CrowdStrike Falcon Reviews

My primary use case for CrowdStrike Falcon is using it to find detections, review them, and depending on what comes out, either pass it on to the Incident Response team or create opportunities or hypotheses of compromise if I am looking for suspicious patterns.

I have a concrete example of how I use CrowdStrike Falcon in my day-to-day work to investigate or detect threats. I have my own project in which, through the API, I acquire information from CrowdStrike Falcon, specifically detections or telemetry, and based on that I can create my own use cases to find suspicious activity or create a baseline of what is normal and what might be highly anomalous within the company.

I use artificial intelligence within CrowdStrike Falcon at specific times to gain one-off experience or expertise when analyzing malware or making a decision, but not much more.

My use of CrowdStrike Falcon has evolved since the initial deployment with an increase in the acquisition of modules and in the speed of response to any threat, though I have not been here since the beginning.

CrowdStrike Falcon has positively impacted my organization significantly, as it has greatly reduced compromises, increased early detection, and in the end, allowed us to respond and prevent before an attacker can achieve any objective.

The use of CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats quite correctly; it works very well and has not posed any obstacle.

CrowdStrike Falcon helps us in all phases to at least be able to detect threats and proceed to block it if CrowdStrike Falcon did not block it before, allowing us to respond before there is any kind of damage, which has never happened.

The benefits I have observed from having multiple security capabilities integrated into a single platform like CrowdStrike Falcon include a reduction in response time, an increase in detection speed, and a reduction in compromises.

The value I have observed from having identity, endpoints, cloud and other security data integrated in the same CrowdStrike Falcon platform is unclear to me, but I have nothing negative to say.

CrowdStrike Falcon has impacted the workload or productivity of my security team by reducing the workload and improving the speed of acting against a threat.

I consider the best features that CrowdStrike Falcon offers to be the intelligence and the dataset behind it, as it is capable of detecting and often anticipating a possible incident by detecting and finding anything suspicious based on its rules and behavior. From there it can activate the corresponding team to prevent it from happening again, create detections, and respond before it escalates.

Regarding intelligence and anticipation capabilities, I do not consider there to be any specific feature or integration that I find especially valuable in my daily experience, since being able to access it through the API allows us to collect all the information and build our own use cases and enrich with external sources.

The forensics module is something I find very useful in CrowdStrike Falcon. I have my own project where it is a Continuous Compromise Assessment, and from there I can start in different phases looking for IOCs and past compromises even from before the sensor was deployed. From there I also create a baseline by finding autoruns, scheduled tasks, anomalous services or users, doing data stacking, and even being able to run YARA across the entire fleet of machines to find everything that CrowdStrike Falcon was not able to detect before it was installed.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is the telemetry, the unification of different modules, and the reliability the tool provides in the face of suspicious behavior of a possible incident.

It was a matter of exploring what capabilities the forensics module had and how far the reach goes, but I do miss being able to run or interact directly with Sigma rules.

A concrete example of improvement would be better review of the backend lag with the forensics module, since if a lot of machines are deployed, this lag issue appears and I have to open a ticket so they can review it, run the patch on the corresponding tenant, and get the forensics module working normally.

CrowdStrike Falcon could improve even more, but nothing comes to mind unless in the end there is a price reduction or an increase in Sharelock tokens, or that they can provide new features to their customers to test them before charging for them.

I have been using CrowdStrike Falcon for more than four years.

The impact that CrowdStrike Falcon sensor has had on endpoint performance and on the ability to deploy security at scale depends on which machine, service or server it is installed on. It is true that at certain times, due to a heavily used or highly loaded server, performance can be slightly affected.

I consider CrowdStrike Falcon to be a stable solution.

I view the scalability of CrowdStrike Falcon as good.

I would rate CrowdStrike Falcon's customer support as good, although sometimes it could be faster, depending on the criticality.

I would rate customer support on a scale from one to ten as an eight.

CrowdStrike Falcon has not allowed me to consolidate or replace other security tools since I joined, because it was already installed. However, it can replace any other EDR, since for me its detection and everything else is much better.

I have seen a return on investment with CrowdStrike Falcon. Although I do not have data, it is positive.

My experience with pricing, implementation cost and licensing has been that I do not know, but it has not been a problem.

On a scale from one to ten, I would rate CrowdStrike Falcon overall as a nine.

I give it a nine because I think it is up to the task. Even though sometimes it is not able to take certain actions, it is able to detect and provide visibility. The telemetry is quite complete, although it can always be improved.

CrowdStrike Falcon is deployed in my organization in a private cloud. As I understand it, we have our tenant and several tenants and from there it is installed across all our fleets.

