CrowdStrike Falcon Reviews

The product is inherently cloud-based.

Knock on wood. Between our management of the platform and having subscribed to Falcon Overwatch, the managed threat hunting service, I haven't had a concern in six years. I have yet to deploy this product in an environment that has later incurred a breach. I have the utmost confidence that would be very unlikely to occur.

Every time that I have deployed it, it was more about Falcon Insight and its EDR protection. Then, the team in the company would be so pleased with the results that there was minimal resistance adding additional stack elements. Prior to their announcement of several new modules last Fall, we had acquired the entire stack. 

Each element of the stack continues to further develop their capability and empowerment of team members. For example, CrowdStrike Falcon Spotlight was an interesting tool to assess vulnerability management, but the capability of that module alone has just continued to develop in a very favorable direction. Also, the discover tool is extremely valuable. 

Probably the most valuable thing to me is the real-time response piece. The fact that I can connect to an endpoint as long as it is on the Internet, no matter where it is globally. I can remove files from the endpoint, drop files on the endpoint, stop processes, reboot it, run custom scripts, and deploy software. Pretty much no other tool can do all that.

As a cloud-native solution, it provides us with flexibility and always-on protection, which is critically important.

There is nothing existing today that I would change very much about the solution. Because of the capability of the data that they are ingesting, they have the ability to create tools leveraging that data to enhance the capability of the platform. The possibilities are endless.

I have been using CrowdStrike Falcon for about five and a half years

There are no questions about stability. I continue to see, especially in the last six months, that CrowdStrike is making very purposeful acquisitions to tactically and strategically build upon the platform. Many companies acquire smaller companies to get a fraction of a piece of technology that tends to be an add-on or something that may compliment the core product, but CrowdStrike is making more strategic moves to acquire technology that they can directly integrate into the existing platform to make it even better and more effective.

Updates can be handled one of a number of ways. This is something that has evolved quite a bit since I initially deployed it. Initially, you simply had the option of manually upgrading sensor versions or leaving them to automatically update as soon as a new update was released. Very infrequently, there have been issues with sensor builds. Early last year, they rolled out the ability to automate the sensor revision updates, but do it in a tiered fashion. So, there was an N-1 and an N-2. So, when they release a new version, I step back my releases and deployment of the updates by one version backwards. Then, I have a few early adopters who get the latest sensor build as soon as it is deployed. Provided there are no problems, when the next release happens, the N-1 version will automatically upstep my entire environment without having to put hands on it.

This product does not require any maintenance post-deployment.

We are protecting 5,500 endpoints with this solution. We do have plans to increase usage. Our environment is rather complex in that we have 6,000 core corporate associates and roughly 5,500 endpoints. Then, we have a distributor network globally comprised of about 220 wholly owned subsidiaries who are essentially their own companies, but they are only licensed to resell our products. They kind of have a mix of endpoint protection because it is largely up to them, within their entity, as what they choose to use. We are looking to further wrap our arms around them from a security perspective. We have looked at acquiring CrowdStrike's complete platform, which would be fully managed to deploy to that distributor network, which is about the same size as our corporate environment. So, it would be roughly another 6,000 users. It is a very large, globally-reaching endeavor, and working through the politics and legal aspects of how we will make that come to fruition may take some time. However, that is the plan.

I would give the technical support 10 out of 10 for the past year. They have improved a lot of things in response to customer feedback. A year and a half ago or more, if you put in a support request by email, then it wasn't timely addressed. It could be a day to three days before you received a response, which was a bit frustrating. There was a lot of customer feedback around this issue, which has been greatly refined. Now, if I put in a support ticket, I would expect it would probably be answered within a couple hours.

I have a lot of ideas in my head about where things could go with the solution. The company is very receptive to those thoughts as well as the opinions of all its customers

Our previous endpoint protection platform was very cumbersome to manage. It did not reliably apply protection and had many issues. My current organization is the fourth time that I have deployed CrowdStrike Falcon in an environment. The first time that we deployed it, we were using an inherently cloud-native protection platform, but it was unreliable. 

