to continue, our session expires and all of tabs are time out. If I have not tagged or saved them, I have to redo that work, which occurs quite often.

So far, I have mix feeling about Charlotte AI, sometimes makes mistakes and misses context, however it never forget to consume tokens, which affects its reliability.

CrowdStrike has expanded far beyond what we were used to in traditional securitydetection and response now it needs to be more easily accessible, and we should not have to jump into so many modules and hopes to complete an investigation

CrowdStrike Falcon itself does not pose a problem regarding endpoint performance; it reliable and doesn't spike the device performance. However, the device control related to USB blocking is a significant challenge for us, it defiantly requiring improvement, as it mistakenly disables usb cameras and is difficult to track in logs. CrowdStrike claims it has not blocked anything, yet the USB and camera non-functionality persists until removal of CrowdStrike.

I have used CrowdStrike Falcon since three years ago in my recent job, although I have used CrowdStrike Falcon well from my previous roles since 2018.

CrowdStrike Falcon is stable in my experience, with only one significant glitch and the persistent USB issue, but otherwise it works well.

CrowdStrike Falcon's scalability allows for easy scaling without issues.

Customer support with CrowdStrike is very poor; they often respond with scripted answers, as it has become an AI chat support system made it even worse. Overall, it does not provide a great experience, especially with sales and support staff not being attentive,

When you have issue take time to explain it to them and then they say ohh it's over 7 days we don't have logs. That usb issues, every time they ask for logs but nothing comes out of it. I have stopped raising issues it to them unless if we are really need them

We previously used another ePO EDR, ; it was challenging with detections and due to false positives. managing exclusions was time-consuming This inefficiency is why we made the switch.

CrowdStrike Falcon is deployed in our organization on a public cloud, where we have our own tenants.

No you can do it yourself, but spend time configuring all policies, integration and automation  before leave it to run on it own

Although I cannot provide solid metrics on return on investment, I can say that I have a small team and definitely need CrowdStrike Falcon, so I cannot get away from it.

We have an enterprise contract, as the parent company purchased CrowdStrike.

It is really good to have multiple capabilities on a single platform, but when they are fragmented into different modules and sold at a very expensive rate, people end up having one or two modules and miss out on the holistic approach that CrowdStrike Falcon offers. I think an endpoint should be an endpoint, regardless of being in the cloud or on-prem, Crowdstrike consider a container a different cost, so is the cloud, and endpoints, and mobile; this approach makes it difficult as we have to pick and choose. That's not included other modules, 

I believe those that are related to security operation and detection and reaponse all should be part of same package, although I understand some modules such as AI, cloud config posture, and vulnerability can be different

Licensing is a real challenge with CrowdStrike Falcon, as it is the main reason that makes us reconsider moving further with it new capabilities.

Defender was another option we considered. We found Crowdstrike was much easier to work with and navigate and information were presented much clearer. 

I rate it an eight because, it's a very high and respectable number,  in terms of technology, CrowdStrike Falcon focus primarily at endpoints, believing everything evolves from there. However, we do have network activities that CrowdStrike Falcon does not account for, which makes it a bit difficult to rate it a ten; it is not all-encompassing, but it is really good.

The AI capabilities of CrowdStrike Falcon are new, so I need to use this to get more insight. From what I have seen, it is interesting, but I will see how it evolves.

I have not consolidated or replaced other security tools with CrowdStrike Falcon, as not much has been done in that area.

My advice for others looking into using CrowdStrike Falcon is to invest time and money to customise the platform so that it can work cohesively across different modules, ensuring it is not just a single alerting tool but rather an integrated system that correlates data and reaponse across the enterprise.

Our main use cases for CrowdStrike Falcon are endpoint security and USB access, with endpoint security being our primary focus.

I can describe a security incident where CrowdStrike Falcon helped my team detect and stop a threat. One of our IT help desk analysts downloaded a BIOS update from Dell without realizing it contained a critical vulnerability. CrowdStrike Falcon helped us block that download and alerted us to investigate it. We were able to follow up, see what process was running, and determine that our analyst needed to double-check that we were downloading and uploading up-to-date BIOS updates.

My use of CrowdStrike Falcon has expanded since my initial deployment from endpoint security to USB access. We were initially managing USB access through GPO, but we decided to transition to CrowdStrike Falcon because it provided us with greater visibility.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats because it gives us a lot of granularity on what goes on, what processes are being run, and what is actually being executed if anyone is trying to get onto our endpoints.

The benefits I have seen from having multiple security capabilities on a single platform is that it gives us more tools to investigate and specifically tells us what happened. Having all those tools at our disposal gives us the benefit of knowing exactly what happened, what time it happened, and what process or executable was being run.

The value I have seen from having endpoint identity, cloud, and other security telemetry in CrowdStrike Falcon is that it is good to have it all consolidated in one platform so we do not have to deal with logging in and going to multiple different sources. It is all consolidated, so it is good to have one platform that we can go to.