For CrowdStrike Falcon, we use all the private cloud providers.

Regarding CrowdStrike Falcon's artificial intelligence capabilities, I do not know it, but I think it is good.

Regarding the accuracy and reliability of the results offered by CrowdStrike Falcon's artificial intelligence, I do not know, but I am going to give it a seven. I think it is quite good and although, as always, it can be improved.

The advice I would give to other companies that are considering using CrowdStrike Falcon is to give it a chance because it is worth it.

My main use cases for CrowdStrike Falcon are incident response to attacks, alerting, and threat intelligence.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by making our response time much quicker and giving me confidence in the alerts and information we receive.

Having endpoint, identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is much easier to manage since it all comes in through one platform, eliminating the need for cross-checking and making things much more efficient.

I have seen benefits from having multiple security capabilities on a single platform, particularly in identifying potential false positives or true positives where one system did not pick it up, and CrowdStrike Falcon did, ensuring our security.

CrowdStrike Falcon has definitely affected the workload and productivity of my security team by making us much more efficient, especially since we have a small team of only two people, which allows us to work much easier.

I believe CrowdStrike Falcon can be improved by continuing to keep up the good work, staying informed about global developments, and keeping us updated.

I would like to see additional features in the next release, such as SafeMind and further advancements in how AI is used to attack, react, and build defenses, which I think is terrific.

I have been using CrowdStrike Falcon for three and a half years.

I assess the stability and reliability of CrowdStrike Falcon as terrific since we have not had any issues; it is always running, with only occasional minor issues related to specific hardware.

I have experienced one instance of downtime where we had an update to a sensor that caused an issue with Microsoft, but we resolved it quickly.

The impact of the CrowdStrike Falcon sensor on endpoint performance and my ability to deploy security at scale has been great, with only one issue regarding a few machines where the sensor would not update, but for the most part, it has been great with very few issues.

I would evaluate customer service and technical support as great, with my current account representative being very responsive and no issues encountered.

Previously, we were using Microsoft Defender, which had some tuning issues and was harder to configure, but CrowdStrike Falcon has helped clean up some issues that we did not identify right away.

My experience with deploying CrowdStrike Falcon has been easy overall; every place I have used it has been fairly simple and quick, without any issues.

My experience regarding what worked well and the challenges I faced was more related to resources and getting other teams involved in the deployment rather than issues with CrowdStrike Falcon itself.

I have definitely seen a return on investment with CrowdStrike Falcon, making it easier for me to sleep at night, especially as we are a small organization that does not operate 24/7.

My experience with pricing, setup costs, and licensing has been simple and without any issues.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is its much easier usability compared to the past security platforms.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools, providing a secondary look at our current systems and a second set of eyes that verifies what I see, thus cutting down the need for additional security.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools, providing a secondary look at our current systems and a second set of eyes that verifies what I see, thus cutting down the need for additional security. I have given this review a rating of 9.

CrowdStrike Falcon serves as our main endpoint protection and vulnerability management solution, particularly for scanning. We deploy it across our environment using the MDR, endpoint protection, and SIM solution.

Due to our organization being very merger and acquisition heavy, one of our primary use cases is rapidly deploying CrowdStrike Falcon to all endpoints when we bring on a new organization.

The 24/7 monitoring through the MDR portion of CrowdStrike Falcon is very valuable, as my team is lean and cannot monitor all endpoints or alerts around the clock.

One of the best features that CrowdStrike Falcon offers is the Next-Gen SIM, which includes free daily ingest of up to 10 gigabytes per day. This feature stands out to me because it helps with costs and has helped me sell the product to leadership, since we were only adding an additional gigabyte for Falcon Complete to take over that portion of the SIM. The data that endpoints already feed back to the console is valuable in its own right.

I really appreciate the built-in connectors and dashboarding inside the console of CrowdStrike Falcon, which works very well when I need to send a report to leadership on sensor health. It is easy to use and straightforward to read.

CrowdStrike Falcon helps my security team quickly respond to alerts escalated from the Falcon Complete team and has minimized the business impact of potential compromises.

CrowdStrike Falcon has prevented many compromises in my organization, as there have been many detections on endpoints that Falcon has prevented from escalating.

The Falcon sensor has had a positive impact on endpoint performance and my ability to deploy security at scale.

The main complaint that myself and leadership have about CrowdStrike Falcon is that the cost has become expensive compared to competitors.