Swagelok was using McAfee ePO, which inherently is an on-premise solution. It is also very unreliable and cumbersome to manage. It was just missing detections, being inherently signature-based. So, it was only hitting on known signature-based malware. We lacked the EDR aspect of endpoint protection, e.g., behavioral-based analytics and preventing malicious behavior before it begins, which drastically stifles the remediation effort. McAfee's principle was always, "If you get said detection, then you need to run other tools to scan, remediate, and clean up the endpoint." Hands need to be on the endpoint taking it physically offline and off the network. Everything is drastically simplified with CrowdStrike Falcon. I can cloud sandbox the endpoint, remediate it, and interact with it at the command line level remotely, regardless of where it is, as long as it has an Internet connection. It is just amazing. 

As far as Swagelok goes, McAfee yielded a lot of false positives. The management was so cumbersome that there were only a handful of people able to resolve problems with endpoints or false detections. If you weren't connected to the inside core network, you couldn't reach the server in order to mitigate the problem. Because of the cloud-native aspect to CrowdStrike Falcon, I can pull up the console in my car on a mobile phone and mitigate an issue for someone whenever and wherever I need to do it, regardless of how I am connected, what device I am on, etc. So, the response time has drastically decreased (by five to 10 times) for remediating a critical vulnerability, a piece of malware, or undoing a false positive. This has been noticed across the company at large.

In all four instances where I deployed the single sensor in organizations of various sizes, it was very simple. Swagelok was probably the easiest deployment, since it is an organization large enough to have a deployment tool, like Microsoft SCCM. Once the package was built to deploy to endpoints, we push the "Go" button. Then, it was a matter of hours and our entire environment was protected. The deployment took less than a week.

Three people were involved in deploying the solution:

1. Being the experienced administrator, I pretty much did all the configuration: creating the correct groups, prevention policies, etc. 
2. We have an administrator of the deployment tool. I worked very closely with the package of the sensors and he executed the deployment.
3. We have another gentleman who oversees our lab environment and was very invested initially in trialing the product against all our existing applications to ensure there weren't any incompatibilities in the early deployment.

We have absolutely seen ROI, e.g., the reduction in man-hours for resolving incidents. The speed of the platform has drastically reduced time consumed, affording more time for an operator to act when resolving problems.

It is an expensive product, but I think it is well worth the investment.

The CrowdStrike Falcon Pro solution alleviates the need to quote out the product. You initiate the use of the free trial, then opting the purchase. You can manage it all on your own without engaging a sales representative. I definitely have done this in a small business environment. 

In all other instances, it was more of a formal business relationship. There was a sales representative involved who queued up the trial environment. If you initiate a trial yourself, you are basically given 14 days to trial it. Whereas, engaging a sales representative allows them to moderate the length of time that you can do the trial. Because we are a larger enterprise with a lot of politics around completing purchases and legal reviews, we have a sourcing department who vets out vendors. The process is very long and cumbersome. We had initiated a trial, in this instance, which ran for several months before we acquired it.

The fact that I have access to the products free for several weeks or months was not really a factor. What was more impressive in the trial was the way CrowdStrike approached it. When you initiate a trial, they give you a CloudFlare instance of a victim machine and an adversary machine. They then allow you the capability to deploy the sensor or pull it back from the victim machine. You can unload whatever you care to against the victim machine for testing to see how well the product works on your own. Unlike many other products in a similar space, when you evaluate the product, it gives you the feeling that you are completely in control. Also, there is a sales engineer who moderates the demonstration of the product.

The first time that I deployed CrowdStrike Falcon, I evaluated probably a dozen other products. I was very close to signing a deal with Carbon Black, simply because I hadn't yet heard of CrowdStrike Falcon. Since deploying it the first time, I would never really consider anything else. I do look at other platforms from time to time to see how they have evolved and changed, but it would be very difficult to convince me to use something else. The winning factor for CrowdStrike Falcon is just the inherent capability of the platform. In my observation, there really isn't another company who can do as much as they can.

