Centralized threat visibility has improved detection speed and strengthened endpoint protection
What is our primary use case?
Our company has been using CrowdStrike Falcon for about 2 years. During that time, it has been a great help in detecting and responding to various security threats. We mainly use it for endpoint security management.
CrowdStrike Falcon is used in various ways in our company. It has been especially effective in detecting and blocking unknown malware or ransomware attacks in real time. For example, recently CrowdStrike Falcon immediately detected a phishing link that came in via an employee's email and prevented it from spreading across the entire network. It also plays a big role in monitoring the security status of remote workers' devices and consistently applying security policies.
We have had real experiences with threat detection. At one point, CrowdStrike Falcon's behavioral analysis detected activity in our system that was different from normal patterns and flagged it as suspicious. Investigation revealed that it was part of a new type of APT attack, and fortunately, we were able to block it in the early stage. In that process, I felt that CrowdStrike Falcon's behavior-based detection technology played the biggest role. It would have been difficult to detect using traditional signature-based methods.
What is most valuable?
After that incident, we strengthened our internal response process for phishing attacks. We started to immediately analyze threat information detected by CrowdStrike Falcon and set up additional automated rules to proactively block similar types of attacks. Compared to before we adopted CrowdStrike Falcon, the biggest improvement has been in visibility into security threats and response speed. In the past, we had to manually analyze logs from multiple security solutions, but now we can see all threat information at a glance and respond quickly from a single CrowdStrike Falcon console.
Thanks to CrowdStrike Falcon's cloud-based architecture, deployment and management were very lightweight. With our previous solutions, the agents were heavy and sometimes affected system performance. But we had no such issues with CrowdStrike Falcon. In terms of cost, although there was some initial investment, by consolidating multiple security tools into one and increasing operational efficiency, I feel it is definitely worth the investment in the long term.
CrowdStrike Falcon's greatest strength is its real-time threat detection and response capabilities. In particular, its detection method based on indicators of attack is very effective at blocking even unknown threats. Another big advantage is that because it uses a lightweight agent and a cloud-native approach, it provides strong security without performance degradation.
The integrated threat intelligence feature in CrowdStrike Falcon provides detailed background information on detected threats, the attacker's tactics, and correlations with other attacks, which greatly helps our analysis team quickly understand the severity of threats and respond appropriately. The user interface is intuitive, so new team members took very little time to adapt to CrowdStrike Falcon.
What needs improvement?
CrowdStrike Falcon is a very powerful tool, but at times the high initial adoption cost can be burdensome. To get the maximum benefit, as in our case where we integrate it with other security systems, a certain level of expertise is required, which is somewhat disappointing. Sometimes updates can cause unexpected issues in the system, so rigorous pre-testing is essential, and that is another point of concern.
In the future, I would like to see even smoother integration with other security tools. If more flexible pricing models or SMB-focused packages were introduced so that small and medium-sized businesses can adopt it without too much burden, I think many more organizations could benefit.
For how long have I used the solution?
I have been working in this field for about 5 years. I started as a security engineer and now I mainly handle analysis work.
What do I think about the stability of the solution?
CrowdStrike Falcon's stability is rated very highly. During the period we have used it at our company, we have not experienced any system downtime or unexpected errors caused by security-related stability issues. However, as I mentioned earlier regarding updates, we are always mindful that content configuration updates can potentially cause problems. I believe thorough pre-testing and phased rollout are essential.
What do I think about the scalability of the solution?
We also have experience with scalability. As our company grew and the number of endpoints increased, CrowdStrike Falcon scaled without any issues. Because it is cloud-based, we were able to integrate many devices in real time without installing additional hardware, and we did not notice any performance degradation. We gained confidence that we could maintain stable security even as the organization grew.
How are customer service and support?
I have experience with CrowdStrike's customer support. When we introduced CrowdStrike Falcon, we needed technical support due to integration issues with our existing systems, and the support team responded very quickly and professionally. They understood our special network configuration and provided tailored solutions, which allowed us to resolve the issue quickly. Overall, satisfaction with customer support is quite high.
I would give the customer support service an 8. The professional help was very useful, but occasionally the wait time was longer than expected.
Which solution did I use previously and why did I switch?