Cost is really the only significant area needing improvement for CrowdStrike Falcon. More direct connectors on the SIM side could be beneficial, but I am already quite satisfied with the current offerings, and I understand that some limitations depend on vendors rather than CrowdStrike, such as Fortinet.

I have not used many of the AI capabilities of CrowdStrike Falcon yet, though I have experimented with Charlotte to a limited extent.

From what I have seen of CrowdStrike Falcon, the AI capabilities seem to work fairly well in terms of accuracy and reliability of output.

The only factor preventing a perfect rating is the actual cost of the product, as it is expensive. It is best in market, but it is somewhat pricey compared to achieving a full ten.

I have been using CrowdStrike Falcon for four years.

CrowdStrike Falcon is stable.

Its scalability has worked well for us, as we use NinjaOne as our RMM and deploy it to our endpoints through that platform.

The customer support for CrowdStrike Falcon has been fantastic.

I would rate the customer support for CrowdStrike Falcon as ten out of ten.

I have seen a return on investment with CrowdStrike Falcon.

I benefit greatly from having multiple security capabilities on a single platform, as it is advantageous not to have numerous different agents installed on endpoints and to be able to leverage a single sensor.

CrowdStrike Falcon sensors are installed across all of our endpoints.

We use Microsoft Azure as our cloud provider.

The single sensor approach of CrowdStrike Falcon differentiates it from other cybersecurity platforms I have used or evaluated.

My use of CrowdStrike Falcon has expanded since the initial deployment, as we have added additional modules to the sensor, including Spotlight and Next-Gen SIM.

My experience with pricing, setup cost, and licensing for CrowdStrike Falcon is positive, but the licensing cost is somewhat expensive.

I would advise others looking to use CrowdStrike Falcon to fully leverage the solution and build into the Falcon stack, as it works exceptionally when you have the different modules deployed.

I would give CrowdStrike Falcon a nine on a scale of one to ten.

For my main use cases with CrowdStrike Falcon, we tested vulnerability assessment and we also tested threats, AI intrusion threats, and vulnerability detection.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats. Although we are too new to really change behavior, it has identified some behaviors that we need to correct.

For example, it has identified threats and user behavior, including user risk behavior.

So far, the benefits I have seen from having multiple security capabilities on a single platform have been limited, but based on the testing, we see that it is identifying threats and it has shown us proactive capabilities to shut down the threats.

I recognize that having endpoint identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is going to make it very efficient for our team because previously, we had to search and diagnose threats from multiple locations and multiple issues from different locations.

I estimate that we will have time saved, and I think it will be hours where we would go in and track who the offending email was and where it came from. Having one platform for each incident will probably save us twenty minutes to a half hour per incident.

The impact that CrowdStrike Falcon sensor has had on endpoint performance and my ability to deploy security at scale is too new to assess.

So far, CrowdStrike Falcon has allowed me to replace Trend Micro right away with it.

CrowdStrike Falcon platform is too new to suggest ways it could be better or additional features that should be included in the next release.

I have been using CrowdStrike Falcon for less than one week.

So far, I would assess the stability and reliability of CrowdStrike Falcon as too new to provide a comprehensive evaluation.

I would evaluate CrowdStrike's customer and technical support as excellent in getting us where we are in the testing phase and closing sales.

The reason for my rating is the willingness to answer questions, the willingness to demonstrate, and the willingness to call up third-party references.

The factors that impacted that change were that we did the testing and found out that it was not adequate to handle all the vulnerabilities that we had, and through testing, it identified more. We knew that this product would replace and extend our capabilities, so as opposed to keeping what we had and adding three other products, we wanted to consolidate everything in one platform.

What differentiates CrowdStrike Falcon from other security platforms I have used or evaluated is that it is much more comprehensive and it is a single platform for multiple vulnerabilities.

So far, it has not had any impact on my security operations because we signed the contract Wednesday with a test deployment, and now we will get the official deployment when we return. Part of us testing and coming to CrowdStrike was part of the experimental process of getting it deployed and finding out what other people are using it for.

I have not deployed CrowdStrike Falcon into my production environment, but we have tested it.

During my test, the experience with deploying CrowdStrike Falcon was very easy with the assistance of professional services or the implementation team, so we are ready. Their assistance has us ready to turn it on and to start right away. There is not a startup process; based on the testing, we are ready now to deploy.

My experience with pricing, setup costs, and licensing was a traditional business venture where you go back and forth and ask for what you want. The only surprising piece for me was that there is a third-party vendor who we purchased from. I thought we would be dealing directly with CrowdStrike, and we were dealing with a third party that offered financing and handled all the contracts, and that is who we paid. I was prepared to write a check to CrowdStrike and it is not that way. That was the surprising piece. I will not say it is negative or positive, but that was the surprising piece. I thought it would all be consolidated.