CrowdStrike Falcon has affected the workload or productivity of my security team by simplifying it significantly. It also gives us the flexibility to simplify our processes, but if we want to get granular, we can go in deeper, investigate, and get down to the details.

We are not currently using AI within CrowdStrike Falcon, but that is definitely something that we want to explore further because we know that CrowdStrike values the discovery of AI and ensuring you have full coverage.

CrowdStrike Falcon can be improved by strengthening the focus on AI and keeping up with responding to AI as it constantly evolves. It would be beneficial to have more information on that.

I have been using CrowdStrike Falcon for about eight months, ever since I started at Royal Business Bank back in January, and it has been really good to us so far.

I would assess the stability and reliability of CrowdStrike Falcon as very reliable. A lot of the information they provide us is accurate and delivered in real-time.

I have not experienced any downtime, crashes, or performance issues with CrowdStrike Falcon.

CrowdStrike Falcon has had a positive impact on endpoint performance and my ability to deploy security at scale. Everything has been smooth and happens autonomously. We do not have to be closely monitoring the sensor updates that get deployed. The simplicity of the process is a major advantage.

I would evaluate customer service and technical support as really good. They are very fast and usually respond within a few hours, providing us with all the information we need, including documentation, notes, and action items we need to take.

CrowdStrike Falcon has allowed us to consolidate or replace other security tools. We have had a few security tools that were redundant, and it helped us with the cost benefit of cutting those off and consolidating everything into one security tool.

We decided to cut Darktrace and stick with CrowdStrike Falcon because we realized we do not really need two platforms for the same process. Darktrace is more of a network security platform, and CrowdStrike Falcon does a little bit of both.

I would describe my experience with deploying CrowdStrike Falcon as good and simple. It has been really easy to deploy out, and if I ever need anything, the support is always really good.

What worked well during deployment was that CrowdStrike Falcon was really responsive when we faced some challenges with a recent Dell BIOS update that they were flagging. It created a lot of noise for us, but CrowdStrike Falcon had documentation on that specific type of update and let us know the response action that we needed to take.

I have seen a return on investment with CrowdStrike Falcon. The business has definitely seen a significant investment in it, particularly with the amount of visibility and the ability to triage and manage alerts that we now have.

My experience with pricing, setup cost, and licensing has been good with no complaints. It has been really simple, and they have been very honest and willing to work with us.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is the comparison with Arctic Wolf, which is a managed detection and response platform. The main difference was the granularity and the ability to give us more data to read and analyze.

I would rate CrowdStrike Falcon overall as a nine out of ten because it is a really good tool, and obviously nothing is perfect, but it is definitely a big player in the security industry. I would advise other organizations considering CrowdStrike Falcon that if you want to get more visibility and more data, then CrowdStrike Falcon is definitely something you should consider. I think their customer support is really good and their agents are very professional and smooth. If you are ever looking for more granular insights, CrowdStrike Falcon is the way to go.

My main use case for CrowdStrike Falcon is endpoint detection for the most part.

The other part would be all the other capabilities that we use it for, such as identity, detection, policies, response, RTR, and forensics.

The benefits I've seen from having multiple security capabilities on a single platform include a single pane of glass, the ability to contain, and eradicate threats easier.

The value I've seen from having endpoint, identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform makes it easy to use one path to focus on specific threats and be able to correlate them together, especially with advanced search and using the graph.

CrowdStrike Falcon has definitely decreased the workload and increased the productivity of my security team compared to if we were to use something else.

The Falcon sensor's impact on endpoint performance is that it does not necessarily affect it in a negative way; the agent does not. From a security perspective, it has a very high impact with ensuring things are secure.

The only downside is trying to figure out all the agents or all of the machines that do not have CrowdStrike Falcon on them, unlike SentinelOne which has a feature for that, along with a feature where you can roll back to detect ransomware if you ever get ransomware.

CrowdStrike Falcon can be improved by having the ability to scan the network to determine what machines do not have CrowdStrike Falcon on, which is a big one, and having the ability to roll back from the volume image if you get encrypted. Other than that, it is pretty solid; you have a monopoly on the field as of now.

I have been using CrowdStrike Falcon for seven or eight years.

I would assess the stability and reliability of CrowdStrike Falcon as a 10 out of 10.

I have not experienced any downtime, crashes, or performance issues with CrowdStrike Falcon.

My use of CrowdStrike Falcon platform has expanded significantly since my initial deployment; I started with Falcon when I worked for the government and then moved to the private sector. As an incident responder, the majority of clients did not have Falcon, and that is when I got compromised. After we installed Falcon, it made life much easier for them. As times changed, Falcon has come a long way from where it first started; I believe you switched your query language to make it faster, as one of the complaints back then was that it was too slow. Now it is much faster and scales at a large scale, so there are definitely many improvements since the first time I ever used it.

I would evaluate customer service and technical support as generally good, but we must mention 2024 because that was the issue with the blue screens; other than that, there were no other issues.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools; we replaced a couple when we added specific features.

