Clean UI and strong performance are my favorite things. “Falcon Cloud Security provides us with actionable AI-driven intelligence, smooth integration with our security tools and simplifies threat monitoring. Onboarding and support is solid and the overall security value for the investment feels good. Review collected by and hosted on G2.com.

The main disadvantage is that some advanced features take some time to be understood, especially for new users. Pricing can also get steep for smaller teams, and a few integrations may be easier to set up. The support is good but the response time isn’t always that good. Review collected by and hosted on G2.com.

What I like most is that it cuts through the noise. Instead of a giant list of findings, I get things that are actually worth acting on, with enough context to know what to fix first. And since it's part of the Falcon platform, our cloud posture sits right next to everything else instead of being a separate tool I have to check. Review collected by and hosted on G2.com.

Not a huge complaint, but the UI can feel crowded when you're first getting into it. There's a lot of capability in there, which is good, but it means you're clicking around more than you'd like until you build your own muscle memory. Once you're used to it, it's fine — the first couple weeks were the rough part for me. Review collected by and hosted on G2.com.

What I like best about CrowdStrike Falcon Cloud Security is its unified approach to cloud security. It provides strong visibility across cloud environments, helps identify misconfigurations and vulnerabilities, and makes it easier to prioritise risks from one platform. The real-time threat detection and integration with the broader Falcon platform are also valuable, especially for teams looking to reduce the number of separate security tools they need to manage. Review collected by and hosted on G2.com.

One downside of CrowdStrike Falcon Cloud Security is that it can feel complex at first, especially for teams that are new to the Falcon platform. There can be a learning curve when configuring policies and navigating some of the more advanced features. Pricing can also be relatively high compared with simpler cloud security solutions, particularly for smaller organisations. Review collected by and hosted on G2.com.

Having cloud security in the same Falcon console we already use for endpoints is the main benefit for our SOC. Analysts investigate cloud and host activity in one place, with the same workflows and response actions. Posture findings (misconfigurations and indicators of misconfiguration) are clear and prioritised, which helps us give clients concrete remediation advice. Onboarding cloud accounts is quick, and the combination of agentless scanning with the sensor on workloads gives good coverage without heavy deployment effort. Review collected by and hosted on G2.com.

Licensing is split across several modules, which makes scoping and pricing for clients harder than it should be. The volume of posture findings can be high at first, and tuning it to what matters for each client takes time. Reporting is limited for a managed-service provider: client-ready summaries still require exporting data and processing it outside the platform. Documentation for some cloud-specific API use cases could be more complete. Review collected by and hosted on G2.com.

Unified "One Agent" Architecture: CrowdStrike’s biggest advantage is its lightweight Falcon Sensor. It combines a kernel-mode driver with a user-mode service that operates across desktops, servers, and cloud workloads. This eliminates the need for organizations to deploy multiple heavy, competing security agents, drastically reducing CPU overhead and simplifying deployment. Review collected by and hosted on G2.com.

Occasional Kernel Issues: Because the Falcon sensor operates at the kernel level for maximum visibility and tamper-resistance, any faulty updates pushed by the vendor can have catastrophic, system-wide impacts—such as the massive, highly publicized global IT outage in mid-2024 that caused millions of Windows machines to crash into a "Blue Screen of Death". Review collected by and hosted on G2.com.

What impresses me most is how seamlessly it brings AWS, Azure, and GCP into a single, cohesive narrative without forcing us to choose between configuration posture and live threat protection. Instead of juggling fragmented tools across different providers, Falcon marries agentless posture management with lightweight runtime protection right inside the broader Falcon ecosystem. Being able to trace an exposed storage bucket or an overly permissive IAM role directly down to an active, running process in a Kubernetes container—and instantly correlating that with endpoint telemetry—gives our security team an unrivaled, full-spectrum view of our multi-cloud footprint.The most significant operational benefit is the drastic reduction in alert noise alongside the freedom it gives our engineering teams to move fast. Rather than drowning analysts in thousands of low-severity notifications, Falcon synthesizes scattered risk signals into prioritized, highly actionable attack storylines that drastically slash our time to detect and respond. It plugs smoothly into our CI/CD pipelines, allowing our DevOps engineers to spin up microservices and push code daily without hitting security speed bumps, as new assets are automatically discovered and guarded the moment they go live. Ultimately, it turned cloud security from a constant source of operational anxiety into a quiet, continuous advantage. Review collected by and hosted on G2.com.