If I would rate CrowdStrike Falcon on a scale of one to ten, I would give it a ten.

What would make it a ten for me is if everything was consolidated in one, where I did not have to deal with a third party and a go-between.

My advice to other companies considering CrowdStrike Falcon is to make sure you get references and make sure that you adequately do the vetting and testing.

I would rate this review overall as a nine out of ten.

CrowdStrike Falcon serves as the main platform for threat hunting and threat intelligence in my organization. For threat hunting and threat intelligence in my day-to-day work, I primarily use CrowdStrike Falcon for threat detection, to see the latest threat trends, and to conduct research on different threats.

I have not seen value from integrating identity, endpoint, cloud, and other security data in the same CrowdStrike Falcon platform, mainly because we do not have the SIEM integrated there; we use it only for intelligence. We do not have the endpoint EDR sensor on the endpoints.

Since its initial implementation, the use of CrowdStrike Falcon has evolved in my organization as we have expanded use cases.

The threat intelligence and scalability features have made a concrete difference in my day-to-day work by increasing our defense coverage, making us better prepared for different threats, and providing better traceability of our infrastructure.

CrowdStrike Falcon has positively impacted my organization by providing more intelligence above all, being better prepared to deal with risks, assessing possible impacts, and also helping us to better understand the environment we are currently in.

The increased intelligence from CrowdStrike Falcon has helped my team anticipate or respond to threats more effectively by enabling the creation of more efficient use cases and allowing for more detailed and in-depth analyses, especially for analysis beyond just vulnerability detection.

The use of CrowdStrike Falcon has optimized the time my security team requires to detect, investigate, and respond to threats. I have seen time optimization specifically in the investigation area. With the current environment and the different threats and vulnerability breaches that have opened up recently, CrowdStrike Falcon has allowed us to make detection and investigation more efficient and faster.

Having several security capabilities integrated into a single platform like CrowdStrike Falcon leads to better communication. That better communication has made my team's daily work more efficient, improving collaboration and making time more efficient overall.

I am using artificial intelligence within CrowdStrike Falcon, resulting in time optimization and better improvement of the information channel, leading to better reception of the information we have.

CrowdStrike Falcon has allowed us to consolidate other security tools.

The best features that CrowdStrike Falcon offers include the intelligence of the EDR, the intelligence on the different current threats, the connectivity, and the fact that it is a scalable product. I could also say that the scalability and access to information are quite good.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that it is more intuitive, more agile, and less cumbersome, giving us readily available information along with better handling of intelligence.

The accuracy and reliability of the results generated by CrowdStrike Falcon's artificial intelligence are quite positive.

I think CrowdStrike Falcon could improve by making the menu more intuitive and perhaps making Charlotte AI faster, as it is a bit slow at times.

I have been using CrowdStrike Falcon for less than a year, which is a very short time.

I consider CrowdStrike Falcon to be stable in its operation. CrowdStrike Falcon's artificial intelligence capabilities are stable and secure, as it appears to be isolated and protected from what I have observed so far.

Regarding CrowdStrike Falcon's scalability, I would rate it a nine.

CrowdStrike Falcon has good customer success; they have listened to all our requirements for the platform, so it is going well. I would rate CrowdStrike Falcon's customer support as good; they have taken care of us, listened to us, organized sessions with other products so we can learn about the benefits, and we have been learning about other options to consider them. On a scale from one to ten, I would rate customer support a ten.

We previously used different tools implemented in my organization, and we added CrowdStrike Falcon as a complement.

I have seen time savings with CrowdStrike Falcon.

Before choosing CrowdStrike Falcon, we evaluated other options.

On a scale from one to ten, I would rate CrowdStrike Falcon a nine. I give it a nine and not a ten because there are areas for improvement, such as speed and intuitiveness, although overall it is good. My advice to others considering using CrowdStrike Falcon would be about its scalability and compatibility with other tools and platforms, based on my research.

My main use case for CrowdStrike Falcon is endpoint security across all assets. In my daily work, all our assets and hosts, regardless of the platform, have a Falcon sensor installed.

CrowdStrike Falcon has had a positive impact on my company by providing higher visibility of our assets and delivering insights into the state of the assets. The increased visibility and insights have led to measurable improvements, such as faster response times, and policies can be deployed via the Falcon sensor.

CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by allowing us to become much faster in a preventive way, enabling us to take measures much more quickly that already prevent attacks in advance.