One of the tools I replaced was Wiz; some of the Wiz sensors we replaced with CrowdStrike cloud Falcon sensor because it was cheaper, and then another one with Falcon Forensics would have been Axiom or FTK. However, we have a retainer, so we do not really dive into Falcon Forensics extensively. The identity one, I had a POC but did not prefer it for whatever reason, so I did not replace anything there that I can think of now.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that, from an EDR perspective, it has a tight grip on everything; in some aspects, such as Falcon Forensics, I have used Axiom in the past, and Axiom is probably better. For identity, there are better identity solutions out there, and for host management, Spotlight is one that we replaced Tenable with; it is pretty solid for vulnerability management, especially because it does automatic scanning. One challenge is trying to convince auditors that this is the solution now because they cannot keep up with the times. Overall, CrowdStrike Falcon is pretty amazing.

I would describe my experience with deploying CrowdStrike Falcon as pretty easy to deploy; I have not deployed it in a minute, but when I did, I just hooked it up in whatever automation platform the company at the time used and went from there.

In terms of deployment challenges, figuring out which machines do not have it is an issue I faced, while what worked well was being able to install it and having installers available for different operating systems, although legacy operating systems are difficult to get an installer for, such as 2008 and 2003.

I have seen return on investment with CrowdStrike Falcon.

Return on investment would be most likely just being able to consolidate tools; Spotlight was a big one, and asset discovery is a big one.

I do not deal with pricing, setup costs, and licensing, but I know that it is approximately 60 dollars per endpoint at MSRP, and they make deals based on that. Our sales reps are pretty good, so we just let the sales rep talk to us, and they sold us on it right there.

I would recommend CrowdStrike Falcon over Carbon Black, SentinelOne, Huntress, and any other main EDR solutions to another organization considering it.

The impact of Charlotte AI on my security operations is high from the perspective of being able to find things quicker, but if you ask it to do complex tasks, it is not necessarily the best. I would rate this review an 8 out of 10 overall.

My main use cases for CrowdStrike Falcon mostly center around their Falcon EDR offering and the suite around it, such as what used to be called Spotlight and Complete, OverWatch, and all those capabilities.

Using CrowdStrike Falcon has provided significantly more visibility than previous tools I used, as well as a more streamlined management of exceptions. There are fewer exceptions that are required for the sensor to run. It also runs significantly lighter than the previous providers that I have used in this space.

The benefits I have seen from having multiple security capabilities on a single platform are that it makes monitoring everything significantly easier. It significantly reduces the amount of time needed to do it. When I can see vulnerabilities as well as detections and identity risks all in one spot, it makes it significantly easier to manage and correlate events.

I have seen value from having endpoint, identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform. While we have not implemented cloud yet, having identity in the same platform has definitely helped me correlate events with potentially risky identities as well as see a path from potentially compromised devices to a higher privileged identity through having that link together.

I do not have much to offer regarding how CrowdStrike Falcon can be improved.

I have been using CrowdStrike Falcon for about three or four years.

I would assess the stability and reliability of CrowdStrike Falcon as very smooth. Outside of the one blackout we experienced, everything has been working well.

I have not experienced any downtime, crashes, or performance issues outside of that event.

The impact of the CrowdStrike Falcon sensor on endpoint performance and my ability to deploy security at scale has been positive. Considering that we transitioned from a previous provider and not from a blank slate that did not have an EDR on it, we saw performance improvements when implementing CrowdStrike Falcon on systems. It was also a very easy deployment, both through N-central and Amybot for at-scale deployments. It has been very efficient at doing so.

My evaluation of customer service and technical support has overall been fairly good. We were able to resolve a couple of tickets, both at the previous employer and at this one, very smoothly and fairly quickly.

I had previously been using SentinelOne EDR alongside another EDR for its network security aspect and compliance profiles. We have essentially been able to replace SentinelOne with CrowdStrike Falcon and still get all the same visibility that I needed.

My experience with deploying CrowdStrike Falcon was very simple and straightforward. The silent install worked well. I do not think it has failed, or if it has, it was in an extremely minimal amount of cases, especially relative to other deployments that needed significantly more handholding. The one sensor that gets installed across all systems, whether Windows end-user or server device, has made deployment very simple. Deployments on Mac and Linux have also been very problem-free.

I have seen return on investment with CrowdStrike Falcon. We have saved a lot of time and significantly reduced the resources we are using, both on servers and end-user devices, which certainly has increased productivity for everyone.

Regarding my experience with pricing, setup cost, and licensing, I can speak from different perspectives. At my previous employer, we were closer to a medium-sized business, and I could easily see the value of adding CrowdStrike Falcon. I can also discuss the perspective of smaller customers who find it challenging to motivate the acquisition of CrowdStrike Falcon due to higher pricing compared to other players in the field. However, we have been fairly successful so far. On bigger enterprises, there is a very easy way to show ROI and value in implementing CrowdStrike Falcon over a competitor.

