Centralized threat visibility has improved detection speed and strengthened endpoint protection
What is our primary use case?
Our company has been using CrowdStrike Falcon for about 2 years. During that time, it has been a great help in detecting and responding to various security threats. We mainly use it for endpoint security management.
CrowdStrike Falcon is used in various ways in our company. It has been especially effective in detecting and blocking unknown malware or ransomware attacks in real time. For example, recently CrowdStrike Falcon immediately detected a phishing link that came in via an employee's email and prevented it from spreading across the entire network. It also plays a big role in monitoring the security status of remote workers' devices and consistently applying security policies.
We have had real experiences with threat detection. At one point, CrowdStrike Falcon's behavioral analysis detected activity in our system that was different from normal patterns and flagged it as suspicious. Investigation revealed that it was part of a new type of APT attack, and fortunately, we were able to block it in the early stage. In that process, I felt that CrowdStrike Falcon's behavior-based detection technology played the biggest role. It would have been difficult to detect using traditional signature-based methods.
What is most valuable?
After that incident, we strengthened our internal response process for phishing attacks. We started to immediately analyze threat information detected by CrowdStrike Falcon and set up additional automated rules to proactively block similar types of attacks. Compared to before we adopted CrowdStrike Falcon, the biggest improvement has been in visibility into security threats and response speed. In the past, we had to manually analyze logs from multiple security solutions, but now we can see all threat information at a glance and respond quickly from a single CrowdStrike Falcon console.
Thanks to CrowdStrike Falcon's cloud-based architecture, deployment and management were very lightweight. With our previous solutions, the agents were heavy and sometimes affected system performance. But we had no such issues with CrowdStrike Falcon. In terms of cost, although there was some initial investment, by consolidating multiple security tools into one and increasing operational efficiency, I feel it is definitely worth the investment in the long term.
CrowdStrike Falcon's greatest strength is its real-time threat detection and response capabilities. In particular, its detection method based on indicators of attack is very effective at blocking even unknown threats. Another big advantage is that because it uses a lightweight agent and a cloud-native approach, it provides strong security without performance degradation.
The integrated threat intelligence feature in CrowdStrike Falcon provides detailed background information on detected threats, the attacker's tactics, and correlations with other attacks, which greatly helps our analysis team quickly understand the severity of threats and respond appropriately. The user interface is intuitive, so new team members took very little time to adapt to CrowdStrike Falcon.
What needs improvement?
CrowdStrike Falcon is a very powerful tool, but at times the high initial adoption cost can be burdensome. To get the maximum benefit, as in our case where we integrate it with other security systems, a certain level of expertise is required, which is somewhat disappointing. Sometimes updates can cause unexpected issues in the system, so rigorous pre-testing is essential, and that is another point of concern.
In the future, I would like to see even smoother integration with other security tools. If more flexible pricing models or SMB-focused packages were introduced so that small and medium-sized businesses can adopt it without too much burden, I think many more organizations could benefit.
For how long have I used the solution?
I have been working in this field for about 5 years. I started as a security engineer and now I mainly handle analysis work.
What do I think about the stability of the solution?
CrowdStrike Falcon's stability is rated very highly. During the period we have used it at our company, we have not experienced any system downtime or unexpected errors caused by security-related stability issues. However, as I mentioned earlier regarding updates, we are always mindful that content configuration updates can potentially cause problems. I believe thorough pre-testing and phased rollout are essential.
What do I think about the scalability of the solution?
We also have experience with scalability. As our company grew and the number of endpoints increased, CrowdStrike Falcon scaled without any issues. Because it is cloud-based, we were able to integrate many devices in real time without installing additional hardware, and we did not notice any performance degradation. We gained confidence that we could maintain stable security even as the organization grew.
How are customer service and support?
I have experience with CrowdStrike's customer support. When we introduced CrowdStrike Falcon, we needed technical support due to integration issues with our existing systems, and the support team responded very quickly and professionally. They understood our special network configuration and provided tailored solutions, which allowed us to resolve the issue quickly. Overall, satisfaction with customer support is quite high.
I would give the customer support service an 8. The professional help was very useful, but occasionally the wait time was longer than expected.
Which solution did I use previously and why did I switch?
We used a few other solutions before adopting CrowdStrike Falcon. We evaluated traditional antivirus programs and other EDR products. The decisive reason we switched to CrowdStrike Falcon was the real-time threat detection capability and overwhelming analysis speed. In particular, CrowdStrike Falcon's behavior-based detection technology was far superior to other products, and the lightweight agent allowed us to strengthen security without worrying about system performance degradation, which was important.
How was the initial setup?
I would like to mention CrowdStrike Falcon's API extensibility. We have integrated CrowdStrike Falcon with our existing Security Information and Event Management system, that is, SIEM, so we can centrally manage and analyze security alerts. This has greatly improved the efficiency of our security operations.
The automation feature that helped the most when integrating with SIEM was the process where a critical alert in CrowdStrike Falcon automatically creates a ticket in the SIEM and sends a notification to the person in charge. This greatly reduced response delays. The difficult part of the integration process was aligning the log formats of the different systems, but thanks to the documentation and support provided by CrowdStrike, we were able to resolve it relatively smoothly.
What was our ROI?
CrowdStrike Falcon has had several positive impacts on our company. First of all, it has greatly reduced the time required to analyze and respond to security threats, allowing team members to focus on more important and strategic security tasks. By preventing actual security breaches, we were able to avoid potential business losses and raise our security level to a higher tier.
Based on our internal analysis, our average threat response time has been reduced by about 30 percent compared to before. The false positive rate, that is, the number of false alarms, has dropped significantly, while the number of valid alerts that the security team actually has to handle has decreased by more than 50 percent. This prevented unnecessary resource waste and allowed us to respond more efficiently to security threats.
We also saw effects in workforce optimization. As the false positive rate decreased and analysis efficiency increased, the security team was able to safely manage more endpoints than before with fewer people. Thanks to that, we could reassign the freed-up staff to other important tasks such as threat hunting and strengthening security policies.
What's my experience with pricing, setup cost, and licensing?
As I mentioned earlier, the initial adoption cost is somewhat high, and there is a certain level of difficulty involved in integrating it with other security systems, which is a drawback. Sometimes unexpected issues can occur after updates, so rigorous pre-testing is essential—this is another aspect I would like to see improved.
In terms of pricing, we use the enterprise bundle, and while the initial cost was somewhat high, considering the wide range of features and the security benefits, we determined that the investment was worthwhile. We contracted licenses based on the number of users, and it was nice that they could be flexibly adjusted to fit our company's size.
Which other solutions did I evaluate?
There were solutions we compared. For example, Microsoft Defender for Endpoint had the advantage of good integration with existing Microsoft environments and was cost-effective. SentinelOne, on the other hand, had excellent AI-based automation, but we felt it consumed a lot of system resources. CrowdStrike Falcon struck the best balance between performance and efficiency, and we gave it the highest score especially in its ability to detect unknown threats.
What other advice do I have?
If I were to advise other companies considering adopting CrowdStrike Falcon, I would say they should not only look at its powerful security features but also thoroughly evaluate whether it fits their current environment and threat profile. In particular, it is essential to develop a thorough integration plan with existing systems and to establish an update management process to ensure stable operations. I would also recommend actively leveraging customer support if needed. My overall review rating for CrowdStrike Falcon is 9.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