Take advantage of the opportunity by CrowdStrike to network with other customers in a similar company size and industry to see how well the product could benefit you as a potential customer before committing.

We have a very minimalistic cloud infrastructure footprint or container footprint at this point in time. That is likely to take off in full swing in the next year or so. We have many legacy applications running on legacy operating systems, which I am working very aggressively to get out of our environment. When that starts to take flight, we will definitely have more of a need for a cloud container as well as cloud infrastructure visibility and protection, which we do not have a lot of at this point in time.

I would rate this solution as 10 out of 10.

We use CrowdStrike Falcon for endpoint protection against malicious activity.

Among CrowdStrike Falcon's most valuable capabilities are its UEBA and SOAR functionalities, along with its seamless integration with any other SIEM solution.

The detection time has room for improvement.

I have been using CrowdStrike Falcon for two years.

I would rate the stability of CrowdStrike Falcon ten out of ten.

I would rate the scalability of CrowdStrike Falcon a nine out of ten.

The technical support is good.

Positive

We are an MSP and have used and provided IBM QRadar, Bit Defender, and CrowdStrike Falcon based on each client's requirements. 

CrowdStrike Falcon is the most popular choice for our clients because of its price.

Deploying CrowdStrike is straightforward. We initially had a technical representative guide us through the process, but now we can handle it ourselves for our clients. 

One architect and two engineers are used for the deployments.

We implement the solution for our clients.

The licenses are offered on a one-year and two-year basis. The more endpoints an organization adds the cheaper the cost.

I would rate CrowdStrike Falcon a ten out of ten.

Our clients range from small up to enterprise level.

The maintenance is simple. We just need to stay on top of the updates.

CrowdStrike Falcon is user-friendly and the analysis provided is good making it an efficient solution.

We primarily use the solution for real-time ransomware protection.

The solution hasn't picked up a virus yet, so I don't know if I'm able to really discuss the most valuable aspect of the solution just yet. It's very new. 

It's not costly, and it's not constantly running, it's only looking for suspicious items when it starts to take action. There's nothing constantly scanning your device, so it's not slowing anything down in that respect. That's what I liked about it the most. 

It's not your traditional antivirus that just sits there constantly scanning your computer for Trojans and malware, etc. This doesn't take any action until it sees something actually going on.

The initial setup is very simple.

The solution doesn't have a whole lot of email security on offer. We did know that going into the purchase, however. We decided to get a different solution for that aspect of security.

They have a sandbox feature, but it's all they do. They have different grades. There's the Socket Pro and then there's an ADR. Then there's another one where they pretty much watch your system for you. And it's all different. It's all based on the price you want to spend. I wasn't going to drop a large amount of money.

They don't really have anything when it comes to scanning attachments. That would be something I would like.

I've only been using the solution for one month. It's still a relatively new product for us.

The technical support so far has just been helping with the setup via the initial webinar. The technician was very knowledgeable. He knew what each feature meant. If I had a question about it, he went into great depth. I've been quite satisfied with technical support so far. As a whole, they are very easy to work with.

I had Bitdefender for three years before switching to this solution.

They were fine. I didn't have a lot of problems, but I'd been hit with ransomware four times while I had Bitdefender. I considered that as kind of a sign that maybe we should change things up.

The malware, as far as uninstalling, wasn't triggering the antivirus. I wanted something a little more advanced, due to the fact that the Ransomware protection just really wasn't there. The anti-virus aspect was pretty good. The email protection was pretty good, as well.

The initial setup is pretty easy. It's very simple to work with. It's been really easy to install.

I did one webinar with a support engineer. He showed me how to set it up, and to run with it. 

We just did a screen share. He gave me insights into the best possible way to set it up and that's how I rolled it out. It was a helpful experience.

The pricing on CrowdStrike is per license. It was about $42 per seat yearly.

I looked at Komodo, a Gen One antivirus. I liked their product. It was pretty good. They have what is called a sandbox feature where you could take a file or the endpoint security will take the file and dump it into like a virtual sandbox and run it to test its safety. It turned out the file was malware, the solution would remove it. 