I still need a separate vendor for next-gen firewalls, for example, which CrowdStrike Falcon does not provide. However, it has allowed me to definitely consolidate on the endpoint stack between compliance, vulnerability, and actual endpoint protection.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools significantly.

My advice to other organizations considering CrowdStrike Falcon is that if the organization has the size to seriously evaluate the Complete offer, the pricing difference is usually more than justified in acquiring it.

The impact on my security operations has been that it has made us more confident in the delivery of security, both within client environments and within our own.

Reducing the workload around it enables us to do more valuable work in that space and provide security that we feel is more adequate and that we are more confident in.

I can describe a security incident where CrowdStrike Falcon helped my team detect a threat. We had an issue with a stealer log that somehow ended up on a server machine, which we were able to trace back to the administrator who accidentally uploaded it through a Samba share.

I have given this review a rating of ten out of ten.

My main use case for CrowdStrike Falcon in my organization is exposure management.

CrowdStrike Falcon helps me manage asset exposure in my company mainly at the hardening level, specifically everything related to compliance and security controls with CIS frameworks for our operating systems.

Since the initial deployment, my use of CrowdStrike Falcon has evolved within my organization as we have added modules over time.

CrowdStrike Falcon has had a positive impact on my organization as it allowed us to understand all the controls and the compliance of our environment, identifying where we were on day one, following the review of the controls and the implementation in audit mode.

When a new CIS framework came out, a new version depending on the OS, having the control implemented in CrowdStrike Falcon within two months was very good, allowing us to raise compliance in line with the new OS at the same time.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats, as it works really well through alerts and collects everything we have put in place.

CrowdStrike Falcon helped my team detect a security incident involving the installation of malicious software on a workstation. My team immediately took charge of the detection, analyzed it, and we remediated the malware on the employee's workstation directly.

CrowdStrike Falcon has impacted the workload of my security team by initially increasing it, but eventually reducing it over time because the analysis became easier when there were alerts and incidents.

The best features CrowdStrike Falcon offers easily show me where the controls have failed as well as the controls that have passed, allowing me to know by OS which controls are passing across all our operating systems, whether Windows 10, 11, or Windows Server.

This visibility into the controls helps us concretely on a daily basis in security decision-making as it lets us see if our Golden Images are compliant from the start and if changes have been made by a user or a system admin, enabling us to catch the gap afterwards.

The advantages I have seen from consolidating multiple security capabilities on a single platform like CrowdStrike Falcon are that everything is in the same place, it is easy, and everything communicates well with each other, allowing us to have end-to-end coverage of all the products CrowdStrike offers.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated in the past is mainly its forward-looking approach, as they have quite ambitious roadmaps that are very interesting.

A big improvement is needed around dashboards, specifically to have an executive dashboard as the current one is very technical but lacking at the executive level.

I mainly want to see improvements in the customization of dashboards, particularly a more graphical display, and I would like to see trends over time regarding SLAs, such as how long it took before an AM put a control in place or how long it took before the control reached an X percentage. I find CrowdStrike Falcon pretty fast for speed and would appreciate a bit more choice in reports.

I have been using CrowdStrike Falcon for almost two years.

I find CrowdStrike Falcon stable.

I would rate CrowdStrike Falcon's scalability as very good.

I rate CrowdStrike Falcon's customer support as excellent.

CrowdStrike Falcon allowed us to consolidate or replace other security tools, specifically replacing Symantec, which was aging and less interesting.

Before using CrowdStrike Falcon, we had MDE in place, so we added CrowdStrike Falcon as a second EDR.

CrowdStrike Falcon is deployed within my organization using both private cloud and on-premises infrastructure.

We use AWS as our private cloud provider to host CrowdStrike Falcon.

The impact of the CrowdStrike Falcon sensor on endpoint performance and on my ability to deploy security at scale across the organization has not been significant; it was just longer to deploy given the size of the company.

My experience with CrowdStrike Falcon's pricing, implementation costs, and licensing has been within the normal range.

I give CrowdStrike Falcon a rating of 9 out of 10.

I choose this rating of 9 because of the dashboard.

Regarding CrowdStrike Falcon's artificial intelligence capabilities, I am not currently using it, but we want to look into moving forward with that. From what I have seen regarding the reliability and accuracy of the results generated by AI in CrowdStrike Falcon, I think it is fine and really good.

My advice to others considering using CrowdStrike Falcon is to get demos, talk to the representatives, ask your questions, be well prepared, and evaluate everything.

My main use case for this platform is that it is strictly EDR.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by giving my team a single source outside of our SIEM to be able to quickly and easily drill into the incident and understand what the alert from our SIEM actually means. It gives us a good spot to put integrations all in one location for our other platforms that we use, to bring everything into that single pane of glass and make it easy to use.