CrowdStrike Falcon has affected the workload and productivity of my security team by allowing us to become much more productive.

The best features that CrowdStrike Falcon offers are easy deployment of the Falcon sensor across all platforms, automation capabilities, and the capability to isolate assets when needed. I would also like to highlight blocking USB ports as another feature that I particularly appreciate.

I assess the governance and security regarding the AI capabilities of CrowdStrike Falcon as good. I rate the accuracy and reliability of the AI outputs in CrowdStrike Falcon highly since the model is specifically trained on the use case with the data.

The advantages I see in combining multiple security functions on a single platform include not having to think in terms of multiple solutions and switch between them, having all the data in one place, achieving more consistent visibility of events from cloud to on-premises, having better traceability for alerting, and being able to correlate data better.

The value I see in having endpoint, identity, cloud, and other security telemetry brought together in CrowdStrike Falcon is that I can follow the entire history and better recognize attack paths instead of just seeing individual events.

What distinguishes CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is its more holistic view, as it is not just focused on a single domain but covers everything due to the large number of modules.

CrowdStrike Falcon could be improved because fine-grained access is not yet implemented deeply enough in all areas, making it difficult to give our IT employees full access to CrowdStrike Falcon without seeing too much.

I have been using CrowdStrike Falcon personally since April 2026.

The Falcon sensor has had no impact on the performance of my endpoints and my ability to implement security at scale. CrowdStrike Falcon is stable.

I rate the scalability of CrowdStrike Falcon as very good.

I find the customer service of CrowdStrike Falcon to be very friendly and very fast. I would rate the customer service as a 10 on a scale from 1 to 10.

I rate CrowdStrike Falcon a 10 on a scale from 1 to 10. The main reason I chose a 10 is that it is easy to handle, and the benefit for us as an information security department is enormous.

Since the initial rollout, my use of CrowdStrike Falcon has evolved significantly with many more features added, a clearer presentation, and UI adjustments.

The advice I would give to others who are considering CrowdStrike Falcon is to check as many functions as possible and then use several things simultaneously.

CrowdStrike Falcon serves as our primary endpoint detection and response solution. We needed this module the most since we were not satisfied with our previous EDR.

We primarily needed an EDR for security, so we have a sensor installed on all of our endpoints. The deployment of it was fairly easy compared to the previous EDR. The advantage of CrowdStrike Falcon lies in the UI and overall management, which allows us to utilize it effectively to detect detections, contain if required, and automate processes easily.

Overall, we are satisfied with our main use case of using CrowdStrike Falcon day-to-day, particularly for endpoint detection and cases. The UI is quite easy to use, and all the information and detections shown on a daily basis remain the main focus. The detections themselves are well executed, and we manage all different detections that CrowdStrike Falcon identifies which is excellent due to its extensive telemetry. Additionally, the threat hunting queries are well set up to detect almost everything, and investigation capabilities within the logs to find potential attack events are outstanding.

Currently, we are not using AI within CrowdStrike Falcon, but we aim to incorporate it in the future.

CrowdStrike Falcon has positively impacted our organization by addressing our dissatisfaction with the previous EDR, which limited us and caused daily issues. With CrowdStrike Falcon, we do not feel constrained, and although we might not utilize it to its full potential, that relates more to our technical limitations than to the tool itself. Overall, the experience has been positive.

CrowdStrike Falcon has improved our team and organization's performance by providing better visibility of endpoints through its detection capabilities, automating workflows, and allowing for correlation and investigation through various modules.

Using CrowdStrike Falcon has changed the way our security team detects, investigates, and responds to threats by consolidating everything into one tool, enhancing detection accuracy through extensive telemetry, while the flexibility has made investigations easier and deeper. The SOAR aspects with workflows and playbooks have accelerated our response processes.

Although I cannot recall a specific incident, there have been numerous occasions in our SOC where vague telemetry has been clarified through the CrowdStrike Falcon sensor, allowing us to delve deeper and address threats more effectively than we could without it.

Having multiple security capabilities on a single platform like CrowdStrike Falcon simplifies learning, as we only have to master one UI, facilitating transitions between modules. The combined console allows for queries across the same platform, which streamlines work.

Having endpoint identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform results in easier management and less hassle.

Since the tool is highly effective and the service has been excellent, it has sped up our productivity, allowing us to accomplish more with less.

Some of the best features that CrowdStrike Falcon offers include the agents, Charlotte, and the advanced hunting feature for comprehensive investigations.

The advanced hunting feature for investigations helps my team by providing a lot of details and information available in the detections. In my case, we benefit the most through the additional detections from our other SIEM, which allows us to have a complete image and conduct investigations on incidents more easily. The ability to build queries or dashboards to gain visibility into additional cases enhances our investigation capabilities significantly.