We used a few other solutions before adopting CrowdStrike Falcon. We evaluated traditional antivirus programs and other EDR products. The decisive reason we switched to CrowdStrike Falcon was the real-time threat detection capability and overwhelming analysis speed. In particular, CrowdStrike Falcon's behavior-based detection technology was far superior to other products, and the lightweight agent allowed us to strengthen security without worrying about system performance degradation, which was important.
How was the initial setup?
I would like to mention CrowdStrike Falcon's API extensibility. We have integrated CrowdStrike Falcon with our existing Security Information and Event Management system, that is, SIEM, so we can centrally manage and analyze security alerts. This has greatly improved the efficiency of our security operations.
The automation feature that helped the most when integrating with SIEM was the process where a critical alert in CrowdStrike Falcon automatically creates a ticket in the SIEM and sends a notification to the person in charge. This greatly reduced response delays. The difficult part of the integration process was aligning the log formats of the different systems, but thanks to the documentation and support provided by CrowdStrike, we were able to resolve it relatively smoothly.
What was our ROI?
CrowdStrike Falcon has had several positive impacts on our company. First of all, it has greatly reduced the time required to analyze and respond to security threats, allowing team members to focus on more important and strategic security tasks. By preventing actual security breaches, we were able to avoid potential business losses and raise our security level to a higher tier.
Based on our internal analysis, our average threat response time has been reduced by about 30 percent compared to before. The false positive rate, that is, the number of false alarms, has dropped significantly, while the number of valid alerts that the security team actually has to handle has decreased by more than 50 percent. This prevented unnecessary resource waste and allowed us to respond more efficiently to security threats.
We also saw effects in workforce optimization. As the false positive rate decreased and analysis efficiency increased, the security team was able to safely manage more endpoints than before with fewer people. Thanks to that, we could reassign the freed-up staff to other important tasks such as threat hunting and strengthening security policies.
What's my experience with pricing, setup cost, and licensing?
As I mentioned earlier, the initial adoption cost is somewhat high, and there is a certain level of difficulty involved in integrating it with other security systems, which is a drawback. Sometimes unexpected issues can occur after updates, so rigorous pre-testing is essential—this is another aspect I would like to see improved.
In terms of pricing, we use the enterprise bundle, and while the initial cost was somewhat high, considering the wide range of features and the security benefits, we determined that the investment was worthwhile. We contracted licenses based on the number of users, and it was nice that they could be flexibly adjusted to fit our company's size.
Which other solutions did I evaluate?
There were solutions we compared. For example, Microsoft Defender for Endpoint had the advantage of good integration with existing Microsoft environments and was cost-effective. SentinelOne, on the other hand, had excellent AI-based automation, but we felt it consumed a lot of system resources. CrowdStrike Falcon struck the best balance between performance and efficiency, and we gave it the highest score especially in its ability to detect unknown threats.
What other advice do I have?
If I were to advise other companies considering adopting CrowdStrike Falcon, I would say they should not only look at its powerful security features but also thoroughly evaluate whether it fits their current environment and threat profile. In particular, it is essential to develop a thorough integration plan with existing systems and to establish an update management process to ensure stable operations. I would also recommend actively leveraging customer support if needed. My overall review rating for CrowdStrike Falcon is 9.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Strong and Reliable Endpoint Protection.
What do you like best about the product?
Its cloud-native architecture enables fast, lightweight deployment with minimal impact on overall system performance. The real-time threat intelligence and strong detection capabilities also help it identify and stop advanced attacks effectively.
What do you dislike about the product?
Pricing can be relatively high, particularly for smaller organizations or when you need access to the full set of features. The interface and alert management can also feel complex at times, so new users may face a bit of a learning curve before they’re fully comfortable.
What problems is the product solving and how is that benefiting you?
It addresses key challenges such as detecting advanced cyberattacks (e.g., ransomware and malware) in real time, while also reducing our reliance on multiple, complex security tools by offering a unified, cloud-based platform. This helps us improve threat visibility, respond to incidents faster, and boost overall security efficiency, all while keeping system performance lightweight.
Real-Time Threat Protection with Lightweight, Cloud-Native Performance
What do you like best about the product?