The benefits I have seen from having multiple security capabilities on a single CrowdStrike Falcon platform is that it is a good way to collapse down a bunch of disparate vendors and move everything into that single pane of glass. I do not have a lot of additional complexity in managing a bunch of separate vendors. Different capabilities, even if a separate vendor may have a slight edge, we will still likely consider rolling that into CrowdStrike.

CrowdStrike Falcon has affected the workload and productivity of my security team by allowing us to spend less time on our investigations because we have a single pane of glass, and that frees them up to work on our actual project work and other things that are probably higher value.

In my opinion, CrowdStrike Falcon platform can be improved by adding the improvements, functionality, or features that we would to see, which have actually been announced already, and that is the Guardian platform for AI. Using it to monitor agents now because it is going to be built into the endpoint, built into the sensor itself, being able to understand prompts, and then be able to see what agents are doing and how they are affecting identity usage. All of that is what we had on our wish list. We could look at a third party, but I would really prefer it be built into CrowdStrike.

The impact that the CrowdStrike Falcon sensor has had on endpoint performance and our ability to deploy security at scale is that the only noticeable impact was the CrowdStrike outage. On a day-to-day use case, I do not think we have ever found the CrowdStrike client to actually cause any sort of real major impact.

Since my initial deployment, my use of CrowdStrike Falcon platform has not expanded, but I think it will be expanding with some of the announcements from Fal.Con.

I would assess the stability and reliability of CrowdStrike Falcon and its agent as being great. With the exception of the CrowdStrike outage, it has not been one of our platforms that has required a lot of additional care and feeding. Although after the CrowdStrike outage and blue screens, we have had to put in place additional controls to ensure that we have phased rollouts. It would be nice if we could more easily or more automatically have a little more granularity and control to get rid of some of my board processes and governance that I have had to set up around that. Outside of that, it is a very stable platform.

I am not planning to expand the number of deployments, but I will expand the feature set and use cases.

I would evaluate CrowdStrike's technical and customer support as excellent. We have never had a problem. At the enterprise level, we are probably a very large account, and so I have access to anybody that I need to talk to. There are no issues. We have never had any issues where we have had a question that was not able to get resolved.

The other security tools I have used or evaluated include Microsoft Defender, McAfee, and Carbon Black. Those are the main ones that I have looked at.

My experience with deploying CrowdStrike Falcon is that I was not around for the deployment, but I have never heard of anybody complaining about how the deployment went.

I would say I have not seen a return on my investment with CrowdStrike Falcon, but that is only because it is not really something that we were looking for a return on. We were solving a problem. There was not a financial bet. The return would be freeing up my team, so maybe from a time perspective, that would be where I would put it. It would be difficult to quantify. The fact that it is easier to manage than the competitors is valuable. We also have Trellix in our environment just because that is the only thing that the vendors that we have to deploy it to support. That is a very small subset of infrastructure, and my team has to spend more time messing around with that than we have to spend on CrowdStrike.

In terms of my experience with pricing, set up costs, and licensing, I do not have any feedback that is under my purview. The only feedback that I would have there is it would be amazing if we could get a much better breakdown of all the SKUs and our entitlements, current entitlements, and costs for additional entitlements. There is a lot of opportunity there, but that is not specific to CrowdStrike. That is most places in the enterprise world.

What differentiates CrowdStrike Falcon platform from other cybersecurity platforms I have used or evaluated is that the biggest differentiator is the super lightweight client. The other differentiator is probably the breadth of functionality that is available if we wanted to buy it. Having it all in that one spot versus Trellix, Microsoft Defender, or something else, I would still have to buy a bunch of other third-party vendor products to fill in the holes in those spaces. It is nice to have that all-in-one, very lightweight client that is easy for my team to use.

A security incident where CrowdStrike Falcon helped my team detect or stop a threat is that we have very few of those. We have a lot of false positives. We run a very conservative point of view on our alerting and so we want to see everything. We have not had a really a true positive. To be clear, this is in our business servers and our OT environments, not our endpoints. Somebody else handles our endpoints with CrowdStrike. There are true positives in there, but since we do not really have true positives in our business environment, it gives us a good way to very quickly rule out those false positives.

I have plugged in six or seven other platforms into CrowdStrike Falcon platform.

The value I see from having endpoint, identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is really not having to go into all of our other platforms to see that data.

On an individual incident, I estimate it probably saves each individual analyst 15 or 20 minutes.

I handle probably 10 to 15 incidents in a day.

My advice to someone who is evaluating this platform based on my experience with it is to run demos. It is pretty easy to get set up. It is easy to run. Ensure that it integrates with all of your platforms. Make sure you get really close with your account team. I would rate this platform a 9 out of 10 based on my overall experience.

My main use cases for CrowdStrike Falcon involve protecting all our endpoints and all our servers. CrowdStrike Falcon has allowed me to consolidate or replace other security tools.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats because we feel a lot more secure as it is very good at stopping threats. It makes it very easy to investigate what happened and what triggered the event. Our response time is a little better when we have to actually dig into something.