Regarding the accuracy and reliability of output from CrowdStrike Falcon's AI capabilities, my usage of Charlotte is limited to detections and the summaries or guidance provided, which have been positive and made interactions easier.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have evaluated are its many modules, the effectiveness of the sensor, the ease of management, superior performance, and versatility without limitations.

The initial challenge was getting used to the UI, which can feel overwhelming with many windows, especially when contracting more than one module at the same time. While CrowdStrike University helps ease this process, I have heard that plans are in place to improve the UI, which would enhance the overall experience. Navigating through the UIs can make one feel as though they might miss useful features.

I have been using CrowdStrike Falcon for about one year and a half.

CrowdStrike Falcon is stable.

The scalability of CrowdStrike Falcon is high.

CrowdStrike Falcon's customer support has been positive, with excellent service provided and the contact managers helping maintain a good relationship with CrowdStrike Falcon.

I would rate the customer support an eight, as we initially experienced dissatisfaction with one representative, but after switching, we received good service.

CrowdStrike Falcon has allowed us to consolidate and replace other security tools, particularly the EDR Cybereason, which we switched from due to dissatisfaction, and the additional modules provided have enabled us to incorporate tools that we previously did not consider.

In the past, I used Cybereason at the two companies I worked for before, but the experience was not good, and we felt limited in what it offered.

While I am primarily a cybersecurity analyst and was not directly involved in the deployment, I do know that the CrowdStrike Falcon sensor deployment was straightforward and did not pose significant issues post-initial deployment.

Before choosing CrowdStrike Falcon, I evaluated Palo Alto, although I was not part of the selection team.

Given my successful experience with CrowdStrike Falcon, I would rate it a 10.

I usually do not give 10s, but the overall positive experience across all aspects stands out. We have not faced any disappointments, and after discussions with various team members, we all express the same surprise and satisfaction with the quality of service.

I contacted CrowdStrike directly to acquire CrowdStrike Falcon.

Since the initial deployment of CrowdStrike Falcon, my use has expanded significantly through CrowdStrike University videos and courses, leading to increased comfort and proficiency with the platform.

My advice for others considering CrowdStrike Falcon is to thoroughly review all documentation and offerings to ensure they align with their needs, as I believe it is a tool that will satisfy most users.

Our main use case for CrowdStrike Falcon is to use it in our CDC to provide customers with endpoint protection.

A concrete example of how we use CrowdStrike Falcon in the CDC for our customers is that we handle the administration of the policies and everything that goes with it, and the customer only has to roll out the agent. We also take care of detection and response.

We mainly use endpoint protection, specifically the EDR part, and that is our main use case, but we also use Identity.

A security incident where CrowdStrike Falcon helped my team detect or stop a threat involved us doing incident response, meaning that when there has already been an incident, we roll out CrowdStrike, and we have special policies that immediately put a device into network containment when a detection occurs.

My use of CrowdStrike Falcon has evolved or expanded since it was first introduced. We started only with endpoint protection and have gradually expanded to device control, firewall management, and identity. In the future, the cloud module will also be added. It has evolved because we are using more products.

CrowdStrike Falcon has had a positive impact on my company as we have a modern EDR solution that we can offer to customers, and customers have been satisfied so far, and we are constantly gaining new ones.

The way my security team detects, investigates, and responds to threats has changed through the use of CrowdStrike Falcon because the analysts have a more precise system that they can look into and where they can bring together the detection data.

The workload or productivity of my security team has changed through the use of CrowdStrike Falcon because the workload has gone down somewhat as CrowdStrike also generates fewer false positives than the solutions we used previously.

As a result, I have concrete numbers indicating that the false positive rate has generally gone down. We have fewer false positives, and the analysts have more time for the detections, leading to no longer having such a large flood of data to go through.

In my view, the best features that CrowdStrike Falcon offers are easy rollout, a good overview, and a large number of modules.

One advantage I see in having multiple security functions on a single platform is that it is more straightforward for the analysts if they do not have to jump between multiple systems.

The added value I see in having endpoint, identity, cloud, and other security telemetry converge on the same CrowdStrike Falcon platform is that it is very useful to consolidate this data.

The question is whether we can really use everything based on the knowledge we have as a partner and whether we can make use of the data we get from the cloud module or from Identity.

The impact of the CrowdStrike Falcon sensor on endpoint performance and my ability to provide security at scale is very good as the sensor is really lightweight, and accordingly, customers have few problems with it. If problems do occur, it is usually not due to CrowdStrike Falcon but due to some other system.