What I like most about Crowdstrike Falcon is its ability to detect and stop threats in real time without slowing down endpoints. Its cloud-native architecture means there’s no heavy agent to manage. The visibility it provides across the entire environment also makes investigations faster and much more accurate.
What do you dislike about the product?
One thing I dislike is that the interface can feel overwhelming at first. There’s a lot of depth, but it takes time to learn where everything is and how it’s organized. Some advanced features also require additional modules, which can make the overall cost add up quickly.
What problems is the product solving and how is that benefiting you?
Crowdstrike Falcon helps us tackle the challenge of detecting modern, fast-moving threats across a distributed environment. Its real-time monitoring and behavioral analytics allow us to catch attacks early, often before they cause any damage.
Excellent Network Containment, RTR, and Endpoint & Identity Protection
What do you like best about the product?
Network containment, RTR, and managing endpoints and workflows, identity protection everything is so good
What do you dislike about the product?
Endpoint on-demand scan: if I initiate a scan on an offline host, it won’t run when the host comes back online, and the scan just fails. It would be really helpful to have a feature where an on-demand scan can be queued and then automatically start once the endpoint is online again.
What problems is the product solving and how is that benefiting you?
It helps with data breaches and with protecting the organisation from malware, and similar threats.
A Comprehensive Security Solution with Easy Deployment
What do you like best about the product?
I like that CrowdStrike Falcon Endpoint Protection Platform works efficiently in the background, which means it takes very little effort from our own team. This allows us to sleep better knowing our computers and servers are protected from malware. The platform also saves us a lot of time because we wouldn't have the resources to run a 24/7 security operations center with our own staff. Switching to CrowdStrike Falcon was significant because it offers both 24/7 service and expert support, not just the technology. The initial setup was very easy, and now it's automated, which I appreciate.
What do you dislike about the product?
They do have additional modules that might add value but we would have to pay extra for those. The admin portal is quite 'made for engineers' and requires knowledge and training to use it for customer.
What problems is the product solving and how is that benefiting you?
CrowdStrike Falcon Endpoint Protection Platform protects our computers and servers from malware, provides SOC services, and operates efficiently in the background, saving us time and resources.
Endpoint security has improved and real-time detection and response reduce false positives
What is our primary use case?
CrowdStrike Falcon's main use case is endpoint security and threat detection, which are the primary purposes for which we are using it.
A day-to-day example of using CrowdStrike Falcon for endpoint security detection occurs when a user downloads suspicious files. The system detects this activity and triggers an alert to the administrator. CrowdStrike Falcon detects abnormal behavior of the system, and an alert is generated in a console. When I log into the console, I can see that some users are trying to access malicious files which are harmful for the organization. The security team isolates the endpoint based on this judgment. We can investigate using process trees and logs in CrowdStrike Falcon. Additionally, USB device control helps sometimes with USB blocking and data access via external storage.
What is most valuable?
The best features CrowdStrike Falcon offers are endpoint detection and response, cloud-native lightweight agent, AI-powered threat detection, threat hunting, and Falcon Overwatch.
The feature I use the most is endpoint detection and response, which you can call EDR. EDR makes the difference in this case because it provides real-time alerts for suspicious activity and full process tree visibility showing what ran, what spawned, and what is happening inside the LAN on the endpoint. It allows for quick investigation of endpoint logins and quick host isolation to stop the spread.
Using CrowdStrike Falcon typically leads to faster threat detection, quicker response, and better visibility across the endpoints. This means I can understand, or an administrator can understand the logs and situation, what is happening with the endpoint, and what suspicious behaviors are occurring inside the endpoints. It has reduced false positives and has a lightweight performance impact, resulting in no heavy use or heavy scans of the agent. User productivity is also increased on the endpoint side.
What needs improvement?
Regarding improvements in reports, when I try to pull a custom report, there are some mismatches, or it does not look professional. I hope CrowdStrike will improve their custom report or inbuilt report to look professional rather than appearing like just adding numbers. Based on the requirement, they should improve their custom reports.
For how long have I used the solution?
I have been using CrowdStrike Falcon for around one year.
What do I think about the stability of the solution?
CrowdStrike Falcon is very stable.
What do I think about the scalability of the solution?
The scalability of CrowdStrike Falcon is very good and very positive.
How are customer service and support?