The benefits I have seen from having multiple security capabilities on a single platform include that it makes it much easier to get to what I need quickly instead of trying to switch platforms. Sometimes switching between modules, the interface is not always the same and does not feel the same. However, largely it is usually very together and it works well.

The value I have seen from having endpoint identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is that if we do have to open up other security tools, sometimes we can leverage what CrowdStrike Falcon sees to quickly get to what is another security tool because it exposes that information.

Using CrowdStrike Falcon has affected the workload or productivity of my security team because in a lot of ways it has actually lowered the workload as it does such a good job of preventing the threats. If something triggers on another system but CrowdStrike Falcon is not triggering it, we are automatically suspect whether it is a real problem.

I have not yet used AI within CrowdStrike Falcon. I cannot think of a way that CrowdStrike Falcon itself can be improved. I do not have any suggestions for additional features that should be included in the next release for CrowdStrike Falcon as it does a very good job by itself.

I have been using CrowdStrike Falcon for about six years.

I would assess the stability and reliability of CrowdStrike Falcon as being awesome, other than the great CrowdStriking. I have experienced downtime, crashes, or performance issues.

The detail I can provide about the performance issues involves the same traumatic thing everyone has gone through, which is the great CrowdStriking. It was bad; I am a casino, so this was on a weekend, overnight.

I have not noticed any impact on performance from the CrowdStrike Falcon sensor regarding endpoint performance and my ability to deploy security at scale.

I would evaluate customer service and technical support by saying that every time I have had to access it, they have been very good.

We used to use Bitdefender and it was not awesome, so we replaced it. We also have replaced some SIEM and some other detective systems with CrowdStrike Falcon.

I would describe my experience with deploying CrowdStrike Falcon as very easy. We have Active Directory, so we just deploy with Active Directory and it works very well. What worked well during the deployment was that it just worked, so there were not really a lot of challenges. It was configure this in Active Directory, deploy it, and it works.

My use of CrowdStrike Falcon has expanded since the initial deployment as we started off with just workstations and now it is deployed to every surface we can get it on.

I believe I have seen a return on investment with CrowdStrike Falcon as I honestly believe it has saved us money and stopped threats.

My experience with pricing, setup costs, and licensing is that everybody complains about pricing. I am not going to be that much different, but they are not outrageous, and I have dealt with companies that are outrageous. On a scale of one to 10, one being really super affordable and 10 being Palo Alto, I would say it is a seven or an eight.

What differentiates CrowdStrike Falcon from the other cybersecurity platforms I have used or evaluated is that the biggest differentiator is that it does not, to me, at the time when we got it, rely on knowing what the bad threat is. It sees the action of the threat and relies on that, so there are no signatures required and that is a pretty big deal.

My advice for other organizations considering CrowdStrike Falcon is that it is worthwhile to test drive and compare it to other systems. I give this review a rating of 9.

My main use cases for CrowdStrike Falcon involve everything security. In more detail, we use Falcon Complete to ensure our users are completely covered.

The benefits I have seen from having multiple security capabilities on a single platform are significant because we do not have to go to different types of portals to get any kind of access; it is all in one. CrowdStrike is actually taking care of everything on the back end, so we do not have to worry about trying to go from one thing to another to figure out what is going on within our environment.

The value I have seen from having endpoint identity, cloud, and other security telemetry in the same Falcon platform is significant because it is a one-stop shop that eliminates the need to go from one to another; it is all in one console.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats because we use Falcon Complete, which means the majority of it is that we do not have to constantly monitor everything that is going on. Falcon Complete actually monitors that for us, and when things do pop up, we are literally just reaching out to our users and following up after the fact of everything that Falcon Complete has done to remediate the issues.

CrowdStrike Falcon has drastically reduced the workload and increased the productivity of my security team.

The impact of the Falcon sensor on endpoint performance and my ability to deploy security at scale is zero; it is very easy with no impact whatsoever since it is very lightweight.

CrowdStrike Falcon can be improved by continuing to adapt to everything that is going on with AI and other developments in the world.

The one improvement I would suggest for the future is to make the console side of CrowdStrike Falcon more user-friendly, but as explained, most of those details are not things we need to worry about because those are things that Falcon Complete takes care of; overall, it is all good.

I have been using CrowdStrike Falcon for four years.

Outside of the blue screen week, I have experienced really no downtime, crashes, or performance issues; the security factor of it all is top-notch.

I would assess the stability and reliability of CrowdStrike Falcon as really, really top-notch.

The impact of the Falcon sensor on endpoint performance and my ability to deploy security at scale is zero; it is very easy with no impact whatsoever since it is very lightweight.

I would evaluate customer service and technical support as still top-notch.

The tools I used previously included Trend Micro, and we were also using Proofpoint for a lot of things; much of that has been able to be consolidated into CrowdStrike Falcon, allowing us not to use those products anymore, making it feel like one console to do two things.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that we used Trend Micro before, and their team was nowhere near as experienced or available to us, nor were they collaborative to ensure that anything that happened was at zero trust. We were able to get most attacks handled within the first few minutes before anything abruptly took place.