In my opinion, what differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated are security, the false positive rate, and the clarity or overview.

In my opinion, CrowdStrike Falcon could be improved by paying more attention to MSSP partners when new developments happen, ensuring that we do not lose sight of them since much of what is released primarily relates to regular customers.

It would be beneficial if there were a button in the console that we could use to uninstall the CrowdStrike Falcon agent.

I have personally worked with CrowdStrike Falcon for three years, and my company has been using CrowdStrike Falcon in total for six years.

I view CrowdStrike Falcon as stable.

I rate the scalability of CrowdStrike Falcon as very good, giving it a 9 out of 10.

I can elaborate on what I mean by the possibilities or what is particularly important to me regarding CrowdStrike Falcon. However, a bit negative is that lately, support requests are being handled less or more slowly, and we often only get references to documentation, which, as an MSSP partner that really engages deeply with this solution, is not enough.

Logically, we first look at the documentation and have the experience, but sometimes it would be good to get a more comprehensive answer.

My experiences with CrowdStrike Falcon's customer support are mixed. Partly, as I mentioned, we only receive references to documentation, even though we are a partner and already have expertise. Sometimes it feels like we are less well supported because it looks to us like the support is actually intended for end customers.

If I had to rate customer support on a scale from 1 to 10, I would give it a 6.

CrowdStrike Falcon has enabled my company to consolidate or replace other security solutions, such as Trend Micro Worry-Free. As I already mentioned, the false positives have gone down, and we also feel that the platform is more secure because Trend Micro did not detect some things that CrowdStrike Falcon does.

I used Trend Micro Worry-Free before; it did not work as well as CrowdStrike Falcon, which is why I switched.

I would rate CrowdStrike Falcon a 9 out of 10.

I choose a 9 because of the possibilities that CrowdStrike Falcon offers.

I assess the governance and security of the AI features of CrowdStrike Falcon poorly because we use them very little. I also rate the detection engine behind it very highly.

CrowdStrike Falcon is deployed in our company using the EU cloud, which is not provided via AWS or anything like that. Instead, we buy the licenses; the EU cloud is with us and is then provided for the customers.

We are not using AI within CrowdStrike Falcon yet, but it may come in the future. First, we will test it.

My advice for others interested in CrowdStrike Falcon is to think carefully about whether they want a fully managed service and therefore go to an MSSP, or if they prefer to administer it themselves and perhaps go directly to CrowdStrike.

My main use case for CrowdStrike Falcon is EDR. For EDR, I use CrowdStrike Falcon for identity, endpoint management, and device control.

The best features CrowdStrike Falcon offers are endpoint and device control, identity threat protection, and AI-generic responses. What I appreciate about the endpoint and device control in CrowdStrike Falcon is that it allows me to lock down USBs for all hosts on the policies applied company-wide.

CrowdStrike Falcon has positively impacted my organization by providing better visibility, host management, compliance, and real-time responses. A specific example that demonstrates how CrowdStrike Falcon has improved visibility or compliance is response times and compliance with NIST 800-171 for CMMC, with an example of locking down mass storage and access controls.

One specific example of how CrowdStrike Falcon can be improved would be the ability to export the device control exceptions for auditability purposes, and perhaps a cleaner UI.

I have been using CrowdStrike Falcon for one year.

CrowdStrike Falcon is stable.

CrowdStrike Falcon's scalability is great, as long as I have the licenses for more sensors.

The customer support for CrowdStrike Falcon on the commercial side is great, but the government side is not as strong.

Since my initial deployment, my use of CrowdStrike Falcon has expanded, and I definitely feel better as a security analyst, more knowledgeable, and have better investigation processes.

My experience with pricing, setup cost, and licensing is that I was able to lower the price a bit by going from a one-year to a three-year contract, but it was still very expensive for the three-year commitment.

Before choosing CrowdStrike Falcon, I did not evaluate other options, as I was not part of that decision.

I would rate CrowdStrike Falcon a nine on a scale of one to ten because I never give anything a perfect score, and it is almost a ten.

Regarding CrowdStrike Falcon's AI capabilities, I think its governance and security are great. Its accuracy and reliability of output seem reliable, but I have not used it enough, as I rely mostly on the Falcon Complete team and my own individual investigations.

CrowdStrike Falcon is now deployed in my organization on GovCloud due to the recent migration.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools, as I actually got rid of some such as Exonius.

The benefits I have seen from having multiple security capabilities on a single platform are faster response time, quicker identification for investigations, and better overall security posture.