Customer support is also appreciated as it is very good. I have raised multiple tickets with technical support, and every time I have received a good response from customer support.
Which solution did I use previously and why did I switch?
We did not use any kind of solution previously.
What was our ROI?
Before CrowdStrike Falcon, there were 40 to 50 alerts per day with many antivirus detections and time wasted validating non-issues. When we installed the CrowdStrike Falcon agent on the endpoint, there are now 10 to 15 meaningful alerts that we can work on and isolate the system. There is a 60 to 70 percent reduction in false positives, allowing us to disregard those. Additionally, higher quality behavioral detection based on pattern analysis is justified. The investigation time has been reduced from three to four hours to one to two hours, and per user, we used to take around 10 to 15 minutes, but now with the reduced false positives, we can troubleshoot or inspect users within five minutes.
What's my experience with pricing, setup cost, and licensing?
The pricing is very straightforward and negotiable. The license is thoughtful and very fruitful. The licensing is pretty simple, so it has a very good impact with the licensing, setup cost, and pricing with respect to CrowdStrike Falcon.
Money is saved because if a user is receiving spam alerts or spam emails which are damaging the organization's privacy, the number of alerts, data threatening, DLP, data extraction, and everything has been reduced. There is a big impact on the organization's security posture as well as time saved while doing troubleshooting, allowing us to monitor that alert via one single console. The positive impact is significant, and the money saved is a very good effect for the organization.
Which other solutions did I evaluate?
We have not evaluated another option before choosing CrowdStrike Falcon.
Improved endpoint visibility has reduced incident response time and strengthens threat investigations
What is our primary use case?
I have been using CrowdStrike Falcon for the past two years. My main use case for CrowdStrike Falcon is endpoint protection, threat protection, and investigating suspicious activities on endpoints in my day-to-day work.
In one case, we received an alert about suspicious PowerShell activities detected on one of the endpoints, and CrowdStrike Falcon detected the issue and generated an alert on our SIM solution as well. We started investigating that endpoint using CrowdStrike Falcon, confirming through the process tree that there was suspicious execution, and we began isolating the endpoint device to prevent further impact. That is how we used CrowdStrike Falcon for monitoring and investigating endpoint devices.
We also use CrowdStrike Falcon for endpoint activities and for responding to malware alerts, which is a significant part of our process.
What is most valuable?
CrowdStrike Falcon offers several features that stand out to me, including a feature called Process Tree visibility, where we can see the entire attack history including how it started, how it initiated the connection, how it ended, and the intentions behind that particular incident. Additionally, it has great threat intelligence data, isolation automation, detailed process visibility, a real-time threat blocking system, and behavioral threat detection that helps in responding to incidents on endpoints. These are the best features I have ever used.
I wish more people knew about the Process Tree visibility feature because it helps to understand the full attack chain quickly, making it a very impactful feature I have ever used.
CrowdStrike Falcon has positively impacted my organization by improving endpoint security. Even if end users are doing something on their endpoints without their knowledge, such as receiving documents from vendors, the endpoints will scan attachments before delivery, and if they are malicious, it will detect them and provide notifications and alerts. It has positively impacted endpoint security and reduced the response time for incidents and alerts.
In my experience, I noticed that the Mean Time To Respond (MTTR) has reduced by around 30 to 40 percent due to faster detection and response achieved by the Falcon agents.
What needs improvement?
CrowdStrike Falcon requires experience and knowledge about tuning, as proper tuning is required. Improvement could focus on this aspect, as well as simplifying the user interface for new users and different department employees, since it sometimes generates a lot of false positives. They should concentrate on this as well.
They can work on better reporting and simplifying the interface to enhance the overall user experience.
CrowdStrike Falcon provides very good visibility into endpoint activity, including process execution and behavior. It is not only useful for the security department; it is beneficial for other departments as well. If something happens, even developers can log into CrowdStrike Falcon to check what is happening with their endpoints. Every tool should be built with this capability in mind, including CrowdStrike Falcon, which could also work on improving user interface design.
What do I think about the stability of the solution?
CrowdStrike Falcon is stable, with no major issues I have faced.
What do I think about the scalability of the solution?
CrowdStrike Falcon is highly scalable.
How are customer service and support?
The customer support is good, and I have reached out to them.