While the platform's core visibility is top-tier, the query language and custom reporting present a noticeable learning curve. When you move beyond the out-of-the-box dashboards to build custom queries or tailored threat-hunting reports across cloud events, you run into complex syntax that takes weeks of hands-on practice to master. Additionally, the initial setup can feel overwhelming due to the sheer volume of default notifications. Until you spend dedicated time tuning policies, establishing operational baselines, and filtering out routine developer activities, Tier 1 analysts can quickly get bogged down by a flood of low-severity findings. Review collected by and hosted on G2.com.

One thing that makes it easy for me is being able to see the alerting that’s part of my organization. It lets me quickly look across different parts of the organization’s cloud instances and understand what’s going on. I can find critical information like IOMs, IoAs, DSPM, and vulnerabilities all in one place. With just a few clicks, I’m able to get what I need. Review collected by and hosted on G2.com.

One thing that can be difficult is getting all the information quickly. Sometimes I have to check different sections to find what I’m looking for. I’ve found a workaround by creating a bookmark for the section I need. Review collected by and hosted on G2.com.

What I appreciate most is the unified Detections Dashboard, which centralizes security telemetry across our entire multi-cloud estate. The proprietary CrowdScore metric has been extremely reliable for us; it contextualizes and aggregates huge volumes of raw detection data into a single, actionable priority level, so my team can quickly see what needs immediate mitigation instead of constantly battling alert fatigue. On top of that, the platform delivers seamless runtime protection and deep visibility into complex host events—whether it’s catching malicious credential access or spotting unauthorized execution via PowerShell—without adding any noticeable resource overhead to our active cloud infrastructure. Review collected by and hosted on G2.com.

The main challenge I’ve had with Falcon Cloud Security is the steep learning curve involved in fully mastering its advanced search features and deeper tactical modules. The highly granular interface can feel overwhelming at first, especially during initial setup and when onboarding junior analysts. In addition, the pricing and licensing structure can be fairly restrictive when you need to scale host coverage up or down across fluctuating staging environments, which makes budget forecasting more difficult for rapidly evolving infrastructure setups. Review collected by and hosted on G2.com.

Crowd Strike Falcon is one of the strongest endpoint detection and response platform on the market and one of the hardest to fit cleanly into the MSP. P and L

It costed us roughly $60 per device per year entry level. Up to $200 to 400 per end point. Per year for fully managed Falcon, complete at scale. That was the really good part about this. Review collected by and hosted on G2.com.

The biggest drawbacks are the cost and the complexity, especially for SMBs with heavy books. And the July 2024 outage is still fresh in my mind. Review collected by and hosted on G2.com.

What I like most is that cloud posture management lives in the same console as our endpoint detections. As an admin, I don’t have to stitch together findings from two separate tools, which makes it much easier to review and act on what we’re seeing. The exploitability-based prioritization on misconfiguration findings has also been genuinely useful, it's kept us focused on the handful of issues that actually matter instead of drowning in every low-severity finding by default. Review collected by and hosted on G2.com.

The default alert volume was our biggest pain point. Right out of the gate, we were getting flagged for a lot of things our org had already reviewed and accepted as an acceptable risk. As a result, the first few weeks took real effort to write suppression rules and custom policies just to get the signal-to-noise ratio to something manageable; not exactly what we want to be spending time on during an initial rollout. Review collected by and hosted on G2.com.