I can describe a security incident where CrowdStrike Falcon helped my team detect or stop a threat involving individuals getting fooled by malicious emails and links, and CrowdStrike Falcon stopping it and allowing me to use the sandbox to see what would have occurred and how it was stopped.

CrowdStrike Falcon has affected the workload or productivity of my security team by making response times faster and visibility quicker and more seamless.

The CrowdStrike Falcon sensor has had a lightweight effect on endpoint performance, is easy to roll out, and there is really no difference at all when it comes to response or processes, other than being faster than it was prior to having CrowdStrike Falcon sensors on my hosts.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that so far it is the best, but it is definitely the most expensive.

My advice for others looking into using CrowdStrike Falcon is to invest in it, as it is a good solution. I would rate CrowdStrike Falcon a nine out of ten overall.

My main use cases for CrowdStrike Falcon are MDR, SIEM, and incident response.

I can describe a security incident where CrowdStrike Falcon helped my team detect or stop a threat. We had a stolen session token that somebody had phished and reused. We were able to respond on CrowdStrike Falcon within three minutes. It was really fast. We were able to find what we needed, figure out it was malicious, and then we revoked the tokens within three minutes. It was really quick and probably the fastest reaction we ever had.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats. We are a lot faster than we were previously. The investigations are easier. I can do forensics a lot faster and easier than what our last vendor had for us, which was Arctic Wolf.

The benefits I have seen from having multiple security capabilities on a single platform include having all the data in one place, which makes it easy. It makes it a lot faster for me to find what I need and to correlate that data as well, so it helps a lot.

Having endpoint, identity, cloud, and other security telemetry in CrowdStrike Falcon benefits us because we can correlate a lot more data from different places where we could not before. We had to copy and paste session ID numbers and UUIDs from one place to the other.

I did not think much about how CrowdStrike Falcon can be improved. For additional features that should be included in the next release, I would suggest the ability to save my queries, which would make it a lot easier. The only other thing I can think of is to make the query buttons, such as the save and load query buttons, a little bit bigger and easier to access.

I have been using CrowdStrike Falcon for about a year now.

I would assess the stability and reliability of CrowdStrike Falcon as very stable and very reliable. We have not had it give us a lot of false positives.

I have not experienced any downtime, crashes, or performance issues.

CrowdStrike Falcon sensor has had an impact on endpoint performance and my ability to deploy security at scale. The sensor itself on some of the machines had a little bit of a learning curve and some growing pains when we installed it at first. We had some users complain that CrowdStrike Falcon was blocking their application, but as soon as we got the necessary exclusions in place, everything was fine. It was a little bit of a learning curve for some of our developers.

I would evaluate customer service and technical support as great. I have only had to call customer support once and they were great.

What was great about my experience with technical support is that they were responsive and called me back.

I replaced Arctic Wolf because Arctic Wolf did our vulnerability management and our SIEM. CrowdStrike Falcon replaced that. We were also using ESET and Bitdefender, and CrowdStrike Falcon also replaced those for our endpoint.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that I have used many cybersecurity tools, and CrowdStrike Falcon is on the cutting edge of cybersecurity. You have more features, your detections are better, and they are more reliable. I prefer CrowdStrike Falcon much better than all the tools I have used. I used to work for a competitor, so I worked for LogRhythm a long time ago, and LogRhythm is still stuck in the past.

I would describe my experience with deploying CrowdStrike Falcon as really easy to deploy. We set it up in NinjaOne and pushed it out and used a GPO for the rest.

What worked well was the installation, which went really well. We did not have any major issues getting it installed. The only challenges we had were that it started blocking things right away before we could get the exclusions in place.

My use of CrowdStrike Falcon has expanded since my initial deployment. We are still in the process of expanding to other things. We are about to start using the AIDR feature, which we were not using previously. We had not rolled out VM management until very recently. We were still using Arctic Wolf for that, and we just started using CrowdStrike Falcon for that as well. We are still expanding it and turning on features that we did not have before.

I have seen return on investment with CrowdStrike Falcon. Whatever it costs, it was worth it.

My experience with pricing, setup costs, and licensing was easy. I cannot provide data points or examples because I do not know what we paid for it.

CrowdStrike Falcon has allowed me to consolidate or replace other security tools.

The advice I would give to other organizations considering CrowdStrike Falcon is to deploy it on the endpoints. However, do not install it until you are ready and have the exclusions in place. A good feature that could be added would be a monitoring mode when you first install it, so it does not start blocking things right away. I give CrowdStrike Falcon a rating of ten out of ten.