Which solution did I use previously and why did I switch?
We were previously using SentinelOne and Microsoft Defender but switched to CrowdStrike Falcon for better detection capabilities, especially for a client handling numerous attachments and endpoint activities.
What was our ROI?
I have seen a return on investment due to strong detection and faster response capabilities of CrowdStrike Falcon.
What's my experience with pricing, setup cost, and licensing?
The pricing, according to my knowledge, is subscription-based, depending on how many endpoints and modules the organization needs to use.
Which other solutions did I evaluate?
Before choosing CrowdStrike Falcon, we evaluated SentinelOne and Microsoft Defender because we needed better detection and visibility.
What other advice do I have?
My advice for others looking into using CrowdStrike Falcon is to have a clear understanding of how to properly fine-tune and monitor the system to get the full benefits. If they are good at these aspects, they can confidently purchase it and start working towards endpoint protection.
CrowdStrike Falcon is a strong solution with faster responses to endpoint-related incidents and alerts. Overall, it is a very robust solution for organizations dealing with endpoint security, and they can confidently choose CrowdStrike Falcon and make it work effectively. I would rate this product a 9 out of 10.
Crowdstrike Helps Your Technical Health, and Mental Health
What do you like best about the product?
The fact that the platform is so insanely robust and granular is an absolute lifesaver. I can make my rules ridiculously complicated if I want to, or I can set up more of a “set and forget” approach that I don’t have to think about again until something actually triggers. The detection rating feels unmatched—the platform gathers more threat intelligence than almost anyone else in the world—and that has been a complete game changer for us. No more spending all day hunting through false positives, and no more overly complex reports that don’t make sense and are frustrating to explain to management. Everything is there, it’s ready, and it’s exportable. You can do just about anything with Crowdstrike, and when I say that, I quite literally mean it.
If you want to sleep at night knowing your organization is protected with what I consider the best protection available on the market, I’d strongly suggest going with Crowdstrike. I’m personally sleeping better at night, and members of my team are far less stressed on weekends—we’re no longer dreading a call that our infrastructure has been compromised.
We use this as our main source of protection across our entire enterprise.
What do you dislike about the product?
It's a complex beast to master - it takes time. That's not even really a dislike, it's more of a fact. If you want to be able to fully understand the product, and use all of the features to their fullest, you need to sit down, and do some training and education. Anything worth using though, takes time to master.
What problems is the product solving and how is that benefiting you?
The ever present issue of a breach - if we are breached, we know that response and remediation will take place in minutes, not hours or days. You can do everything right, but the end user is always going to be your weakest link, and the juciest target. However, while users maybe juicy targets, Crowdstrikes Spotlight Vulnerability Mangement platform gives me the ability to patch Windows on the fly, and show me what other third programs need to be patched as well. Not only that, but the remediation time frame window reports, and the general reporting ability of Spotlight is amazing. The reports are straightforward and easy to read for non-technical members of management. They aren't focused on flashy statistics - they're focused on giving you a no frills picture of what's going on in your environment.
Feature-Rich EDR
What do you like best about the product?
It has features you don't see in other technologies; it's a fantastic EDR and offers plenty of options for configuration and customization—something that's difficult to find in other technologies.
What do you dislike about the product?
The learning curve is steep, and there are many modules that change frequently
What problems is the product solving and how is that benefiting you?
Implementing better security policies to strengthen teams against potential breaches, using RTR connections to deploy scripts, and the new approach CrowdStrike is taking with SIEM help provide greater visibility into events as they occur.
Peace of Mind with 24/7 Threat Detection
What do you like best about the product?
I love that with CrowdStrike Falcon Endpoint Protection Platform, I don't have to worry about my endpoints. If there's a problem, they take care of it and notify me, which allows me to sleep much better at night knowing that CrowdStrike Falcon has our back. The platform is worth every penny. It's very easy to set up, and we were able to automate the deployment of the agent, making it very helpful for our team.
What do you dislike about the product?
Absolutely nothing!
What problems is the product solving and how is that benefiting you?
I use CrowdStrike Falcon Endpoint Protection Platform for threat detection, 24/7 endpoint monitoring, and remediation, allowing us to avoid hiring a round-the-clock internal staff.