I would describe my experience with deploying CrowdStrike Falcon as easy, super easy.

What worked during deployment was literally zero challenges; the biggest thing was when we went from Trend to CrowdStrike Falcon, where CrowdStrike Falcon did not care if Trend was installed, and they just took over management of everything. After that, it was just up to us to get rid of Trend Micro from all the machines that had it installed.

I have seen return on investment with CrowdStrike Falcon absolutely.

The data points or examples I can share are the many times we have almost had ransom attacks on our systems, and all of them have been stopped.

My experience with pricing, setup costs, and licensing has been very good and very easy.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools, and that is all we have been using.

The advice I would give to other organizations considering CrowdStrike Falcon is that if you are really worried about the cost of it, it is worth it.

I am using AI within CrowdStrike Falcon for deep security issues, but to be honest, we do not use it completely; we really depend on Falcon Complete to do most of the work.

I really cannot think of how my use of CrowdStrike Falcon has expanded since my initial deployment.

My review rating for CrowdStrike Falcon is a 10.

My main use case for CrowdStrike Falcon is endpoint security, detection, and response.

Using CrowdStrike Falcon has significantly changed the way my security team detects, investigates, and responds to threats because the Falcon platform is a very good dashboard and platform. We have used other products before, and we are really happy with CrowdStrike because it is a very good product.

I can describe a security incident where CrowdStrike Falcon helped my team detect and stop a threat. We had Ukrainian assets in our tenant where Ukrainian colleagues had a web server that was reachable from the internet. The web server was bound to the Active Directory environment of Ukraine, and they did not notice that someone was brute forcing the website. CrowdStrike alerted us because so many failed logins occurred, and we informed the Ukrainian colleagues who then took the website offline, which stopped the backdoor.

CrowdStrike Falcon has significantly affected the workload and productivity of my security team by improving efficiency through good notification automation, good response automation, a good overview of detections and incidents, and the ability to get information fast and react faster.

I have seen significant benefits from having multiple security capabilities on a single CrowdStrike Falcon platform. I can use Fusion workflows, the investigation module, and the endpoint security dashboard to see exactly what happens over the last seven days, including the most common behaviors or tactics. This provides a good overview.

I see everything in one platform.

I have seen huge value from having endpoint, identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform because I can see all the data and all the information in one dashboard. I do not need to log in to multiple platforms, spend time logging in, or set up multiple users for different platforms. I have it all in one console.

The impact of CrowdStrike Falcon sensor on endpoint performance and my ability to deploy security at scale is significant. The Falcon sensor is a lightweight agent which, for my situation, is one of the best, if not the best sensor on the market. The footprint is very low, and the reaction is very fast. I really appreciate the connection between the sensor and the console because I have worked with many other products in the past, and CrowdStrike has the fastest communication between the sensor and the console.

It has the best reaction time, design, support, and functions in the console. The design is user-friendly.

In general, I do not have any improvement suggestions because I really appreciate CrowdStrike Falcon. I have worked with five vendors over the last 10 years, and CrowdStrike is definitely the best product we use.

I have been using CrowdStrike Falcon for three years.

I have expanded my usage of CrowdStrike Falcon since my initial deployment and have added more sensors. We have approximately 5,000 sensors in our environment, which is substantial.

If I worked with CrowdStrike support, I would evaluate them as good. I really appreciate them. The Israel team is also very good at their work. I have also worked with many people from the UK and Ireland. We also have our TAM who, if we have any trouble with support, which I have not experienced, I could always reach out to them and they would help us.

My experience deploying CrowdStrike Falcon went very well because CrowdStrike is easy to install and easy to set up. The most common difficulty was obtaining all assets, including notebooks that are in home offices or at home and not on the company network where I could easily connect and install the sensor. I needed to find a solution to reach the notebooks over the internet and install or uninstall the old solution and install CrowdStrike Falcon. During the time of uninstalling the old solution and installing CrowdStrike Falcon, I needed to remain protected at the highest level. However, this was not something CrowdStrike made difficult; it was more related to the environment.

I estimate that I have improved my productivity and saved time by 70 to 80% with CrowdStrike Falcon.

I would rate CrowdStrike Falcon as a definite 10 on a scale of one to 10.

I advise anyone evaluating to try CrowdStrike Falcon. CrowdStrike is a good tool with many things that I can test and see how they work. I recommend trying CrowdStrike Falcon because it is definitely the best product we have used in recent years.

My main use case for CrowdStrike Falcon at the moment is endpoint security, but we're trying to expand it out to the AI and Guardian.

Currently, we are using CrowdStrike Falcon for metrics, which is a bit different from the questions. We have to report our metrics back to our client, and obviously, we're using CrowdStrike Falcon to understand vulnerabilities on endpoints and what can be done to improve the security.