We decided not to go with it, however, due to the fact that it didn't have many reviews. Komodo is actually cheaper than CrowdStrike. I've been down the road before with bad antiviruses and had some bad experiences. Since they didn't have a whole ton of notoriety out there, you didn't see a lot on it, which kind of scared me away from it, even though I liked what they had.

CrowdStrike, it's new, however, Amazon uses it. My thoughts are if it's good enough for them, I assume it's good enough for me.

We looked at Sophos as well, however, it was very expensive. Sophos offers everything, and they are a great product, however, for us, the price was just too much.

We're just a customer. We don't have a special relationship with CrowdStrike.

We're using the most up to date version of the solution right now.

So far, I've had good luck with this solution. That said, it hasn't hit anything. I won't get a true test until I actually get somebody that sends up malware. In the meantime, no news is good news.

I would rate the solution nine out of ten right now. They're pretty good. I haven't done anything super-advanced or to spec. There's a lot there to work with if I want to, however, I keep it pretty basic. I only have a couple of policies. It's not a huge company, so it's not real hard.

It's security-related product. A security environment based on AIML. It is not like the older stuff, which used to have signature-based updates.

It has helped us with security and managing threats that we see currently in our environment.

Because it is security product and acts like an AIML smart product, not merely based on daily/weekly updates and signatures.

Unfortunately, native applications are not supported.

It manages around a few thousand endpoints and servers in our environment, and it is doing well so far.

There are no issues in terms of scalability. 

We can call the tech support, if needed. Then, they have a dedicated rep for us.

It went well. We just installed an app on all the endpoints or devices. They have a good console which helps do this. So, it is as simple as that.

We are using this for endpoint security, so it doesn't need to integrate with anything else.

We evaluated three to four other vendors.

During the PoC, we figured out that this product is far better, and it met our requirements. That is why we went for CrowdStrike. With our PoC, they did a good job in explaining the product. So, the PoC went well, and we were able to achieve what we intended to with it.

Do a thorough PoC. Don't go ever go by the sales team unless you have tested it and know it works for your environment, because every environment is unique. The sales guy will promise you the moon. Only unless you have tested, you know it delivers.

The product has met its purpose for us.

We use both the on-premise and AWS versions. They are both good products and very simple to move, install, and configure.

CrowdStrike Falcon is used for incident response.

It is very easy to hunt a threat in the organization. It keeps logs, making it very easy to investigate any kind of incident using CrowdStrike by looking at the processes that are running on a machine. There's more visibility over the endpoint through CrowdStrike.

The ability to remote into other devices for investigation and the way it presents a graphical representation of the detection, like the parent-child process, are valuable features.

The new interface, the UI, seems a bit messy. The previous one was quite clear. It might be because of my adaptation to it. That's what I see as needing improvement.

I have been using CrowdStrike Falcon for more than three years, around three and a half years.

It is quite stable. I would rate it eight or nine out of ten.

I would rate customer service and support a ten. I am very satisfied with the support.

Positive

I have used antiviruses like Symantec before. Compared to all of that, I found CrowdStrike quite striking. Even compared to Defender, I find CrowdStrike more appealing.

On the terms of investigating, I find it's quite easy to investigate an event and have a broader look at the event using CrowdStrike. I would rate the time saved around eight, nine, or even ten out of ten. Compared to Defender, it makes it faster to investigate.

I think the pricing is quite reasonable with the services they provide.

For an incident investigator, it's quite easy to use, and it provides great visibility over the processes.

I'd rate the solution ten out of ten.

Our organization relies on CrowdStrike, a standalone endpoint security solution, to safeguard our bare-metal machines. CrowdStrike continuously monitors for threats on all endpoints. If it detects any suspicious activity, such as malware or malicious processes, it immediately alerts us for investigation. 

The malware protection is the most valuable feature of CrowdStrike Falcon.

The current database schema presents challenges and has potential for improvement.

The technical support response time can be improved.

There are a lot of false positives reported.

I have been using CrowdStrike Falcon for almost four years.