Regarding my main use case with CrowdStrike Falcon, we have daily vulnerability reports come through about the big use cases, which have obviously increased a lot now with AI and the dangers around it, highlighting what we need to do to protect ourselves. Every time one of these emails comes in, we check into CrowdStrike Falcon to ensure that vulnerability doesn't exist in our environment.

CrowdStrike Falcon has impacted our organization positively. It's hard to say given that we've been using it for such a long time now, but it's not really the benefits that we notice, more of just the day-to-day of not having the struggles of using other tools.

In terms of struggles faced with previous tools that I don't have now with CrowdStrike Falcon, there are definitely fewer user complaints. It's relatively simple to apply patches onto people's laptops where you just run scripts from CrowdStrike Falcon, allowing you to do whatever you want on people's laptops without having to start up a call with them to take over control.

Using CrowdStrike Falcon has changed the way our security team detects, investigates, and responds to threats. It's definitely our first point of contact when we get a threat or a known vulnerability to come through, as CrowdStrike Falcon is normally always the first place we check.

I can describe a recent security incident where CrowdStrike Falcon helped my team detect a threat. We received an email stating that a vulnerability had been discovered on a Linux server, and when we checked CrowdStrike Falcon, we saw that it was deployed on one of the servers running a version of the software impacted by the vulnerability, which allowed us to create the ticket for the engineering team within half an hour of starting to look.

The benefits of having multiple security capabilities on a single platform like CrowdStrike Falcon are significant. It's very nice not having to log into multiple applications and deal with MFA just to go somewhere that doesn't have the information you need and then having to go to a different application. Having it all in one place is very nice.

The value I see from having endpoint identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is very nice and easy to go to one place and have everything there.

CrowdStrike Falcon has affected the workload and productivity of my security team. We've always had it, so it's very hard to say if it's improved or made things worse, but not having something like CrowdStrike Falcon would definitely make everything a nightmare.

Currently, CrowdStrike Falcon hasn't allowed us to consolidate or replace other security tools, but we're hoping to look into getting Guardian, which will reduce the number of tools we need to accomplish the same thing.

In my experience, one of the best features CrowdStrike Falcon offers is how little the end users are impacted. Normally, a lot of endpoint devices get backlash from users either slowing down their laptops or annoying them with popups, but CrowdStrike Falcon just seems to work on people's laptops, and we very rarely get any instances of someone's laptop running slow because CrowdStrike Falcon is running.

The reporting features and vulnerability detection of CrowdStrike Falcon stand out to me. The vulnerability side is interesting, though we sometimes get worried about whether the numbers are accurate, which is something we're continuing to monitor to see if we can improve because we obviously have different endpoint tools that report one thing while CrowdStrike Falcon says another, but it's very helpful when we can confirm that the numbers are accurate or not when it comes to reporting.

CrowdStrike Falcon sensor has had nearly no impact on endpoint performance, as very rarely do we get someone saying that their laptop has slowed down because of CrowdStrike Falcon, which means we can be more confident deploying it to everyone.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I've used or evaluated is the fact that it isn't just a single tool. There are add-ons available, meaning all of your tools are on one platform.

To improve CrowdStrike Falcon, I think the UI is dreadful. It's such a pain, especially for someone that hasn't used it before, and if you show it in front of them, it'll take a lot of searching to get to the thing that they actually want.

The user interface is the main thing. We saw the demo for Guardian today, and the UI was clean and nice to look at, simple to use, and it turns into a case of wishing that CrowdStrike Falcon looked more than that.

The reason I rate it an eight is mainly just because of the UI. It takes a few weeks maybe to get very comfortable with the way it's laid out.

I have been using CrowdStrike Falcon personally in the company for nine months, as long as I've been there, but I think the company's been using it for a good few years.

I think CrowdStrike Falcon is stable.

Since our initial deployment, our use of CrowdStrike Falcon has expanded to many more endpoints and many more servers, and there's much less worry in doing that.

In terms of scalability, CrowdStrike Falcon is pretty good and very easy to get onto different endpoints. I think it's just as simple as pressing a button and installing it onto a new device.

Our customer support experience has been that our account manager is really good. He's always reaching out to ensure we're getting the most out of it, though we've never actually used, or very rarely use, the customer support at crowdstrike.co.uk.

It's hard to say if we've seen a return on investment, as we're already a very small team, but there may be a saving in that sense since we haven't needed to hire anyone else because we use this, though there are no metrics to back that up.

My experience with pricing, setup cost, and licensing for CrowdStrike Falcon has been that it is expensive, but that's what you would expect.

On a scale of 1 to 10, I would rate CrowdStrike Falcon an eight.

CrowdStrike Falcon is deployed in our organization on the public cloud and also on all endpoints.

We use GCP as our cloud provider.

My advice for others looking into using CrowdStrike Falcon is that it's definitely worth it, but it's a big tool that can do a lot, so make sure you have a scoped plan out before you jump in, otherwise you'll get consumed by how much it can do.