CrowdStrike Falcon is stable. 

CrowdStrike Falcon is scalable.

The technical support is good but the response time can be improved.

Positive

We previously used VMware Carbon Black Endpoint. CrowdStrike Falcon is more of an EDR solution.

I would rate CrowdStrike Falcon a seven out of ten.

The maintenance is straightforward.

CrowdStrike Falcon is deployed independently in our environment and we have 30 users.

While CrowdStrike Falcon offers valuable security tools for larger organizations with extensive infrastructure, its complexity might not be ideal for smaller businesses with limited IT resources.

We primarily use the solution for our Windows and Macs.

The detection and response have been excellent overall. We've had no ransomware attacks. 

We found the initial setup to be straightforward. 

The solution is stable. 

Scalability hasn't been an issue for us.

The price is too high.

I've been using the solution for three years now. 

The stability has been fantastic. We have never had an outage. There are no bugs or glitches. The performance is great.

As we are a smaller organization, scalability hasn't been an issue. It's been very good so far. 

We have about 120 users and they include technical people, salespeople, project managers, and developers.

This solution is being widely used in our organization as it is mandatory. All of our users need to have it. 

The product works really well. We very rarely had to reach out to technical support. When we reached out to them, they've been pretty good.

We were in the old McAfee EPO and with all the ransomware and all that stuff hitting us, we found that McAfee wasn't really cutting it. That's why we switched.

The initial setup is simple. It's not overly complex or difficult. 

For us, the deployment took a couple of weeks and we were good to go.

You need very few staff members for deployment and maintenance. 

We did not use an integrator, consultant, or reseller to help us with the implementation. We were able to handle it ourselves.

There's not really an ROI. The ROI is that we haven't been hit by ransomware.

The product is quite expensive. It's higher than the competition in general in terms of cost. 

We pay a yearly licensing fee.

They also offer what they call the Falcon Complete, which was a complete managed service, which we chose not to go with. We measured it ourselves.

We looked at Carbon Black, Cybereason, and Microsoft Defender ATP. We chose CrowdStrike, as it's always easy to use. It was the most mature product as well. We liked what Gartner had to say about CrowdStrike.

We're a managed security services provider.

I can't speak to the exact version of the solution we're using at this time. 

I would advise users to just follow the advice of CrowdStrike. They have some very good manuals and YouTube videos and stuff of that. It's a complex piece of software, however, you need to work very well and make sure your implementation is correct.

I'd rate the solution at a ten out of ten.

We use CrowdStrike Falcon for intrusion prevention management.

CrowdStrike Falcon proactively blocks threats and provides us with insights.

CrowdStrike Falcon integration is seamless.

The endpoint and server management are the most valuable features of CrowdStrike Falcon.

CrowdStrike Falcon's GUI requires improvement for user-friendliness. The console's available options are unclear, making it difficult to understand and extract details. Additionally, correlating information within the console and reports proves challenging.

I have been using CrowdStrike Falcon for two years.

CrowdStrike Falcon had some initial stability issues in our environment, likely due to its new integration. However, it appears to have matured and is now functioning reliably.

Being cloud-based, CrowdStrike Falcon offers easy scalability. Adding licenses through procurement increases resources without the need for additional hardware, making scaling straightforward.

While the technical support meets all response time commitments outlined in our Service Level Agreement, some users believe they should strive for a higher standard – a Security Level Target. This means responding to security incidents immediately, not just within SLA windows. Security tools are crucial for our environment's protection, and their use shouldn't be limited by SLA constraints.

Positive

After using Symantec, Trend Micro, McAfee, and VMware Carbon Black, we migrated to CrowdStrike Falcon due to a lack of support from the previous vendors and their shortcomings in comprehensive threat detection.

I would rate CrowdStrike Falcon eight out of ten.

The maintenance required is reasonable.

We have 6,000 endpoints in our environment.

CrowdStrike Falcon shines with its user-friendliness, providing clear insights into the endpoint environment. Proactive features are a major plus, offering actionable items and valuable attack path simulations that empower better decision-making.